# Flog Txt Version 1 # Analyzer Version: 4.7.1 # Analyzer Build Date: Nov 21 2022 05:40:14 # Log Creation Date: 27.12.2022 08:17:03.577 Process: id = "1" image_name = "319fbb2dd26045a90a452eb26799c6529f8a77ad8d7b967aec58111e25b12cd5.exe" filename = "c:\\users\\rdhj0cnfevzx\\desktop\\319fbb2dd26045a90a452eb26799c6529f8a77ad8d7b967aec58111e25b12cd5.exe" page_root = "0x5bd3b000" os_pid = "0x12b8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x670" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\319fbb2dd26045a90a452eb26799c6529f8a77ad8d7b967aec58111e25b12cd5.exe\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f213" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 118 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 119 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 120 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 121 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 122 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 123 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 124 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 125 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 126 start_va = 0x400000 end_va = 0x408fff monitored = 1 entry_point = 0x4021d1 region_type = mapped_file name = "319fbb2dd26045a90a452eb26799c6529f8a77ad8d7b967aec58111e25b12cd5.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\319fbb2dd26045a90a452eb26799c6529f8a77ad8d7b967aec58111e25b12cd5.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\319fbb2dd26045a90a452eb26799c6529f8a77ad8d7b967aec58111e25b12cd5.exe") Region: id = 127 start_va = 0x77760000 end_va = 0x778dafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 128 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 129 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 130 start_va = 0x7fff0000 end_va = 0x7ffd0d94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 131 start_va = 0x7ffd0d950000 end_va = 0x7ffd0db10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 132 start_va = 0x7ffd0db11000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffd0db11000" filename = "" Region: id = 271 start_va = 0x410000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 272 start_va = 0x700a0000 end_va = 0x700effff monitored = 0 entry_point = 0x700b8180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 273 start_va = 0x70020000 end_va = 0x70099fff monitored = 0 entry_point = 0x70033290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 274 start_va = 0x77340000 end_va = 0x7741ffff monitored = 0 entry_point = 0x77353980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 275 start_va = 0x700f0000 end_va = 0x700f7fff monitored = 0 entry_point = 0x700f17c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 276 start_va = 0x510000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 277 start_va = 0x77340000 end_va = 0x7741ffff monitored = 0 entry_point = 0x77353980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 278 start_va = 0x75580000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75631b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 279 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 280 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 281 start_va = 0x410000 end_va = 0x4cdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 282 start_va = 0x500000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 283 start_va = 0x743e0000 end_va = 0x74471fff monitored = 0 entry_point = 0x74420380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 284 start_va = 0x7fb00000 end_va = 0x7fea0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 285 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 286 start_va = 0x77420000 end_va = 0x7749afff monitored = 0 entry_point = 0x7743e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 287 start_va = 0x753c0000 end_va = 0x7547dfff monitored = 0 entry_point = 0x753f5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 288 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 289 start_va = 0x510000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 290 start_va = 0x620000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 291 start_va = 0x776b0000 end_va = 0x776f3fff monitored = 0 entry_point = 0x776c9d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 292 start_va = 0x74e90000 end_va = 0x74f3cfff monitored = 0 entry_point = 0x74ea4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 293 start_va = 0x74490000 end_va = 0x744adfff monitored = 0 entry_point = 0x7449b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 294 start_va = 0x74480000 end_va = 0x74489fff monitored = 0 entry_point = 0x74482a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 295 start_va = 0x772c0000 end_va = 0x77317fff monitored = 0 entry_point = 0x773025c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 296 start_va = 0x75210000 end_va = 0x7535efff monitored = 0 entry_point = 0x752c6820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 297 start_va = 0x70140000 end_va = 0x701d1fff monitored = 0 entry_point = 0x7014dd60 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll") Region: id = 298 start_va = 0x74f40000 end_va = 0x75086fff monitored = 0 entry_point = 0x74f51cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 299 start_va = 0x75960000 end_va = 0x76d5efff monitored = 0 entry_point = 0x75b1b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 300 start_va = 0x75540000 end_va = 0x75576fff monitored = 0 entry_point = 0x75543b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 301 start_va = 0x74820000 end_va = 0x74d18fff monitored = 0 entry_point = 0x74a27610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 302 start_va = 0x75700000 end_va = 0x758bcfff monitored = 0 entry_point = 0x757e2a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 303 start_va = 0x74df0000 end_va = 0x74e34fff monitored = 0 entry_point = 0x74e0de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 304 start_va = 0x77320000 end_va = 0x7732bfff monitored = 0 entry_point = 0x77323930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 305 start_va = 0x77230000 end_va = 0x772bcfff monitored = 0 entry_point = 0x77279b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 306 start_va = 0x74e40000 end_va = 0x74e83fff monitored = 0 entry_point = 0x74e47410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 307 start_va = 0x75530000 end_va = 0x7553efff monitored = 0 entry_point = 0x75532e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 308 start_va = 0x720000 end_va = 0x91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 309 start_va = 0x4d0000 end_va = 0x4f9fff monitored = 0 entry_point = 0x4d5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 310 start_va = 0x720000 end_va = 0x8a7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000720000" filename = "" Region: id = 311 start_va = 0x910000 end_va = 0x91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 312 start_va = 0x76df0000 end_va = 0x76e1afff monitored = 0 entry_point = 0x76df5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 313 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 314 start_va = 0x4d0000 end_va = 0x4d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 315 start_va = 0x920000 end_va = 0xaa0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000920000" filename = "" Region: id = 316 start_va = 0xab0000 end_va = 0x1eaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 317 start_va = 0x1eb0000 end_va = 0x1f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001eb0000" filename = "" Region: id = 318 start_va = 0x1f60000 end_va = 0x20bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 319 start_va = 0x70110000 end_va = 0x70137fff monitored = 0 entry_point = 0x70117820 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 320 start_va = 0x6f7d0000 end_va = 0x6f840fff monitored = 0 entry_point = 0x6f8269e0 region_type = mapped_file name = "efswrt.dll" filename = "\\Windows\\SysWOW64\\efswrt.dll" (normalized: "c:\\windows\\syswow64\\efswrt.dll") Region: id = 321 start_va = 0x774a0000 end_va = 0x77531fff monitored = 0 entry_point = 0x774d8cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 322 start_va = 0x70240000 end_va = 0x70307fff monitored = 0 entry_point = 0x702aae90 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\SysWOW64\\WinTypes.dll" (normalized: "c:\\windows\\syswow64\\wintypes.dll") Region: id = 323 start_va = 0x20c0000 end_va = 0x21a9fff monitored = 0 entry_point = 0x20fd650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 324 start_va = 0x6f780000 end_va = 0x6f7c8fff monitored = 0 entry_point = 0x6f786450 region_type = mapped_file name = "edputil.dll" filename = "\\Windows\\SysWOW64\\edputil.dll" (normalized: "c:\\windows\\syswow64\\edputil.dll") Region: id = 325 start_va = 0x20c0000 end_va = 0x23f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 326 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 327 start_va = 0x1d0000 end_va = 0x1d4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\user32.dll.mui") Region: id = 328 start_va = 0x2400000 end_va = 0x28f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002400000" filename = "" Region: id = 329 start_va = 0x2900000 end_va = 0x393ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 330 start_va = 0x73240000 end_va = 0x732b4fff monitored = 0 entry_point = 0x73279a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 331 start_va = 0x510000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 332 start_va = 0x3940000 end_va = 0x3a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003940000" filename = "" Region: id = 333 start_va = 0x3a70000 end_va = 0x3a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a70000" filename = "" Region: id = 334 start_va = 0x77540000 end_va = 0x7765efff monitored = 0 entry_point = 0x77585980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 335 start_va = 0x1e0000 end_va = 0x1e3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 336 start_va = 0x550000 end_va = 0x60bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 337 start_va = 0x71930000 end_va = 0x7194cfff monitored = 0 entry_point = 0x71933b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 338 start_va = 0x1f0000 end_va = 0x1f3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 339 start_va = 0x4e0000 end_va = 0x4e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004e0000" filename = "" Region: id = 340 start_va = 0x1eb0000 end_va = 0x1f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001eb0000" filename = "" Region: id = 341 start_va = 0x1f50000 end_va = 0x1f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f50000" filename = "" Region: id = 342 start_va = 0x74720000 end_va = 0x7480afff monitored = 0 entry_point = 0x7475d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Thread: id = 1 os_tid = 0x12bc [0055.974] GetProcessHeap () returned 0x620000 [0055.975] FindResourceA (hModule=0x0, lpName=0xe, lpType=0x2) returned 0x408090 [0055.975] SizeofResource (hModule=0x0, hResInfo=0x408090) returned 0x43a [0055.975] LoadResource (hModule=0x0, hResInfo=0x408090) returned 0x4080f0 [0055.975] LockResource (hResData=0x4080f0) returned 0x4080f0 [0055.975] RtlMoveMemory (in: Destination=0x406db9, Source=0x4080f0, Length=0x10 | out: Destination=0x406db9) [0055.976] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x166) returned 0x631c68 [0055.976] RtlMoveMemory (in: Destination=0x631c68, Source=0x408104, Length=0x166 | out: Destination=0x631c68) [0055.976] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x270) returned 0x638fe0 [0055.976] RtlMoveMemory (in: Destination=0x638fe0, Source=0x40826e, Length=0x270 | out: Destination=0x638fe0) [0055.976] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x3) returned 0x626dc0 [0055.976] RtlMoveMemory (in: Destination=0x626dc0, Source=0x4084e2, Length=0x3 | out: Destination=0x626dc0) [0055.976] RtlMoveMemory (in: Destination=0x406dc9, Source=0x4084e5, Length=0x10 | out: Destination=0x406dc9) [0055.976] RtlMoveMemory (in: Destination=0x407529, Source=0x4084f5, Length=0x5 | out: Destination=0x407529) [0055.976] RtlMoveMemory (in: Destination=0x406dd9, Source=0x4084fa, Length=0x10 | out: Destination=0x406dd9) [0055.976] RtlMoveMemory (in: Destination=0x406de9, Source=0x40850a, Length=0x10 | out: Destination=0x406de9) [0055.976] RtlMoveMemory (in: Destination=0x407525, Source=0x40851a, Length=0x4 | out: Destination=0x407525) [0055.976] RtlMoveMemory (in: Destination=0x4065a5, Source=0x40851e, Length=0x4 | out: Destination=0x4065a5) [0055.976] RtlMoveMemory (in: Destination=0x4065a9, Source=0x408522, Length=0x4 | out: Destination=0x4065a9) [0055.976] RtlMoveMemory (in: Destination=0x4065ad, Source=0x408526, Length=0x4 | out: Destination=0x4065ad) [0055.976] FreeResource (hResData=0x4080f0) returned 0 [0055.976] GetTempPathA (in: nBufferLength=0x200, lpBuffer=0x404e50 | out: lpBuffer="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 0x25 [0055.976] lstrcpyA (in: lpString1=0x405950, lpString2="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\" [0055.976] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x405450, nSize=0x500 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\319fbb2dd26045a90a452eb26799c6529f8a77ad8d7b967aec58111e25b12cd5.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\319fbb2dd26045a90a452eb26799c6529f8a77ad8d7b967aec58111e25b12cd5.exe")) returned 0x62 [0055.976] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x14e988) returned 0x1f6c020 [0055.983] GetWindowsDirectoryA (in: lpBuffer=0x40755e, uSize=0x200 | out: lpBuffer="C:\\Windows") returned 0xa [0055.983] PathAddBackslashA (in: pszPath="C:\\Windows" | out: pszPath="C:\\Windows\\") returned="" [0055.983] lstrcatA (in: lpString1="C:\\Windows\\", lpString2="explorer.exe" | out: lpString1="C:\\Windows\\explorer.exe") returned="C:\\Windows\\explorer.exe" [0055.983] CreateFileA (lpFileName="C:\\Windows\\explorer.exe" (normalized: "c:\\windows\\explorer.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.983] GetFileTime (in: hFile=0x174, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556 | out: lpCreationTime=0x407546*(dwLowDateTime=0x220ad5e0, dwHighDateTime=0x1d112e3), lpLastAccessTime=0x40754e*(dwLowDateTime=0x220ad5e0, dwHighDateTime=0x1d112e3), lpLastWriteTime=0x407556*(dwLowDateTime=0x220ad5e0, dwHighDateTime=0x1d112e3)) returned 1 [0055.983] CloseHandle (hObject=0x174) returned 1 [0055.983] lstrcatA (in: lpString1="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", lpString2="WU17sDZVZ12PQjL" | out: lpString1="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\WU17sDZVZ12PQjL") returned="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\WU17sDZVZ12PQjL" [0055.983] lstrcatA (in: lpString1="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\WU17sDZVZ12PQjL", lpString2=".exe" | out: lpString1="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\WU17sDZVZ12PQjL.exe") returned="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\WU17sDZVZ12PQjL.exe" [0055.983] CopyFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\319fbb2dd26045a90a452eb26799c6529f8a77ad8d7b967aec58111e25b12cd5.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\319fbb2dd26045a90a452eb26799c6529f8a77ad8d7b967aec58111e25b12cd5.exe"), lpNewFileName="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\WU17sDZVZ12PQjL.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\wu17sdzvz12pqjl.exe"), bFailIfExists=1) returned 1 [0056.215] CreateFileA (lpFileName="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\WU17sDZVZ12PQjL.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\wu17sdzvz12pqjl.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0056.215] SetFileTime (hFile=0x174, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.215] CloseHandle (hObject=0x174) returned 1 [0056.215] RegCreateKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x19ff64, lpdwDisposition=0x19ff68 | out: phkResult=0x19ff64*=0x174, lpdwDisposition=0x19ff68*=0x2) returned 0x0 [0056.216] lstrlenA (lpString="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\WU17sDZVZ12PQjL.exe") returned 56 [0056.216] RegSetValueExA (in: hKey=0x174, lpValueName="Alcmeter", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\WU17sDZVZ12PQjL.exe", cbData=0x38 | out: lpData="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\WU17sDZVZ12PQjL.exe") returned 0x0 [0056.216] RegCloseKey (hKey=0x174) returned 0x0 [0056.216] lstrcpyA (in: lpString1=0x4065b9, lpString2="." | out: lpString1=".") returned="." [0056.216] lstrcatA (in: lpString1=".", lpString2="BD" | out: lpString1=".BD") returned=".BD" [0056.216] RegCreateKeyExA (in: hKey=0x80000000, lpSubKey=".BD", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x19ff60, lpdwDisposition=0x19ff64 | out: phkResult=0x19ff60*=0x1ba, lpdwDisposition=0x19ff64*=0x1) returned 0x0 [0056.222] lstrlenA (lpString="ZFUOCNFJDMPZDFQ") returned 15 [0056.222] RegSetValueExA (in: hKey=0x1ba, lpValueName="", Reserved=0x0, dwType=0x1, lpData="ZFUOCNFJDMPZDFQ", cbData=0xf | out: lpData="ZFUOCNFJDMPZDFQ") returned 0x0 [0056.222] RegCloseKey (hKey=0x1ba) returned 0x0 [0056.222] RegCreateKeyExA (in: hKey=0x80000000, lpSubKey="ZFUOCNFJDMPZDFQ", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x19ff60, lpdwDisposition=0x19ff64 | out: phkResult=0x19ff60*=0x17a, lpdwDisposition=0x19ff64*=0x1) returned 0x0 [0056.228] lstrlenA (lpString="CRYPTED!") returned 8 [0056.228] RegSetValueExA (in: hKey=0x17a, lpValueName="", Reserved=0x0, dwType=0x1, lpData="CRYPTED!", cbData=0x8 | out: lpData="CRYPTED!") returned 0x0 [0056.229] RegCloseKey (hKey=0x17a) returned 0x0 [0056.229] lstrcpyA (in: lpString1=0x4065b9, lpString2="ZFUOCNFJDMPZDFQ" | out: lpString1="ZFUOCNFJDMPZDFQ") returned="ZFUOCNFJDMPZDFQ" [0056.229] lstrcatA (in: lpString1="ZFUOCNFJDMPZDFQ", lpString2="\\DefaultIcon" | out: lpString1="ZFUOCNFJDMPZDFQ\\DefaultIcon") returned="ZFUOCNFJDMPZDFQ\\DefaultIcon" [0056.229] lstrcatA (in: lpString1="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\WU17sDZVZ12PQjL.exe", lpString2=",0" | out: lpString1="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\WU17sDZVZ12PQjL.exe,0") returned="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\WU17sDZVZ12PQjL.exe,0" [0056.229] RegCreateKeyExA (in: hKey=0x80000000, lpSubKey="ZFUOCNFJDMPZDFQ\\DefaultIcon", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x19ff60, lpdwDisposition=0x19ff64 | out: phkResult=0x19ff60*=0x1ba, lpdwDisposition=0x19ff64*=0x1) returned 0x0 [0056.230] lstrlenA (lpString="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\WU17sDZVZ12PQjL.exe,0") returned 58 [0056.230] RegSetValueExA (in: hKey=0x1ba, lpValueName="", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\WU17sDZVZ12PQjL.exe,0", cbData=0x3a | out: lpData="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\WU17sDZVZ12PQjL.exe,0") returned 0x0 [0056.230] RegCloseKey (hKey=0x1ba) returned 0x0 [0056.230] lstrcpyA (in: lpString1=0x4065b9, lpString2="ZFUOCNFJDMPZDFQ" | out: lpString1="ZFUOCNFJDMPZDFQ") returned="ZFUOCNFJDMPZDFQ" [0056.230] lstrcatA (in: lpString1="ZFUOCNFJDMPZDFQ", lpString2="\\shell\\open\\command" | out: lpString1="ZFUOCNFJDMPZDFQ\\shell\\open\\command") returned="ZFUOCNFJDMPZDFQ\\shell\\open\\command" [0056.230] lstrlenA (lpString="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\WU17sDZVZ12PQjL.exe,0") returned 58 [0056.230] RegCreateKeyExA (in: hKey=0x80000000, lpSubKey="ZFUOCNFJDMPZDFQ\\shell\\open\\command", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x19ff60, lpdwDisposition=0x19ff64 | out: phkResult=0x19ff60*=0x1be, lpdwDisposition=0x19ff64*=0x1) returned 0x0 [0056.231] lstrlenA (lpString="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\WU17sDZVZ12PQjL.exe") returned 56 [0056.231] RegSetValueExA (in: hKey=0x1be, lpValueName="", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\WU17sDZVZ12PQjL.exe", cbData=0x38 | out: lpData="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\WU17sDZVZ12PQjL.exe") returned 0x0 [0056.231] RegCloseKey (hKey=0x1be) returned 0x0 [0056.231] SetErrorMode (uMode=0x1) returned 0x0 [0056.231] GetLogicalDrives () returned 0x4 [0056.232] FindFirstFileA (in: lpFileName="C:\\*.*" (normalized: "c:\\*.*"), lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x19fef4, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x636670 [0056.232] lstrcmpA (lpString1=".", lpString2="$Recycle.Bin") returned 1 [0056.235] lstrcmpA (lpString1="..", lpString2="$Recycle.Bin") returned 1 [0056.235] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0056.235] lstrcatA (in: lpString1="C:\\", lpString2="$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0056.235] lstrlenA (lpString="C:\\$Recycle.Bin") returned 15 [0056.236] FindFirstFileA (in: lpFileName="C:\\$Recycle.Bin\\*.*" (normalized: "c:\\$recycle.bin\\*.*"), lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x77b1180e, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x77b1180e, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62a870, dwReserved1=0x63b838, cFileName=".", cAlternateFileName="")) returned 0x6368f0 [0056.236] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.236] FindNextFileA (in: hFindFile=0x6368f0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x77b1180e, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x77b1180e, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62a870, dwReserved1=0x63b838, cFileName="..", cAlternateFileName="")) returned 1 [0056.236] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.236] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.236] FindNextFileA (in: hFindFile=0x6368f0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x77b1180e, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x77b1180e, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x77b1180e, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62a870, dwReserved1=0x63b838, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0056.236] lstrcmpA (lpString1=".", lpString2="S-1-5-18") returned -1 [0056.236] lstrcmpA (lpString1="..", lpString2="S-1-5-18") returned -1 [0056.236] PathFindFileNameA (pszPath="C:\\$Recycle.Bin\\*.*") returned="*.*" [0056.236] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\", lpString2="S-1-5-18" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18") returned="C:\\$Recycle.Bin\\S-1-5-18" [0056.236] lstrlenA (lpString="C:\\$Recycle.Bin\\S-1-5-18") returned 24 [0056.236] FindFirstFileA (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*.*" (normalized: "c:\\$recycle.bin\\s-1-5-18\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x77b1180e, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x77b1180e, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x77b1180e, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63c848, dwReserved1=0x63c840, cFileName=".", cAlternateFileName="")) returned 0x6369f0 [0056.237] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.237] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x77b1180e, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x77b1180e, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x77b1180e, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63c848, dwReserved1=0x63c840, cFileName="..", cAlternateFileName="")) returned 1 [0056.237] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.237] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.237] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x77b1180e, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x77b1180e, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x77b1180e, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x63c848, dwReserved1=0x63c840, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0056.237] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.237] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0056.237] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0056.237] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0056.237] PathFindFileNameA (pszPath="C:\\$Recycle.Bin\\S-1-5-18\\*.*") returned="*.*" [0056.238] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\$Recycle.Bin\\S-1-5-18\\" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\") returned="C:\\$Recycle.Bin\\S-1-5-18\\" [0056.238] PathAddBackslashA (in: pszPath="C:\\$Recycle.Bin\\S-1-5-18\\" | out: pszPath="C:\\$Recycle.Bin\\S-1-5-18\\") returned="" [0056.238] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\HOW TO DECRYPT FILES.txt") returned="C:\\$Recycle.Bin\\S-1-5-18\\HOW TO DECRYPT FILES.txt" [0056.238] GetFileAttributesA (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\$recycle.bin\\s-1-5-18\\how to decrypt files.txt")) returned 0xffffffff [0056.238] CreateFileA (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\$recycle.bin\\s-1-5-18\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.238] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.238] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.241] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.241] CloseHandle (hObject=0x1c4) returned 1 [0056.242] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\", lpString2="desktop.ini" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" [0056.242] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.zip") returned 0 [0056.243] lstrlenA (lpString="*.zip") returned 5 [0056.243] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.rar") returned 0 [0056.243] lstrlenA (lpString="*.rar") returned 5 [0056.243] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.7z") returned 0 [0056.243] lstrlenA (lpString="*.7z") returned 4 [0056.243] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.tar") returned 0 [0056.243] lstrlenA (lpString="*.tar") returned 5 [0056.243] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.gzip") returned 0 [0056.243] lstrlenA (lpString="*.gzip") returned 6 [0056.243] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.jpg") returned 0 [0056.243] lstrlenA (lpString="*.jpg") returned 5 [0056.243] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.jpeg") returned 0 [0056.243] lstrlenA (lpString="*.jpeg") returned 6 [0056.243] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.psd") returned 0 [0056.243] lstrlenA (lpString="*.psd") returned 5 [0056.243] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.cdr") returned 0 [0056.243] lstrlenA (lpString="*.cdr") returned 5 [0056.243] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.dwg") returned 0 [0056.243] lstrlenA (lpString="*.dwg") returned 5 [0056.243] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.max") returned 0 [0056.243] lstrlenA (lpString="*.max") returned 5 [0056.243] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.bmp") returned 0 [0056.243] lstrlenA (lpString="*.bmp") returned 5 [0056.243] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.gif") returned 0 [0056.243] lstrlenA (lpString="*.gif") returned 5 [0056.243] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.png") returned 0 [0056.244] lstrlenA (lpString="*.png") returned 5 [0056.244] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.doc") returned 0 [0056.244] lstrlenA (lpString="*.doc") returned 5 [0056.244] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.docx") returned 0 [0056.244] lstrlenA (lpString="*.docx") returned 6 [0056.244] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.xls") returned 0 [0056.244] lstrlenA (lpString="*.xls") returned 5 [0056.244] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.xlsx") returned 0 [0056.244] lstrlenA (lpString="*.xlsx") returned 6 [0056.244] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.ppt") returned 0 [0056.244] lstrlenA (lpString="*.ppt") returned 5 [0056.244] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.pptx") returned 0 [0056.244] lstrlenA (lpString="*.pptx") returned 6 [0056.244] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.txt") returned 0 [0056.244] lstrlenA (lpString="*.txt") returned 5 [0056.244] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.pdf") returned 0 [0056.244] lstrlenA (lpString="*.pdf") returned 5 [0056.244] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.djvu") returned 0 [0056.244] lstrlenA (lpString="*.djvu") returned 6 [0056.244] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.htm") returned 0 [0056.244] lstrlenA (lpString="*.htm") returned 5 [0056.244] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.html") returned 0 [0056.244] lstrlenA (lpString="*.html") returned 6 [0056.244] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.mdb") returned 0 [0056.244] lstrlenA (lpString="*.mdb") returned 5 [0056.244] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.cer") returned 0 [0056.244] lstrlenA (lpString="*.cer") returned 5 [0056.244] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.p12") returned 0 [0056.245] lstrlenA (lpString="*.p12") returned 5 [0056.245] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.pfx") returned 0 [0056.245] lstrlenA (lpString="*.pfx") returned 5 [0056.245] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.kwm") returned 0 [0056.245] lstrlenA (lpString="*.kwm") returned 5 [0056.245] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.pwm") returned 0 [0056.245] lstrlenA (lpString="*.pwm") returned 5 [0056.245] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.1cd") returned 0 [0056.245] lstrlenA (lpString="*.1cd") returned 5 [0056.245] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.md") returned 0 [0056.245] lstrlenA (lpString="*.md") returned 4 [0056.245] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.mdf") returned 0 [0056.245] lstrlenA (lpString="*.mdf") returned 5 [0056.245] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.dbf") returned 0 [0056.245] lstrlenA (lpString="*.dbf") returned 5 [0056.245] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.odt") returned 0 [0056.245] lstrlenA (lpString="*.odt") returned 5 [0056.245] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.vob") returned 0 [0056.245] lstrlenA (lpString="*.vob") returned 5 [0056.245] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.ifo") returned 0 [0056.245] lstrlenA (lpString="*.ifo") returned 5 [0056.245] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.lnk") returned 0 [0056.245] lstrlenA (lpString="*.lnk") returned 5 [0056.245] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.torrent") returned 0 [0056.245] lstrlenA (lpString="*.torrent") returned 9 [0056.245] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.mov") returned 0 [0056.246] lstrlenA (lpString="*.mov") returned 5 [0056.246] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.m2v") returned 0 [0056.246] lstrlenA (lpString="*.m2v") returned 5 [0056.246] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.3gp") returned 0 [0056.246] lstrlenA (lpString="*.3gp") returned 5 [0056.246] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.mpeg") returned 0 [0056.246] lstrlenA (lpString="*.mpeg") returned 6 [0056.246] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.mpg") returned 0 [0056.246] lstrlenA (lpString="*.mpg") returned 5 [0056.246] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.flv") returned 0 [0056.246] lstrlenA (lpString="*.flv") returned 5 [0056.246] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.avi") returned 0 [0056.246] lstrlenA (lpString="*.avi") returned 5 [0056.246] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.mp4") returned 0 [0056.246] lstrlenA (lpString="*.mp4") returned 5 [0056.246] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.wmv") returned 0 [0056.246] lstrlenA (lpString="*.wmv") returned 5 [0056.246] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.divx") returned 0 [0056.246] lstrlenA (lpString="*.divx") returned 6 [0056.246] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.mkv") returned 0 [0056.246] lstrlenA (lpString="*.mkv") returned 5 [0056.246] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.mp3") returned 0 [0056.246] lstrlenA (lpString="*.mp3") returned 5 [0056.246] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.wav") returned 0 [0056.246] lstrlenA (lpString="*.wav") returned 5 [0056.246] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.flac") returned 0 [0056.246] lstrlenA (lpString="*.flac") returned 6 [0056.247] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.ape") returned 0 [0056.247] lstrlenA (lpString="*.ape") returned 5 [0056.247] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.wma") returned 0 [0056.247] lstrlenA (lpString="*.wma") returned 5 [0056.247] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.ac3") returned 0 [0056.247] lstrlenA (lpString="*.ac3") returned 5 [0056.247] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x77b1180e, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x77b1180e, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x77b1180e, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x63c848, dwReserved1=0x63c840, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0056.247] FindClose (in: hFindFile=0x6369f0 | out: hFindFile=0x6369f0) returned 1 [0056.247] FindNextFileA (in: hFindFile=0x6368f0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x913b261b, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x913b261b, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x913b261b, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62f540, dwReserved1=0x7, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0056.247] lstrcmpA (lpString1=".", lpString2="S-1-5-21-1560258661-3990802383-1811730007-1000") returned -1 [0056.247] lstrcmpA (lpString1="..", lpString2="S-1-5-21-1560258661-3990802383-1811730007-1000") returned -1 [0056.247] PathFindFileNameA (pszPath="C:\\$Recycle.Bin\\*.*") returned="*.*" [0056.247] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\", lpString2="S-1-5-21-1560258661-3990802383-1811730007-1000" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000") returned="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000" [0056.247] lstrlenA (lpString="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000") returned 62 [0056.247] FindFirstFileA (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\*.*" (normalized: "c:\\$recycle.bin\\s-1-5-21-1560258661-3990802383-1811730007-1000\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x913b261b, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x913b261b, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x913b261b, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6, dwReserved1=0x7000007, cFileName=".", cAlternateFileName="")) returned 0x636b30 [0056.248] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.248] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x913b261b, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x913b261b, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x913b261b, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6, dwReserved1=0x7000007, cFileName="..", cAlternateFileName="")) returned 1 [0056.248] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.248] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.248] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x913b261b, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x913b261b, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x913b261b, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x6, dwReserved1=0x7000007, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0056.248] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.248] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0056.248] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0056.248] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0056.248] PathFindFileNameA (pszPath="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\*.*") returned="*.*" [0056.248] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\") returned="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\" [0056.248] PathAddBackslashA (in: pszPath="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\" | out: pszPath="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\") returned="" [0056.248] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\HOW TO DECRYPT FILES.txt") returned="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\HOW TO DECRYPT FILES.txt" [0056.248] GetFileAttributesA (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\$recycle.bin\\s-1-5-21-1560258661-3990802383-1811730007-1000\\how to decrypt files.txt")) returned 0xffffffff [0056.248] CreateFileA (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\$recycle.bin\\s-1-5-21-1560258661-3990802383-1811730007-1000\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.253] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.253] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.254] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.254] CloseHandle (hObject=0x1c4) returned 1 [0056.254] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\", lpString2="desktop.ini" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini") returned="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini" [0056.254] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.zip") returned 0 [0056.254] lstrlenA (lpString="*.zip") returned 5 [0056.255] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.rar") returned 0 [0056.255] lstrlenA (lpString="*.rar") returned 5 [0056.255] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.7z") returned 0 [0056.255] lstrlenA (lpString="*.7z") returned 4 [0056.255] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.tar") returned 0 [0056.255] lstrlenA (lpString="*.tar") returned 5 [0056.255] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.gzip") returned 0 [0056.255] lstrlenA (lpString="*.gzip") returned 6 [0056.255] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.jpg") returned 0 [0056.256] lstrlenA (lpString="*.jpg") returned 5 [0056.256] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.jpeg") returned 0 [0056.256] lstrlenA (lpString="*.jpeg") returned 6 [0056.256] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.psd") returned 0 [0056.256] lstrlenA (lpString="*.psd") returned 5 [0056.256] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.cdr") returned 0 [0056.256] lstrlenA (lpString="*.cdr") returned 5 [0056.256] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.dwg") returned 0 [0056.256] lstrlenA (lpString="*.dwg") returned 5 [0056.256] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.max") returned 0 [0056.256] lstrlenA (lpString="*.max") returned 5 [0056.256] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.bmp") returned 0 [0056.256] lstrlenA (lpString="*.bmp") returned 5 [0056.256] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.gif") returned 0 [0056.256] lstrlenA (lpString="*.gif") returned 5 [0056.256] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.png") returned 0 [0056.256] lstrlenA (lpString="*.png") returned 5 [0056.256] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.doc") returned 0 [0056.256] lstrlenA (lpString="*.doc") returned 5 [0056.256] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.docx") returned 0 [0056.256] lstrlenA (lpString="*.docx") returned 6 [0056.256] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.xls") returned 0 [0056.256] lstrlenA (lpString="*.xls") returned 5 [0056.256] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.xlsx") returned 0 [0056.256] lstrlenA (lpString="*.xlsx") returned 6 [0056.257] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.ppt") returned 0 [0056.257] lstrlenA (lpString="*.ppt") returned 5 [0056.257] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.pptx") returned 0 [0056.257] lstrlenA (lpString="*.pptx") returned 6 [0056.257] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.txt") returned 0 [0056.257] lstrlenA (lpString="*.txt") returned 5 [0056.257] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.pdf") returned 0 [0056.257] lstrlenA (lpString="*.pdf") returned 5 [0056.257] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.djvu") returned 0 [0056.257] lstrlenA (lpString="*.djvu") returned 6 [0056.257] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.htm") returned 0 [0056.257] lstrlenA (lpString="*.htm") returned 5 [0056.257] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.html") returned 0 [0056.257] lstrlenA (lpString="*.html") returned 6 [0056.257] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.mdb") returned 0 [0056.257] lstrlenA (lpString="*.mdb") returned 5 [0056.257] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.cer") returned 0 [0056.257] lstrlenA (lpString="*.cer") returned 5 [0056.257] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.p12") returned 0 [0056.257] lstrlenA (lpString="*.p12") returned 5 [0056.257] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.pfx") returned 0 [0056.257] lstrlenA (lpString="*.pfx") returned 5 [0056.257] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.kwm") returned 0 [0056.257] lstrlenA (lpString="*.kwm") returned 5 [0056.257] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.pwm") returned 0 [0056.258] lstrlenA (lpString="*.pwm") returned 5 [0056.258] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.1cd") returned 0 [0056.258] lstrlenA (lpString="*.1cd") returned 5 [0056.258] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.md") returned 0 [0056.258] lstrlenA (lpString="*.md") returned 4 [0056.258] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.mdf") returned 0 [0056.258] lstrlenA (lpString="*.mdf") returned 5 [0056.258] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.dbf") returned 0 [0056.258] lstrlenA (lpString="*.dbf") returned 5 [0056.258] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.odt") returned 0 [0056.258] lstrlenA (lpString="*.odt") returned 5 [0056.258] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.vob") returned 0 [0056.258] lstrlenA (lpString="*.vob") returned 5 [0056.258] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.ifo") returned 0 [0056.258] lstrlenA (lpString="*.ifo") returned 5 [0056.258] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.lnk") returned 0 [0056.258] lstrlenA (lpString="*.lnk") returned 5 [0056.258] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.torrent") returned 0 [0056.258] lstrlenA (lpString="*.torrent") returned 9 [0056.258] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.mov") returned 0 [0056.258] lstrlenA (lpString="*.mov") returned 5 [0056.258] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.m2v") returned 0 [0056.258] lstrlenA (lpString="*.m2v") returned 5 [0056.258] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.3gp") returned 0 [0056.258] lstrlenA (lpString="*.3gp") returned 5 [0056.258] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.mpeg") returned 0 [0056.258] lstrlenA (lpString="*.mpeg") returned 6 [0056.259] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.mpg") returned 0 [0056.259] lstrlenA (lpString="*.mpg") returned 5 [0056.259] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.flv") returned 0 [0056.259] lstrlenA (lpString="*.flv") returned 5 [0056.259] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.avi") returned 0 [0056.259] lstrlenA (lpString="*.avi") returned 5 [0056.259] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.mp4") returned 0 [0056.259] lstrlenA (lpString="*.mp4") returned 5 [0056.259] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.wmv") returned 0 [0056.259] lstrlenA (lpString="*.wmv") returned 5 [0056.259] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.divx") returned 0 [0056.259] lstrlenA (lpString="*.divx") returned 6 [0056.259] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.mkv") returned 0 [0056.259] lstrlenA (lpString="*.mkv") returned 5 [0056.259] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.mp3") returned 0 [0056.259] lstrlenA (lpString="*.mp3") returned 5 [0056.259] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.wav") returned 0 [0056.259] lstrlenA (lpString="*.wav") returned 5 [0056.259] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.flac") returned 0 [0056.259] lstrlenA (lpString="*.flac") returned 6 [0056.259] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.ape") returned 0 [0056.259] lstrlenA (lpString="*.ape") returned 5 [0056.259] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.wma") returned 0 [0056.259] lstrlenA (lpString="*.wma") returned 5 [0056.259] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini", pszSpec="*.ac3") returned 0 [0056.260] lstrlenA (lpString="*.ac3") returned 5 [0056.260] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x913b261b, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x913b261b, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x913b261b, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x6, dwReserved1=0x7000007, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0056.260] FindClose (in: hFindFile=0x636b30 | out: hFindFile=0x636b30) returned 1 [0056.260] FindNextFileA (in: hFindFile=0x6368f0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x913b261b, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x913b261b, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x913b261b, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62f540, dwReserved1=0x7, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0056.260] FindClose (in: hFindFile=0x6368f0 | out: hFindFile=0x6368f0) returned 1 [0056.260] FindNextFileA (in: hFindFile=0x636670, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x19fef4, cFileName="Boot", cAlternateFileName="")) returned 1 [0056.260] lstrcmpA (lpString1=".", lpString2="Boot") returned -1 [0056.260] lstrcmpA (lpString1="..", lpString2="Boot") returned -1 [0056.260] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0056.260] lstrcatA (in: lpString1="C:\\", lpString2="Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0056.260] lstrlenA (lpString="C:\\Boot") returned 7 [0056.260] FindFirstFileA (in: lpFileName="C:\\Boot\\*.*" (normalized: "c:\\boot\\*.*"), lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b74525, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b74525, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63c848, dwReserved1=0x63c840, cFileName=".", cAlternateFileName="")) returned 0x636b30 [0056.261] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.261] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b74525, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b74525, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63c848, dwReserved1=0x63c840, cFileName="..", cAlternateFileName="")) returned 1 [0056.263] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.263] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.263] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b74525, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x7068766, ftLastAccessTime.dwHighDateTime=0x1d8c107, ftLastWriteTime.dwLowDateTime=0x7068766, ftLastWriteTime.dwHighDateTime=0x1d8c107, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x63c848, dwReserved1=0x63c840, cFileName="BCD", cAlternateFileName="")) returned 1 [0056.263] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0056.263] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BCD") returned 1 [0056.263] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCD") returned 1 [0056.263] lstrcmpiA (lpString1="", lpString2="BCD") returned -1 [0056.263] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.263] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0056.263] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned="" [0056.263] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt" [0056.263] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0xffffffff [0056.263] CreateFileA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0056.265] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.265] WriteFile (in: hFile=0x1c0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.267] SetFileTime (hFile=0x1c0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.267] CloseHandle (hObject=0x1c0) returned 1 [0056.267] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BCD" | out: lpString1="C:\\Boot\\BCD") returned="C:\\Boot\\BCD" [0056.267] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.zip") returned 0 [0056.267] lstrlenA (lpString="*.zip") returned 5 [0056.267] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.rar") returned 0 [0056.267] lstrlenA (lpString="*.rar") returned 5 [0056.267] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.7z") returned 0 [0056.268] lstrlenA (lpString="*.7z") returned 4 [0056.268] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.tar") returned 0 [0056.268] lstrlenA (lpString="*.tar") returned 5 [0056.268] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.gzip") returned 0 [0056.268] lstrlenA (lpString="*.gzip") returned 6 [0056.268] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.jpg") returned 0 [0056.268] lstrlenA (lpString="*.jpg") returned 5 [0056.268] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.jpeg") returned 0 [0056.268] lstrlenA (lpString="*.jpeg") returned 6 [0056.268] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.psd") returned 0 [0056.268] lstrlenA (lpString="*.psd") returned 5 [0056.268] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.cdr") returned 0 [0056.268] lstrlenA (lpString="*.cdr") returned 5 [0056.268] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.dwg") returned 0 [0056.268] lstrlenA (lpString="*.dwg") returned 5 [0056.268] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.max") returned 0 [0056.268] lstrlenA (lpString="*.max") returned 5 [0056.268] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.bmp") returned 0 [0056.268] lstrlenA (lpString="*.bmp") returned 5 [0056.268] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.gif") returned 0 [0056.268] lstrlenA (lpString="*.gif") returned 5 [0056.268] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.png") returned 0 [0056.268] lstrlenA (lpString="*.png") returned 5 [0056.268] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.doc") returned 0 [0056.268] lstrlenA (lpString="*.doc") returned 5 [0056.268] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.docx") returned 0 [0056.268] lstrlenA (lpString="*.docx") returned 6 [0056.269] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.xls") returned 0 [0056.269] lstrlenA (lpString="*.xls") returned 5 [0056.269] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.xlsx") returned 0 [0056.269] lstrlenA (lpString="*.xlsx") returned 6 [0056.269] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.ppt") returned 0 [0056.269] lstrlenA (lpString="*.ppt") returned 5 [0056.269] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.pptx") returned 0 [0056.269] lstrlenA (lpString="*.pptx") returned 6 [0056.269] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.txt") returned 0 [0056.269] lstrlenA (lpString="*.txt") returned 5 [0056.269] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.pdf") returned 0 [0056.269] lstrlenA (lpString="*.pdf") returned 5 [0056.269] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.djvu") returned 0 [0056.269] lstrlenA (lpString="*.djvu") returned 6 [0056.269] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.htm") returned 0 [0056.269] lstrlenA (lpString="*.htm") returned 5 [0056.269] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.html") returned 0 [0056.269] lstrlenA (lpString="*.html") returned 6 [0056.269] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mdb") returned 0 [0056.269] lstrlenA (lpString="*.mdb") returned 5 [0056.269] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.cer") returned 0 [0056.269] lstrlenA (lpString="*.cer") returned 5 [0056.269] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.p12") returned 0 [0056.269] lstrlenA (lpString="*.p12") returned 5 [0056.269] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.pfx") returned 0 [0056.269] lstrlenA (lpString="*.pfx") returned 5 [0056.269] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.kwm") returned 0 [0056.270] lstrlenA (lpString="*.kwm") returned 5 [0056.270] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.pwm") returned 0 [0056.270] lstrlenA (lpString="*.pwm") returned 5 [0056.270] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.1cd") returned 0 [0056.270] lstrlenA (lpString="*.1cd") returned 5 [0056.270] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.md") returned 0 [0056.270] lstrlenA (lpString="*.md") returned 4 [0056.270] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mdf") returned 0 [0056.270] lstrlenA (lpString="*.mdf") returned 5 [0056.270] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.dbf") returned 0 [0056.270] lstrlenA (lpString="*.dbf") returned 5 [0056.270] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.odt") returned 0 [0056.270] lstrlenA (lpString="*.odt") returned 5 [0056.270] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.vob") returned 0 [0056.270] lstrlenA (lpString="*.vob") returned 5 [0056.270] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.ifo") returned 0 [0056.270] lstrlenA (lpString="*.ifo") returned 5 [0056.270] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.lnk") returned 0 [0056.270] lstrlenA (lpString="*.lnk") returned 5 [0056.270] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.torrent") returned 0 [0056.270] lstrlenA (lpString="*.torrent") returned 9 [0056.274] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mov") returned 0 [0056.274] lstrlenA (lpString="*.mov") returned 5 [0056.274] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.m2v") returned 0 [0056.275] lstrlenA (lpString="*.m2v") returned 5 [0056.275] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.3gp") returned 0 [0056.275] lstrlenA (lpString="*.3gp") returned 5 [0056.275] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mpeg") returned 0 [0056.275] lstrlenA (lpString="*.mpeg") returned 6 [0056.275] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mpg") returned 0 [0056.275] lstrlenA (lpString="*.mpg") returned 5 [0056.275] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.flv") returned 0 [0056.275] lstrlenA (lpString="*.flv") returned 5 [0056.275] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.avi") returned 0 [0056.275] lstrlenA (lpString="*.avi") returned 5 [0056.275] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mp4") returned 0 [0056.275] lstrlenA (lpString="*.mp4") returned 5 [0056.275] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.wmv") returned 0 [0056.275] lstrlenA (lpString="*.wmv") returned 5 [0056.275] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.divx") returned 0 [0056.275] lstrlenA (lpString="*.divx") returned 6 [0056.275] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mkv") returned 0 [0056.275] lstrlenA (lpString="*.mkv") returned 5 [0056.275] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mp3") returned 0 [0056.275] lstrlenA (lpString="*.mp3") returned 5 [0056.275] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.wav") returned 0 [0056.275] lstrlenA (lpString="*.wav") returned 5 [0056.275] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.flac") returned 0 [0056.275] lstrlenA (lpString="*.flac") returned 6 [0056.275] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.ape") returned 0 [0056.275] lstrlenA (lpString="*.ape") returned 5 [0056.275] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.wma") returned 0 [0056.276] lstrlenA (lpString="*.wma") returned 5 [0056.276] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.ac3") returned 0 [0056.276] lstrlenA (lpString="*.ac3") returned 5 [0056.276] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x78b74525, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b74525, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b74525, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x6, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0056.276] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0056.276] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BCD.LOG") returned 1 [0056.276] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCD.LOG") returned 1 [0056.276] lstrcmpiA (lpString1="", lpString2="BCD.LOG") returned -1 [0056.276] PathFindFileNameA (pszPath="C:\\Boot\\BCD") returned="BCD" [0056.276] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0056.276] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned="" [0056.276] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt" [0056.276] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20 [0056.276] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG" | out: lpString1="C:\\Boot\\BCD.LOG") returned="C:\\Boot\\BCD.LOG" [0056.276] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.zip") returned 0 [0056.276] lstrlenA (lpString="*.zip") returned 5 [0056.276] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.rar") returned 0 [0056.276] lstrlenA (lpString="*.rar") returned 5 [0056.276] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.7z") returned 0 [0056.276] lstrlenA (lpString="*.7z") returned 4 [0056.277] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.tar") returned 0 [0056.277] lstrlenA (lpString="*.tar") returned 5 [0056.277] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.gzip") returned 0 [0056.277] lstrlenA (lpString="*.gzip") returned 6 [0056.277] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.jpg") returned 0 [0056.277] lstrlenA (lpString="*.jpg") returned 5 [0056.277] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.jpeg") returned 0 [0056.277] lstrlenA (lpString="*.jpeg") returned 6 [0056.277] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.psd") returned 0 [0056.277] lstrlenA (lpString="*.psd") returned 5 [0056.277] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.cdr") returned 0 [0056.277] lstrlenA (lpString="*.cdr") returned 5 [0056.277] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.dwg") returned 0 [0056.277] lstrlenA (lpString="*.dwg") returned 5 [0056.277] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.max") returned 0 [0056.277] lstrlenA (lpString="*.max") returned 5 [0056.277] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.bmp") returned 0 [0056.277] lstrlenA (lpString="*.bmp") returned 5 [0056.277] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.gif") returned 0 [0056.277] lstrlenA (lpString="*.gif") returned 5 [0056.277] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.png") returned 0 [0056.277] lstrlenA (lpString="*.png") returned 5 [0056.277] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.doc") returned 0 [0056.277] lstrlenA (lpString="*.doc") returned 5 [0056.277] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.docx") returned 0 [0056.277] lstrlenA (lpString="*.docx") returned 6 [0056.277] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.xls") returned 0 [0056.278] lstrlenA (lpString="*.xls") returned 5 [0056.278] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.xlsx") returned 0 [0056.278] lstrlenA (lpString="*.xlsx") returned 6 [0056.278] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.ppt") returned 0 [0056.278] lstrlenA (lpString="*.ppt") returned 5 [0056.278] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.pptx") returned 0 [0056.278] lstrlenA (lpString="*.pptx") returned 6 [0056.278] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.txt") returned 0 [0056.278] lstrlenA (lpString="*.txt") returned 5 [0056.278] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.pdf") returned 0 [0056.278] lstrlenA (lpString="*.pdf") returned 5 [0056.278] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.djvu") returned 0 [0056.278] lstrlenA (lpString="*.djvu") returned 6 [0056.278] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.htm") returned 0 [0056.278] lstrlenA (lpString="*.htm") returned 5 [0056.278] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.html") returned 0 [0056.278] lstrlenA (lpString="*.html") returned 6 [0056.278] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mdb") returned 0 [0056.278] lstrlenA (lpString="*.mdb") returned 5 [0056.278] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.cer") returned 0 [0056.278] lstrlenA (lpString="*.cer") returned 5 [0056.278] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.p12") returned 0 [0056.278] lstrlenA (lpString="*.p12") returned 5 [0056.278] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.pfx") returned 0 [0056.278] lstrlenA (lpString="*.pfx") returned 5 [0056.278] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.kwm") returned 0 [0056.278] lstrlenA (lpString="*.kwm") returned 5 [0056.279] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.pwm") returned 0 [0056.279] lstrlenA (lpString="*.pwm") returned 5 [0056.279] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.1cd") returned 0 [0056.279] lstrlenA (lpString="*.1cd") returned 5 [0056.279] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.md") returned 0 [0056.279] lstrlenA (lpString="*.md") returned 4 [0056.279] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mdf") returned 0 [0056.279] lstrlenA (lpString="*.mdf") returned 5 [0056.279] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.dbf") returned 0 [0056.279] lstrlenA (lpString="*.dbf") returned 5 [0056.279] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.odt") returned 0 [0056.279] lstrlenA (lpString="*.odt") returned 5 [0056.279] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.vob") returned 0 [0056.279] lstrlenA (lpString="*.vob") returned 5 [0056.279] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.ifo") returned 0 [0056.279] lstrlenA (lpString="*.ifo") returned 5 [0056.279] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.lnk") returned 0 [0056.279] lstrlenA (lpString="*.lnk") returned 5 [0056.279] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.torrent") returned 0 [0056.279] lstrlenA (lpString="*.torrent") returned 9 [0056.279] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mov") returned 0 [0056.279] lstrlenA (lpString="*.mov") returned 5 [0056.279] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.m2v") returned 0 [0056.279] lstrlenA (lpString="*.m2v") returned 5 [0056.279] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.3gp") returned 0 [0056.279] lstrlenA (lpString="*.3gp") returned 5 [0056.279] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mpeg") returned 0 [0056.279] lstrlenA (lpString="*.mpeg") returned 6 [0056.280] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mpg") returned 0 [0056.280] lstrlenA (lpString="*.mpg") returned 5 [0056.280] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.flv") returned 0 [0056.280] lstrlenA (lpString="*.flv") returned 5 [0056.280] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.avi") returned 0 [0056.280] lstrlenA (lpString="*.avi") returned 5 [0056.280] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mp4") returned 0 [0056.280] lstrlenA (lpString="*.mp4") returned 5 [0056.280] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.wmv") returned 0 [0056.280] lstrlenA (lpString="*.wmv") returned 5 [0056.280] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.divx") returned 0 [0056.280] lstrlenA (lpString="*.divx") returned 6 [0056.280] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mkv") returned 0 [0056.280] lstrlenA (lpString="*.mkv") returned 5 [0056.280] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mp3") returned 0 [0056.280] lstrlenA (lpString="*.mp3") returned 5 [0056.280] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.wav") returned 0 [0056.280] lstrlenA (lpString="*.wav") returned 5 [0056.280] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.flac") returned 0 [0056.280] lstrlenA (lpString="*.flac") returned 6 [0056.280] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.ape") returned 0 [0056.280] lstrlenA (lpString="*.ape") returned 5 [0056.280] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.wma") returned 0 [0056.280] lstrlenA (lpString="*.wma") returned 5 [0056.280] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.ac3") returned 0 [0056.280] lstrlenA (lpString="*.ac3") returned 5 [0056.281] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x78b74525, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b74525, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b74525, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0056.281] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0056.281] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BCD.LOG1") returned 1 [0056.281] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCD.LOG1") returned 1 [0056.281] lstrcmpiA (lpString1="", lpString2="BCD.LOG1") returned -1 [0056.281] PathFindFileNameA (pszPath="C:\\Boot\\BCD.LOG") returned="BCD.LOG" [0056.281] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0056.281] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned="" [0056.281] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt" [0056.281] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20 [0056.281] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG1" | out: lpString1="C:\\Boot\\BCD.LOG1") returned="C:\\Boot\\BCD.LOG1" [0056.281] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.zip") returned 0 [0056.281] lstrlenA (lpString="*.zip") returned 5 [0056.281] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.rar") returned 0 [0056.281] lstrlenA (lpString="*.rar") returned 5 [0056.281] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.7z") returned 0 [0056.281] lstrlenA (lpString="*.7z") returned 4 [0056.281] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.tar") returned 0 [0056.281] lstrlenA (lpString="*.tar") returned 5 [0056.281] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.gzip") returned 0 [0056.282] lstrlenA (lpString="*.gzip") returned 6 [0056.282] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.jpg") returned 0 [0056.282] lstrlenA (lpString="*.jpg") returned 5 [0056.282] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.jpeg") returned 0 [0056.282] lstrlenA (lpString="*.jpeg") returned 6 [0056.282] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.psd") returned 0 [0056.282] lstrlenA (lpString="*.psd") returned 5 [0056.282] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.cdr") returned 0 [0056.282] lstrlenA (lpString="*.cdr") returned 5 [0056.282] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.dwg") returned 0 [0056.282] lstrlenA (lpString="*.dwg") returned 5 [0056.282] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.max") returned 0 [0056.282] lstrlenA (lpString="*.max") returned 5 [0056.282] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.bmp") returned 0 [0056.282] lstrlenA (lpString="*.bmp") returned 5 [0056.282] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.gif") returned 0 [0056.282] lstrlenA (lpString="*.gif") returned 5 [0056.282] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.png") returned 0 [0056.282] lstrlenA (lpString="*.png") returned 5 [0056.282] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.doc") returned 0 [0056.282] lstrlenA (lpString="*.doc") returned 5 [0056.282] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.docx") returned 0 [0056.282] lstrlenA (lpString="*.docx") returned 6 [0056.282] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.xls") returned 0 [0056.282] lstrlenA (lpString="*.xls") returned 5 [0056.282] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.xlsx") returned 0 [0056.282] lstrlenA (lpString="*.xlsx") returned 6 [0056.283] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.ppt") returned 0 [0056.283] lstrlenA (lpString="*.ppt") returned 5 [0056.283] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.pptx") returned 0 [0056.283] lstrlenA (lpString="*.pptx") returned 6 [0056.283] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.txt") returned 0 [0056.283] lstrlenA (lpString="*.txt") returned 5 [0056.283] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.pdf") returned 0 [0056.283] lstrlenA (lpString="*.pdf") returned 5 [0056.283] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.djvu") returned 0 [0056.283] lstrlenA (lpString="*.djvu") returned 6 [0056.283] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.htm") returned 0 [0056.283] lstrlenA (lpString="*.htm") returned 5 [0056.283] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.html") returned 0 [0056.283] lstrlenA (lpString="*.html") returned 6 [0056.283] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mdb") returned 0 [0056.283] lstrlenA (lpString="*.mdb") returned 5 [0056.283] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.cer") returned 0 [0056.283] lstrlenA (lpString="*.cer") returned 5 [0056.283] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.p12") returned 0 [0056.283] lstrlenA (lpString="*.p12") returned 5 [0056.283] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.pfx") returned 0 [0056.283] lstrlenA (lpString="*.pfx") returned 5 [0056.283] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.kwm") returned 0 [0056.283] lstrlenA (lpString="*.kwm") returned 5 [0056.283] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.pwm") returned 0 [0056.283] lstrlenA (lpString="*.pwm") returned 5 [0056.283] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.1cd") returned 0 [0056.283] lstrlenA (lpString="*.1cd") returned 5 [0056.284] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.md") returned 0 [0056.284] lstrlenA (lpString="*.md") returned 4 [0056.284] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mdf") returned 0 [0056.284] lstrlenA (lpString="*.mdf") returned 5 [0056.284] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.dbf") returned 0 [0056.284] lstrlenA (lpString="*.dbf") returned 5 [0056.284] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.odt") returned 0 [0056.284] lstrlenA (lpString="*.odt") returned 5 [0056.284] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.vob") returned 0 [0056.284] lstrlenA (lpString="*.vob") returned 5 [0056.284] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.ifo") returned 0 [0056.284] lstrlenA (lpString="*.ifo") returned 5 [0056.284] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.lnk") returned 0 [0056.284] lstrlenA (lpString="*.lnk") returned 5 [0056.284] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.torrent") returned 0 [0056.284] lstrlenA (lpString="*.torrent") returned 9 [0056.284] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mov") returned 0 [0056.284] lstrlenA (lpString="*.mov") returned 5 [0056.284] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.m2v") returned 0 [0056.284] lstrlenA (lpString="*.m2v") returned 5 [0056.284] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.3gp") returned 0 [0056.284] lstrlenA (lpString="*.3gp") returned 5 [0056.284] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mpeg") returned 0 [0056.284] lstrlenA (lpString="*.mpeg") returned 6 [0056.284] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mpg") returned 0 [0056.284] lstrlenA (lpString="*.mpg") returned 5 [0056.284] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.flv") returned 0 [0056.284] lstrlenA (lpString="*.flv") returned 5 [0056.285] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.avi") returned 0 [0056.285] lstrlenA (lpString="*.avi") returned 5 [0056.285] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mp4") returned 0 [0056.285] lstrlenA (lpString="*.mp4") returned 5 [0056.285] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.wmv") returned 0 [0056.285] lstrlenA (lpString="*.wmv") returned 5 [0056.285] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.divx") returned 0 [0056.285] lstrlenA (lpString="*.divx") returned 6 [0056.285] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mkv") returned 0 [0056.285] lstrlenA (lpString="*.mkv") returned 5 [0056.285] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mp3") returned 0 [0056.285] lstrlenA (lpString="*.mp3") returned 5 [0056.285] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.wav") returned 0 [0056.285] lstrlenA (lpString="*.wav") returned 5 [0056.285] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.flac") returned 0 [0056.285] lstrlenA (lpString="*.flac") returned 6 [0056.285] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.ape") returned 0 [0056.285] lstrlenA (lpString="*.ape") returned 5 [0056.285] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.wma") returned 0 [0056.285] lstrlenA (lpString="*.wma") returned 5 [0056.285] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.ac3") returned 0 [0056.285] lstrlenA (lpString="*.ac3") returned 5 [0056.285] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x78b74525, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b74525, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b74525, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0056.285] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0056.285] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BCD.LOG2") returned 1 [0056.285] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCD.LOG2") returned 1 [0056.286] lstrcmpiA (lpString1="", lpString2="BCD.LOG2") returned -1 [0056.286] PathFindFileNameA (pszPath="C:\\Boot\\BCD.LOG1") returned="BCD.LOG1" [0056.286] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0056.286] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned="" [0056.286] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt" [0056.286] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20 [0056.286] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG2" | out: lpString1="C:\\Boot\\BCD.LOG2") returned="C:\\Boot\\BCD.LOG2" [0056.286] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.zip") returned 0 [0056.286] lstrlenA (lpString="*.zip") returned 5 [0056.286] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.rar") returned 0 [0056.286] lstrlenA (lpString="*.rar") returned 5 [0056.287] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.7z") returned 0 [0056.287] lstrlenA (lpString="*.7z") returned 4 [0056.287] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.tar") returned 0 [0056.287] lstrlenA (lpString="*.tar") returned 5 [0056.287] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.gzip") returned 0 [0056.287] lstrlenA (lpString="*.gzip") returned 6 [0056.287] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.jpg") returned 0 [0056.287] lstrlenA (lpString="*.jpg") returned 5 [0056.287] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.jpeg") returned 0 [0056.287] lstrlenA (lpString="*.jpeg") returned 6 [0056.287] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.psd") returned 0 [0056.287] lstrlenA (lpString="*.psd") returned 5 [0056.287] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.cdr") returned 0 [0056.287] lstrlenA (lpString="*.cdr") returned 5 [0056.287] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.dwg") returned 0 [0056.287] lstrlenA (lpString="*.dwg") returned 5 [0056.287] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.max") returned 0 [0056.287] lstrlenA (lpString="*.max") returned 5 [0056.287] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.bmp") returned 0 [0056.287] lstrlenA (lpString="*.bmp") returned 5 [0056.287] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.gif") returned 0 [0056.287] lstrlenA (lpString="*.gif") returned 5 [0056.287] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.png") returned 0 [0056.287] lstrlenA (lpString="*.png") returned 5 [0056.287] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.doc") returned 0 [0056.287] lstrlenA (lpString="*.doc") returned 5 [0056.287] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.docx") returned 0 [0056.287] lstrlenA (lpString="*.docx") returned 6 [0056.288] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.xls") returned 0 [0056.288] lstrlenA (lpString="*.xls") returned 5 [0056.288] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.xlsx") returned 0 [0056.288] lstrlenA (lpString="*.xlsx") returned 6 [0056.288] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.ppt") returned 0 [0056.288] lstrlenA (lpString="*.ppt") returned 5 [0056.288] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.pptx") returned 0 [0056.288] lstrlenA (lpString="*.pptx") returned 6 [0056.288] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.txt") returned 0 [0056.288] lstrlenA (lpString="*.txt") returned 5 [0056.288] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.pdf") returned 0 [0056.288] lstrlenA (lpString="*.pdf") returned 5 [0056.288] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.djvu") returned 0 [0056.288] lstrlenA (lpString="*.djvu") returned 6 [0056.288] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.htm") returned 0 [0056.288] lstrlenA (lpString="*.htm") returned 5 [0056.288] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.html") returned 0 [0056.288] lstrlenA (lpString="*.html") returned 6 [0056.288] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mdb") returned 0 [0056.288] lstrlenA (lpString="*.mdb") returned 5 [0056.288] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.cer") returned 0 [0056.288] lstrlenA (lpString="*.cer") returned 5 [0056.288] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.p12") returned 0 [0056.288] lstrlenA (lpString="*.p12") returned 5 [0056.288] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.pfx") returned 0 [0056.288] lstrlenA (lpString="*.pfx") returned 5 [0056.288] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.kwm") returned 0 [0056.289] lstrlenA (lpString="*.kwm") returned 5 [0056.289] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.pwm") returned 0 [0056.289] lstrlenA (lpString="*.pwm") returned 5 [0056.289] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.1cd") returned 0 [0056.289] lstrlenA (lpString="*.1cd") returned 5 [0056.289] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.md") returned 0 [0056.289] lstrlenA (lpString="*.md") returned 4 [0056.289] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mdf") returned 0 [0056.289] lstrlenA (lpString="*.mdf") returned 5 [0056.289] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.dbf") returned 0 [0056.289] lstrlenA (lpString="*.dbf") returned 5 [0056.289] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.odt") returned 0 [0056.289] lstrlenA (lpString="*.odt") returned 5 [0056.289] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.vob") returned 0 [0056.289] lstrlenA (lpString="*.vob") returned 5 [0056.289] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.ifo") returned 0 [0056.289] lstrlenA (lpString="*.ifo") returned 5 [0056.289] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.lnk") returned 0 [0056.289] lstrlenA (lpString="*.lnk") returned 5 [0056.289] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.torrent") returned 0 [0056.289] lstrlenA (lpString="*.torrent") returned 9 [0056.289] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mov") returned 0 [0056.289] lstrlenA (lpString="*.mov") returned 5 [0056.289] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.m2v") returned 0 [0056.289] lstrlenA (lpString="*.m2v") returned 5 [0056.289] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.3gp") returned 0 [0056.289] lstrlenA (lpString="*.3gp") returned 5 [0056.290] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mpeg") returned 0 [0056.290] lstrlenA (lpString="*.mpeg") returned 6 [0056.290] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mpg") returned 0 [0056.290] lstrlenA (lpString="*.mpg") returned 5 [0056.290] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.flv") returned 0 [0056.290] lstrlenA (lpString="*.flv") returned 5 [0056.290] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.avi") returned 0 [0056.290] lstrlenA (lpString="*.avi") returned 5 [0056.290] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mp4") returned 0 [0056.290] lstrlenA (lpString="*.mp4") returned 5 [0056.290] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.wmv") returned 0 [0056.290] lstrlenA (lpString="*.wmv") returned 5 [0056.290] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.divx") returned 0 [0056.290] lstrlenA (lpString="*.divx") returned 6 [0056.290] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mkv") returned 0 [0056.290] lstrlenA (lpString="*.mkv") returned 5 [0056.290] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mp3") returned 0 [0056.290] lstrlenA (lpString="*.mp3") returned 5 [0056.290] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.wav") returned 0 [0056.290] lstrlenA (lpString="*.wav") returned 5 [0056.290] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.flac") returned 0 [0056.290] lstrlenA (lpString="*.flac") returned 6 [0056.290] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.ape") returned 0 [0056.290] lstrlenA (lpString="*.ape") returned 5 [0056.290] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.wma") returned 0 [0056.290] lstrlenA (lpString="*.wma") returned 5 [0056.290] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.ac3") returned 0 [0056.290] lstrlenA (lpString="*.ac3") returned 5 [0056.291] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x7898476d, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x7898476d, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0056.291] lstrcmpA (lpString1=".", lpString2="bg-BG") returned -1 [0056.291] lstrcmpA (lpString1="..", lpString2="bg-BG") returned -1 [0056.291] PathFindFileNameA (pszPath="C:\\Boot\\BCD.LOG2") returned="BCD.LOG2" [0056.291] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="bg-BG" | out: lpString1="C:\\Boot\\bg-BG") returned="C:\\Boot\\bg-BG" [0056.291] lstrlenA (lpString="C:\\Boot\\bg-BG") returned 13 [0056.291] FindFirstFileA (in: lpFileName="C:\\Boot\\bg-BG\\*.*" (normalized: "c:\\boot\\bg-bg\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x7898476d, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x7898476d, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0x4a, cFileName=".", cAlternateFileName="")) returned 0x636ab0 [0056.291] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.291] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x7898476d, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x7898476d, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0x4a, cFileName="..", cAlternateFileName="")) returned 1 [0056.291] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.291] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.291] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x7898476d, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x77792cf0, dwReserved1=0x4a, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.292] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.292] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.292] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.292] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.292] PathFindFileNameA (pszPath="C:\\Boot\\bg-BG\\*.*") returned="*.*" [0056.292] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\bg-BG\\" | out: lpString1="C:\\Boot\\bg-BG\\") returned="C:\\Boot\\bg-BG\\" [0056.292] PathAddBackslashA (in: pszPath="C:\\Boot\\bg-BG\\" | out: pszPath="C:\\Boot\\bg-BG\\") returned="" [0056.292] lstrcatA (in: lpString1="C:\\Boot\\bg-BG\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\bg-BG\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\bg-BG\\HOW TO DECRYPT FILES.txt" [0056.292] GetFileAttributesA (lpFileName="C:\\Boot\\bg-BG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\bg-bg\\how to decrypt files.txt")) returned 0xffffffff [0056.292] CreateFileA (lpFileName="C:\\Boot\\bg-BG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\bg-bg\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.292] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.292] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.295] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.295] CloseHandle (hObject=0x1c4) returned 1 [0056.295] lstrcatA (in: lpString1="C:\\Boot\\bg-BG\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned="C:\\Boot\\bg-BG\\bootmgr.exe.mui" [0056.295] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.295] lstrlenA (lpString="*.zip") returned 5 [0056.295] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.295] lstrlenA (lpString="*.rar") returned 5 [0056.296] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.296] lstrlenA (lpString="*.7z") returned 4 [0056.296] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.296] lstrlenA (lpString="*.tar") returned 5 [0056.296] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.296] lstrlenA (lpString="*.gzip") returned 6 [0056.296] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.296] lstrlenA (lpString="*.jpg") returned 5 [0056.296] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.296] lstrlenA (lpString="*.jpeg") returned 6 [0056.296] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.296] lstrlenA (lpString="*.psd") returned 5 [0056.296] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.296] lstrlenA (lpString="*.cdr") returned 5 [0056.296] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.296] lstrlenA (lpString="*.dwg") returned 5 [0056.296] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.296] lstrlenA (lpString="*.max") returned 5 [0056.296] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.296] lstrlenA (lpString="*.bmp") returned 5 [0056.296] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.296] lstrlenA (lpString="*.gif") returned 5 [0056.296] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.296] lstrlenA (lpString="*.png") returned 5 [0056.296] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.296] lstrlenA (lpString="*.doc") returned 5 [0056.297] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.297] lstrlenA (lpString="*.docx") returned 6 [0056.297] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.297] lstrlenA (lpString="*.xls") returned 5 [0056.297] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.297] lstrlenA (lpString="*.xlsx") returned 6 [0056.297] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.297] lstrlenA (lpString="*.ppt") returned 5 [0056.297] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.297] lstrlenA (lpString="*.pptx") returned 6 [0056.297] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.297] lstrlenA (lpString="*.txt") returned 5 [0056.297] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.297] lstrlenA (lpString="*.pdf") returned 5 [0056.297] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.297] lstrlenA (lpString="*.djvu") returned 6 [0056.297] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.297] lstrlenA (lpString="*.htm") returned 5 [0056.297] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.297] lstrlenA (lpString="*.html") returned 6 [0056.297] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.297] lstrlenA (lpString="*.mdb") returned 5 [0056.297] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.297] lstrlenA (lpString="*.cer") returned 5 [0056.297] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.297] lstrlenA (lpString="*.p12") returned 5 [0056.298] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.298] lstrlenA (lpString="*.pfx") returned 5 [0056.298] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.298] lstrlenA (lpString="*.kwm") returned 5 [0056.298] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.298] lstrlenA (lpString="*.pwm") returned 5 [0056.298] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.298] lstrlenA (lpString="*.1cd") returned 5 [0056.298] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.298] lstrlenA (lpString="*.md") returned 4 [0056.298] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.298] lstrlenA (lpString="*.mdf") returned 5 [0056.298] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.298] lstrlenA (lpString="*.dbf") returned 5 [0056.298] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.298] lstrlenA (lpString="*.odt") returned 5 [0056.298] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.298] lstrlenA (lpString="*.vob") returned 5 [0056.298] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.298] lstrlenA (lpString="*.ifo") returned 5 [0056.298] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.298] lstrlenA (lpString="*.lnk") returned 5 [0056.298] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.298] lstrlenA (lpString="*.torrent") returned 9 [0056.298] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.298] lstrlenA (lpString="*.mov") returned 5 [0056.298] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.299] lstrlenA (lpString="*.m2v") returned 5 [0056.299] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.299] lstrlenA (lpString="*.3gp") returned 5 [0056.299] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.299] lstrlenA (lpString="*.mpeg") returned 6 [0056.299] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.299] lstrlenA (lpString="*.mpg") returned 5 [0056.299] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.299] lstrlenA (lpString="*.flv") returned 5 [0056.299] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.299] lstrlenA (lpString="*.avi") returned 5 [0056.299] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.299] lstrlenA (lpString="*.mp4") returned 5 [0056.299] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.299] lstrlenA (lpString="*.wmv") returned 5 [0056.299] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.299] lstrlenA (lpString="*.divx") returned 6 [0056.299] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.299] lstrlenA (lpString="*.mkv") returned 5 [0056.299] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.299] lstrlenA (lpString="*.mp3") returned 5 [0056.299] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.299] lstrlenA (lpString="*.wav") returned 5 [0056.299] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.299] lstrlenA (lpString="*.flac") returned 6 [0056.299] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.299] lstrlenA (lpString="*.ape") returned 5 [0056.300] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.300] lstrlenA (lpString="*.wma") returned 5 [0056.300] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.300] lstrlenA (lpString="*.ac3") returned 5 [0056.300] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x7898476d, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x77792cf0, dwReserved1=0x4a, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0056.300] FindClose (in: hFindFile=0x636ab0 | out: hFindFile=0x636ab0) returned 1 [0056.300] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78ab5a49, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x62f540, dwReserved1=0x7, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0056.300] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0056.300] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BOOTSTAT.DAT") returned 1 [0056.300] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BOOTSTAT.DAT") returned 1 [0056.300] lstrcmpiA (lpString1="", lpString2="BOOTSTAT.DAT") returned -1 [0056.300] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.300] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0056.300] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned="" [0056.300] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt" [0056.300] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20 [0056.300] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BOOTSTAT.DAT" | out: lpString1="C:\\Boot\\BOOTSTAT.DAT") returned="C:\\Boot\\BOOTSTAT.DAT" [0056.301] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.zip") returned 0 [0056.301] lstrlenA (lpString="*.zip") returned 5 [0056.301] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.rar") returned 0 [0056.301] lstrlenA (lpString="*.rar") returned 5 [0056.301] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.7z") returned 0 [0056.301] lstrlenA (lpString="*.7z") returned 4 [0056.301] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.tar") returned 0 [0056.301] lstrlenA (lpString="*.tar") returned 5 [0056.301] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.gzip") returned 0 [0056.301] lstrlenA (lpString="*.gzip") returned 6 [0056.301] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.jpg") returned 0 [0056.301] lstrlenA (lpString="*.jpg") returned 5 [0056.301] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.jpeg") returned 0 [0056.301] lstrlenA (lpString="*.jpeg") returned 6 [0056.301] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.psd") returned 0 [0056.301] lstrlenA (lpString="*.psd") returned 5 [0056.301] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.cdr") returned 0 [0056.301] lstrlenA (lpString="*.cdr") returned 5 [0056.301] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.dwg") returned 0 [0056.301] lstrlenA (lpString="*.dwg") returned 5 [0056.301] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.max") returned 0 [0056.301] lstrlenA (lpString="*.max") returned 5 [0056.301] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.bmp") returned 0 [0056.301] lstrlenA (lpString="*.bmp") returned 5 [0056.301] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.gif") returned 0 [0056.301] lstrlenA (lpString="*.gif") returned 5 [0056.302] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.png") returned 0 [0056.302] lstrlenA (lpString="*.png") returned 5 [0056.302] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.doc") returned 0 [0056.302] lstrlenA (lpString="*.doc") returned 5 [0056.302] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.docx") returned 0 [0056.302] lstrlenA (lpString="*.docx") returned 6 [0056.302] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.xls") returned 0 [0056.302] lstrlenA (lpString="*.xls") returned 5 [0056.302] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.xlsx") returned 0 [0056.302] lstrlenA (lpString="*.xlsx") returned 6 [0056.302] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.ppt") returned 0 [0056.302] lstrlenA (lpString="*.ppt") returned 5 [0056.302] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.pptx") returned 0 [0056.302] lstrlenA (lpString="*.pptx") returned 6 [0056.303] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.txt") returned 0 [0056.303] lstrlenA (lpString="*.txt") returned 5 [0056.303] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.pdf") returned 0 [0056.303] lstrlenA (lpString="*.pdf") returned 5 [0056.303] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.djvu") returned 0 [0056.303] lstrlenA (lpString="*.djvu") returned 6 [0056.303] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.htm") returned 0 [0056.303] lstrlenA (lpString="*.htm") returned 5 [0056.303] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.html") returned 0 [0056.303] lstrlenA (lpString="*.html") returned 6 [0056.303] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mdb") returned 0 [0056.303] lstrlenA (lpString="*.mdb") returned 5 [0056.303] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.cer") returned 0 [0056.303] lstrlenA (lpString="*.cer") returned 5 [0056.303] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.p12") returned 0 [0056.303] lstrlenA (lpString="*.p12") returned 5 [0056.303] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.pfx") returned 0 [0056.303] lstrlenA (lpString="*.pfx") returned 5 [0056.303] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.kwm") returned 0 [0056.303] lstrlenA (lpString="*.kwm") returned 5 [0056.303] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.pwm") returned 0 [0056.303] lstrlenA (lpString="*.pwm") returned 5 [0056.303] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.1cd") returned 0 [0056.303] lstrlenA (lpString="*.1cd") returned 5 [0056.303] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.md") returned 0 [0056.303] lstrlenA (lpString="*.md") returned 4 [0056.303] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mdf") returned 0 [0056.304] lstrlenA (lpString="*.mdf") returned 5 [0056.304] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.dbf") returned 0 [0056.304] lstrlenA (lpString="*.dbf") returned 5 [0056.304] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.odt") returned 0 [0056.304] lstrlenA (lpString="*.odt") returned 5 [0056.304] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.vob") returned 0 [0056.304] lstrlenA (lpString="*.vob") returned 5 [0056.304] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.ifo") returned 0 [0056.304] lstrlenA (lpString="*.ifo") returned 5 [0056.304] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.lnk") returned 0 [0056.304] lstrlenA (lpString="*.lnk") returned 5 [0056.304] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.torrent") returned 0 [0056.304] lstrlenA (lpString="*.torrent") returned 9 [0056.304] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mov") returned 0 [0056.304] lstrlenA (lpString="*.mov") returned 5 [0056.304] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.m2v") returned 0 [0056.304] lstrlenA (lpString="*.m2v") returned 5 [0056.304] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.3gp") returned 0 [0056.304] lstrlenA (lpString="*.3gp") returned 5 [0056.304] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mpeg") returned 0 [0056.304] lstrlenA (lpString="*.mpeg") returned 6 [0056.304] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mpg") returned 0 [0056.304] lstrlenA (lpString="*.mpg") returned 5 [0056.304] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.flv") returned 0 [0056.304] lstrlenA (lpString="*.flv") returned 5 [0056.304] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.avi") returned 0 [0056.304] lstrlenA (lpString="*.avi") returned 5 [0056.305] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mp4") returned 0 [0056.305] lstrlenA (lpString="*.mp4") returned 5 [0056.305] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.wmv") returned 0 [0056.305] lstrlenA (lpString="*.wmv") returned 5 [0056.305] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.divx") returned 0 [0056.305] lstrlenA (lpString="*.divx") returned 6 [0056.305] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mkv") returned 0 [0056.305] lstrlenA (lpString="*.mkv") returned 5 [0056.305] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mp3") returned 0 [0056.305] lstrlenA (lpString="*.mp3") returned 5 [0056.305] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.wav") returned 0 [0056.305] lstrlenA (lpString="*.wav") returned 5 [0056.305] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.flac") returned 0 [0056.305] lstrlenA (lpString="*.flac") returned 6 [0056.305] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.ape") returned 0 [0056.305] lstrlenA (lpString="*.ape") returned 5 [0056.305] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.wma") returned 0 [0056.305] lstrlenA (lpString="*.wma") returned 5 [0056.305] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.ac3") returned 0 [0056.305] lstrlenA (lpString="*.ac3") returned 5 [0056.305] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x17f60, dwReserved0=0x6, dwReserved1=0x0, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0056.305] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0056.305] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootvhd.dll") returned 1 [0056.305] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootvhd.dll") returned 1 [0056.305] lstrcmpiA (lpString1="", lpString2="bootvhd.dll") returned -1 [0056.305] PathFindFileNameA (pszPath="C:\\Boot\\BOOTSTAT.DAT") returned="BOOTSTAT.DAT" [0056.306] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0056.306] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned="" [0056.306] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt" [0056.306] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20 [0056.306] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="bootvhd.dll" | out: lpString1="C:\\Boot\\bootvhd.dll") returned="C:\\Boot\\bootvhd.dll" [0056.306] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.zip") returned 0 [0056.306] lstrlenA (lpString="*.zip") returned 5 [0056.306] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.rar") returned 0 [0056.306] lstrlenA (lpString="*.rar") returned 5 [0056.306] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.7z") returned 0 [0056.306] lstrlenA (lpString="*.7z") returned 4 [0056.306] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.tar") returned 0 [0056.306] lstrlenA (lpString="*.tar") returned 5 [0056.306] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.gzip") returned 0 [0056.306] lstrlenA (lpString="*.gzip") returned 6 [0056.306] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.jpg") returned 0 [0056.306] lstrlenA (lpString="*.jpg") returned 5 [0056.306] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.jpeg") returned 0 [0056.306] lstrlenA (lpString="*.jpeg") returned 6 [0056.306] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.psd") returned 0 [0056.306] lstrlenA (lpString="*.psd") returned 5 [0056.306] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.cdr") returned 0 [0056.307] lstrlenA (lpString="*.cdr") returned 5 [0056.307] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.dwg") returned 0 [0056.307] lstrlenA (lpString="*.dwg") returned 5 [0056.307] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.max") returned 0 [0056.307] lstrlenA (lpString="*.max") returned 5 [0056.307] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.bmp") returned 0 [0056.307] lstrlenA (lpString="*.bmp") returned 5 [0056.307] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.gif") returned 0 [0056.307] lstrlenA (lpString="*.gif") returned 5 [0056.307] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.png") returned 0 [0056.307] lstrlenA (lpString="*.png") returned 5 [0056.307] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.doc") returned 0 [0056.307] lstrlenA (lpString="*.doc") returned 5 [0056.307] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.docx") returned 0 [0056.307] lstrlenA (lpString="*.docx") returned 6 [0056.307] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.xls") returned 0 [0056.307] lstrlenA (lpString="*.xls") returned 5 [0056.307] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.xlsx") returned 0 [0056.307] lstrlenA (lpString="*.xlsx") returned 6 [0056.307] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.ppt") returned 0 [0056.307] lstrlenA (lpString="*.ppt") returned 5 [0056.307] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.pptx") returned 0 [0056.307] lstrlenA (lpString="*.pptx") returned 6 [0056.307] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.txt") returned 0 [0056.307] lstrlenA (lpString="*.txt") returned 5 [0056.307] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.pdf") returned 0 [0056.307] lstrlenA (lpString="*.pdf") returned 5 [0056.307] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.djvu") returned 0 [0056.308] lstrlenA (lpString="*.djvu") returned 6 [0056.308] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.htm") returned 0 [0056.308] lstrlenA (lpString="*.htm") returned 5 [0056.308] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.html") returned 0 [0056.308] lstrlenA (lpString="*.html") returned 6 [0056.308] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.mdb") returned 0 [0056.308] lstrlenA (lpString="*.mdb") returned 5 [0056.308] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.cer") returned 0 [0056.308] lstrlenA (lpString="*.cer") returned 5 [0056.308] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.p12") returned 0 [0056.308] lstrlenA (lpString="*.p12") returned 5 [0056.308] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.pfx") returned 0 [0056.308] lstrlenA (lpString="*.pfx") returned 5 [0056.308] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.kwm") returned 0 [0056.308] lstrlenA (lpString="*.kwm") returned 5 [0056.308] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.pwm") returned 0 [0056.308] lstrlenA (lpString="*.pwm") returned 5 [0056.308] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.1cd") returned 0 [0056.308] lstrlenA (lpString="*.1cd") returned 5 [0056.308] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.md") returned 0 [0056.308] lstrlenA (lpString="*.md") returned 4 [0056.308] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.mdf") returned 0 [0056.308] lstrlenA (lpString="*.mdf") returned 5 [0056.308] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.dbf") returned 0 [0056.308] lstrlenA (lpString="*.dbf") returned 5 [0056.308] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.odt") returned 0 [0056.308] lstrlenA (lpString="*.odt") returned 5 [0056.309] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.vob") returned 0 [0056.309] lstrlenA (lpString="*.vob") returned 5 [0056.309] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.ifo") returned 0 [0056.309] lstrlenA (lpString="*.ifo") returned 5 [0056.309] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.lnk") returned 0 [0056.309] lstrlenA (lpString="*.lnk") returned 5 [0056.309] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.torrent") returned 0 [0056.309] lstrlenA (lpString="*.torrent") returned 9 [0056.309] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.mov") returned 0 [0056.309] lstrlenA (lpString="*.mov") returned 5 [0056.309] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.m2v") returned 0 [0056.309] lstrlenA (lpString="*.m2v") returned 5 [0056.309] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.3gp") returned 0 [0056.309] lstrlenA (lpString="*.3gp") returned 5 [0056.309] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.mpeg") returned 0 [0056.309] lstrlenA (lpString="*.mpeg") returned 6 [0056.309] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.mpg") returned 0 [0056.309] lstrlenA (lpString="*.mpg") returned 5 [0056.309] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.flv") returned 0 [0056.309] lstrlenA (lpString="*.flv") returned 5 [0056.309] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.avi") returned 0 [0056.309] lstrlenA (lpString="*.avi") returned 5 [0056.309] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.mp4") returned 0 [0056.309] lstrlenA (lpString="*.mp4") returned 5 [0056.309] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.wmv") returned 0 [0056.309] lstrlenA (lpString="*.wmv") returned 5 [0056.309] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.divx") returned 0 [0056.309] lstrlenA (lpString="*.divx") returned 6 [0056.310] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.mkv") returned 0 [0056.310] lstrlenA (lpString="*.mkv") returned 5 [0056.310] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.mp3") returned 0 [0056.310] lstrlenA (lpString="*.mp3") returned 5 [0056.310] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.wav") returned 0 [0056.310] lstrlenA (lpString="*.wav") returned 5 [0056.310] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.flac") returned 0 [0056.310] lstrlenA (lpString="*.flac") returned 6 [0056.310] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.ape") returned 0 [0056.310] lstrlenA (lpString="*.ape") returned 5 [0056.310] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.wma") returned 0 [0056.310] lstrlenA (lpString="*.wma") returned 5 [0056.310] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.ac3") returned 0 [0056.310] lstrlenA (lpString="*.ac3") returned 5 [0056.310] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789aa98c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0056.310] lstrcmpA (lpString1=".", lpString2="cs-CZ") returned -1 [0056.310] lstrcmpA (lpString1="..", lpString2="cs-CZ") returned -1 [0056.310] PathFindFileNameA (pszPath="C:\\Boot\\bootvhd.dll") returned="bootvhd.dll" [0056.310] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="cs-CZ" | out: lpString1="C:\\Boot\\cs-CZ") returned="C:\\Boot\\cs-CZ" [0056.310] lstrlenA (lpString="C:\\Boot\\cs-CZ") returned 13 [0056.310] FindFirstFileA (in: lpFileName="C:\\Boot\\cs-CZ\\*.*" (normalized: "c:\\boot\\cs-cz\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789aa98c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0x4a, cFileName=".", cAlternateFileName="")) returned 0x6365b0 [0056.311] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.311] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789aa98c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0x4a, cFileName="..", cAlternateFileName="")) returned 1 [0056.311] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.311] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.311] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x77792cf0, dwReserved1=0x4a, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.311] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.311] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.311] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.311] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.311] PathFindFileNameA (pszPath="C:\\Boot\\cs-CZ\\*.*") returned="*.*" [0056.311] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\cs-CZ\\" | out: lpString1="C:\\Boot\\cs-CZ\\") returned="C:\\Boot\\cs-CZ\\" [0056.311] PathAddBackslashA (in: pszPath="C:\\Boot\\cs-CZ\\" | out: pszPath="C:\\Boot\\cs-CZ\\") returned="" [0056.311] lstrcatA (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\cs-CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\cs-CZ\\HOW TO DECRYPT FILES.txt" [0056.311] GetFileAttributesA (lpFileName="C:\\Boot\\cs-CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\cs-cz\\how to decrypt files.txt")) returned 0xffffffff [0056.311] CreateFileA (lpFileName="C:\\Boot\\cs-CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\cs-cz\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.319] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.319] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.321] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.321] CloseHandle (hObject=0x1c4) returned 1 [0056.321] lstrcatA (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" [0056.321] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.321] lstrlenA (lpString="*.zip") returned 5 [0056.321] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.321] lstrlenA (lpString="*.rar") returned 5 [0056.321] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.321] lstrlenA (lpString="*.7z") returned 4 [0056.321] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.321] lstrlenA (lpString="*.tar") returned 5 [0056.322] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.322] lstrlenA (lpString="*.gzip") returned 6 [0056.322] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.322] lstrlenA (lpString="*.jpg") returned 5 [0056.322] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.322] lstrlenA (lpString="*.jpeg") returned 6 [0056.322] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.322] lstrlenA (lpString="*.psd") returned 5 [0056.322] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.322] lstrlenA (lpString="*.cdr") returned 5 [0056.322] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.322] lstrlenA (lpString="*.dwg") returned 5 [0056.322] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.322] lstrlenA (lpString="*.max") returned 5 [0056.322] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.322] lstrlenA (lpString="*.bmp") returned 5 [0056.322] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.322] lstrlenA (lpString="*.gif") returned 5 [0056.322] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.322] lstrlenA (lpString="*.png") returned 5 [0056.322] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.322] lstrlenA (lpString="*.doc") returned 5 [0056.322] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.322] lstrlenA (lpString="*.docx") returned 6 [0056.322] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.322] lstrlenA (lpString="*.xls") returned 5 [0056.322] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.323] lstrlenA (lpString="*.xlsx") returned 6 [0056.323] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.323] lstrlenA (lpString="*.ppt") returned 5 [0056.323] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.323] lstrlenA (lpString="*.pptx") returned 6 [0056.323] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.323] lstrlenA (lpString="*.txt") returned 5 [0056.323] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.323] lstrlenA (lpString="*.pdf") returned 5 [0056.323] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.323] lstrlenA (lpString="*.djvu") returned 6 [0056.323] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.323] lstrlenA (lpString="*.htm") returned 5 [0056.323] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.323] lstrlenA (lpString="*.html") returned 6 [0056.323] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.323] lstrlenA (lpString="*.mdb") returned 5 [0056.323] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.323] lstrlenA (lpString="*.cer") returned 5 [0056.323] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.323] lstrlenA (lpString="*.p12") returned 5 [0056.323] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.323] lstrlenA (lpString="*.pfx") returned 5 [0056.323] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.323] lstrlenA (lpString="*.kwm") returned 5 [0056.323] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.323] lstrlenA (lpString="*.pwm") returned 5 [0056.323] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.323] lstrlenA (lpString="*.1cd") returned 5 [0056.324] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.324] lstrlenA (lpString="*.md") returned 4 [0056.324] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.324] lstrlenA (lpString="*.mdf") returned 5 [0056.324] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.324] lstrlenA (lpString="*.dbf") returned 5 [0056.324] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.324] lstrlenA (lpString="*.odt") returned 5 [0056.324] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.324] lstrlenA (lpString="*.vob") returned 5 [0056.324] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.324] lstrlenA (lpString="*.ifo") returned 5 [0056.324] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.324] lstrlenA (lpString="*.lnk") returned 5 [0056.324] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.324] lstrlenA (lpString="*.torrent") returned 9 [0056.324] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.324] lstrlenA (lpString="*.mov") returned 5 [0056.324] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.324] lstrlenA (lpString="*.m2v") returned 5 [0056.324] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.324] lstrlenA (lpString="*.3gp") returned 5 [0056.324] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.324] lstrlenA (lpString="*.mpeg") returned 6 [0056.324] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.324] lstrlenA (lpString="*.mpg") returned 5 [0056.324] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.324] lstrlenA (lpString="*.flv") returned 5 [0056.325] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.325] lstrlenA (lpString="*.avi") returned 5 [0056.325] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.325] lstrlenA (lpString="*.mp4") returned 5 [0056.325] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.325] lstrlenA (lpString="*.wmv") returned 5 [0056.325] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.325] lstrlenA (lpString="*.divx") returned 6 [0056.325] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.325] lstrlenA (lpString="*.mkv") returned 5 [0056.325] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.325] lstrlenA (lpString="*.mp3") returned 5 [0056.325] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.325] lstrlenA (lpString="*.wav") returned 5 [0056.325] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.325] lstrlenA (lpString="*.flac") returned 6 [0056.325] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.325] lstrlenA (lpString="*.ape") returned 5 [0056.325] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.325] lstrlenA (lpString="*.wma") returned 5 [0056.325] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.325] lstrlenA (lpString="*.ac3") returned 5 [0056.325] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160, dwReserved0=0x6, dwReserved1=0x7000007, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.325] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.325] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0056.325] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0056.325] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0056.326] PathFindFileNameA (pszPath="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0056.326] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\cs-CZ\\" | out: lpString1="C:\\Boot\\cs-CZ\\") returned="C:\\Boot\\cs-CZ\\" [0056.326] PathAddBackslashA (in: pszPath="C:\\Boot\\cs-CZ\\" | out: pszPath="C:\\Boot\\cs-CZ\\") returned="" [0056.326] lstrcatA (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\cs-CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\cs-CZ\\HOW TO DECRYPT FILES.txt" [0056.326] GetFileAttributesA (lpFileName="C:\\Boot\\cs-CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\cs-cz\\how to decrypt files.txt")) returned 0x20 [0056.326] lstrcatA (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned="C:\\Boot\\cs-CZ\\memtest.exe.mui" [0056.326] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0056.326] lstrlenA (lpString="*.zip") returned 5 [0056.326] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0056.326] lstrlenA (lpString="*.rar") returned 5 [0056.326] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0056.326] lstrlenA (lpString="*.7z") returned 4 [0056.326] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0056.326] lstrlenA (lpString="*.tar") returned 5 [0056.326] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0056.326] lstrlenA (lpString="*.gzip") returned 6 [0056.326] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0056.326] lstrlenA (lpString="*.jpg") returned 5 [0056.326] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0056.326] lstrlenA (lpString="*.jpeg") returned 6 [0056.326] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0056.326] lstrlenA (lpString="*.psd") returned 5 [0056.326] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0056.326] lstrlenA (lpString="*.cdr") returned 5 [0056.327] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0056.327] lstrlenA (lpString="*.dwg") returned 5 [0056.327] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.max") returned 0 [0056.327] lstrlenA (lpString="*.max") returned 5 [0056.327] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0056.327] lstrlenA (lpString="*.bmp") returned 5 [0056.327] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0056.327] lstrlenA (lpString="*.gif") returned 5 [0056.327] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.png") returned 0 [0056.327] lstrlenA (lpString="*.png") returned 5 [0056.327] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0056.327] lstrlenA (lpString="*.doc") returned 5 [0056.327] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0056.327] lstrlenA (lpString="*.docx") returned 6 [0056.327] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0056.327] lstrlenA (lpString="*.xls") returned 5 [0056.327] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0056.327] lstrlenA (lpString="*.xlsx") returned 6 [0056.327] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0056.327] lstrlenA (lpString="*.ppt") returned 5 [0056.327] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0056.327] lstrlenA (lpString="*.pptx") returned 6 [0056.327] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0056.327] lstrlenA (lpString="*.txt") returned 5 [0056.327] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0056.327] lstrlenA (lpString="*.pdf") returned 5 [0056.327] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0056.328] lstrlenA (lpString="*.djvu") returned 6 [0056.328] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0056.328] lstrlenA (lpString="*.htm") returned 5 [0056.328] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.html") returned 0 [0056.328] lstrlenA (lpString="*.html") returned 6 [0056.328] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0056.328] lstrlenA (lpString="*.mdb") returned 5 [0056.328] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0056.328] lstrlenA (lpString="*.cer") returned 5 [0056.328] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0056.328] lstrlenA (lpString="*.p12") returned 5 [0056.328] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0056.328] lstrlenA (lpString="*.pfx") returned 5 [0056.328] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0056.328] lstrlenA (lpString="*.kwm") returned 5 [0056.328] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0056.328] lstrlenA (lpString="*.pwm") returned 5 [0056.328] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0056.328] lstrlenA (lpString="*.1cd") returned 5 [0056.328] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.md") returned 0 [0056.328] lstrlenA (lpString="*.md") returned 4 [0056.328] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0056.328] lstrlenA (lpString="*.mdf") returned 5 [0056.328] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0056.328] lstrlenA (lpString="*.dbf") returned 5 [0056.328] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0056.328] lstrlenA (lpString="*.odt") returned 5 [0056.328] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0056.329] lstrlenA (lpString="*.vob") returned 5 [0056.329] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0056.329] lstrlenA (lpString="*.ifo") returned 5 [0056.329] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0056.329] lstrlenA (lpString="*.lnk") returned 5 [0056.329] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0056.329] lstrlenA (lpString="*.torrent") returned 9 [0056.329] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0056.329] lstrlenA (lpString="*.mov") returned 5 [0056.329] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0056.329] lstrlenA (lpString="*.m2v") returned 5 [0056.329] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0056.329] lstrlenA (lpString="*.3gp") returned 5 [0056.329] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0056.329] lstrlenA (lpString="*.mpeg") returned 6 [0056.329] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0056.329] lstrlenA (lpString="*.mpg") returned 5 [0056.329] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0056.329] lstrlenA (lpString="*.flv") returned 5 [0056.329] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0056.329] lstrlenA (lpString="*.avi") returned 5 [0056.329] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0056.329] lstrlenA (lpString="*.mp4") returned 5 [0056.329] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0056.329] lstrlenA (lpString="*.wmv") returned 5 [0056.329] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0056.329] lstrlenA (lpString="*.divx") returned 6 [0056.330] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0056.330] lstrlenA (lpString="*.mkv") returned 5 [0056.330] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0056.330] lstrlenA (lpString="*.mp3") returned 5 [0056.330] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0056.330] lstrlenA (lpString="*.wav") returned 5 [0056.330] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0056.330] lstrlenA (lpString="*.flac") returned 6 [0056.330] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0056.330] lstrlenA (lpString="*.ape") returned 5 [0056.330] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0056.330] lstrlenA (lpString="*.wma") returned 5 [0056.330] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0056.330] lstrlenA (lpString="*.ac3") returned 5 [0056.330] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160, dwReserved0=0x6, dwReserved1=0x7000007, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0056.330] FindClose (in: hFindFile=0x6365b0 | out: hFindFile=0x6365b0) returned 1 [0056.330] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789aa98c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62f540, dwReserved1=0x7, cFileName="da-DK", cAlternateFileName="")) returned 1 [0056.330] lstrcmpA (lpString1=".", lpString2="da-DK") returned -1 [0056.330] lstrcmpA (lpString1="..", lpString2="da-DK") returned -1 [0056.330] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.330] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="da-DK" | out: lpString1="C:\\Boot\\da-DK") returned="C:\\Boot\\da-DK" [0056.331] lstrlenA (lpString="C:\\Boot\\da-DK") returned 13 [0056.331] FindFirstFileA (in: lpFileName="C:\\Boot\\da-DK\\*.*" (normalized: "c:\\boot\\da-dk\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789aa98c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636b70 [0056.332] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.332] FindNextFileA (in: hFindFile=0x636b70, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789aa98c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.332] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.332] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.332] FindNextFileA (in: hFindFile=0x636b70, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x6, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.332] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.332] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.332] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.332] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.332] PathFindFileNameA (pszPath="C:\\Boot\\da-DK\\*.*") returned="*.*" [0056.332] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\da-DK\\" | out: lpString1="C:\\Boot\\da-DK\\") returned="C:\\Boot\\da-DK\\" [0056.332] PathAddBackslashA (in: pszPath="C:\\Boot\\da-DK\\" | out: pszPath="C:\\Boot\\da-DK\\") returned="" [0056.332] lstrcatA (in: lpString1="C:\\Boot\\da-DK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\da-DK\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\da-DK\\HOW TO DECRYPT FILES.txt" [0056.332] GetFileAttributesA (lpFileName="C:\\Boot\\da-DK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\da-dk\\how to decrypt files.txt")) returned 0xffffffff [0056.332] CreateFileA (lpFileName="C:\\Boot\\da-DK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\da-dk\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.334] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.334] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.335] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.335] CloseHandle (hObject=0x1c4) returned 1 [0056.335] lstrcatA (in: lpString1="C:\\Boot\\da-DK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned="C:\\Boot\\da-DK\\bootmgr.exe.mui" [0056.335] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.336] lstrlenA (lpString="*.zip") returned 5 [0056.336] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.336] lstrlenA (lpString="*.rar") returned 5 [0056.336] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.336] lstrlenA (lpString="*.7z") returned 4 [0056.336] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.336] lstrlenA (lpString="*.tar") returned 5 [0056.336] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.336] lstrlenA (lpString="*.gzip") returned 6 [0056.336] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.336] lstrlenA (lpString="*.jpg") returned 5 [0056.336] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.336] lstrlenA (lpString="*.jpeg") returned 6 [0056.336] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.336] lstrlenA (lpString="*.psd") returned 5 [0056.336] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.336] lstrlenA (lpString="*.cdr") returned 5 [0056.336] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.336] lstrlenA (lpString="*.dwg") returned 5 [0056.336] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.336] lstrlenA (lpString="*.max") returned 5 [0056.336] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.336] lstrlenA (lpString="*.bmp") returned 5 [0056.336] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.336] lstrlenA (lpString="*.gif") returned 5 [0056.336] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.336] lstrlenA (lpString="*.png") returned 5 [0056.336] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.336] lstrlenA (lpString="*.doc") returned 5 [0056.336] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.337] lstrlenA (lpString="*.docx") returned 6 [0056.337] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.337] lstrlenA (lpString="*.xls") returned 5 [0056.337] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.337] lstrlenA (lpString="*.xlsx") returned 6 [0056.337] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.337] lstrlenA (lpString="*.ppt") returned 5 [0056.337] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.337] lstrlenA (lpString="*.pptx") returned 6 [0056.337] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.337] lstrlenA (lpString="*.txt") returned 5 [0056.337] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.337] lstrlenA (lpString="*.pdf") returned 5 [0056.337] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.337] lstrlenA (lpString="*.djvu") returned 6 [0056.337] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.337] lstrlenA (lpString="*.htm") returned 5 [0056.337] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.337] lstrlenA (lpString="*.html") returned 6 [0056.337] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.337] lstrlenA (lpString="*.mdb") returned 5 [0056.337] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.337] lstrlenA (lpString="*.cer") returned 5 [0056.337] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.337] lstrlenA (lpString="*.p12") returned 5 [0056.337] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.337] lstrlenA (lpString="*.pfx") returned 5 [0056.337] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.337] lstrlenA (lpString="*.kwm") returned 5 [0056.337] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.337] lstrlenA (lpString="*.pwm") returned 5 [0056.337] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.337] lstrlenA (lpString="*.1cd") returned 5 [0056.338] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.338] lstrlenA (lpString="*.md") returned 4 [0056.338] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.338] lstrlenA (lpString="*.mdf") returned 5 [0056.338] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.338] lstrlenA (lpString="*.dbf") returned 5 [0056.338] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.338] lstrlenA (lpString="*.odt") returned 5 [0056.338] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.338] lstrlenA (lpString="*.vob") returned 5 [0056.338] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.338] lstrlenA (lpString="*.ifo") returned 5 [0056.338] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.338] lstrlenA (lpString="*.lnk") returned 5 [0056.338] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.338] lstrlenA (lpString="*.torrent") returned 9 [0056.338] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.338] lstrlenA (lpString="*.mov") returned 5 [0056.338] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.338] lstrlenA (lpString="*.m2v") returned 5 [0056.338] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.338] lstrlenA (lpString="*.3gp") returned 5 [0056.338] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.338] lstrlenA (lpString="*.mpeg") returned 6 [0056.338] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.338] lstrlenA (lpString="*.mpg") returned 5 [0056.338] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.338] lstrlenA (lpString="*.flv") returned 5 [0056.338] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.338] lstrlenA (lpString="*.avi") returned 5 [0056.338] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.338] lstrlenA (lpString="*.mp4") returned 5 [0056.338] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.338] lstrlenA (lpString="*.wmv") returned 5 [0056.339] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.339] lstrlenA (lpString="*.divx") returned 6 [0056.339] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.339] lstrlenA (lpString="*.mkv") returned 5 [0056.339] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.339] lstrlenA (lpString="*.mp3") returned 5 [0056.339] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.339] lstrlenA (lpString="*.wav") returned 5 [0056.339] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.339] lstrlenA (lpString="*.flac") returned 6 [0056.339] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.339] lstrlenA (lpString="*.ape") returned 5 [0056.339] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.339] lstrlenA (lpString="*.wma") returned 5 [0056.339] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.339] lstrlenA (lpString="*.ac3") returned 5 [0056.339] FindNextFileA (in: hFindFile=0x636b70, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160, dwReserved0=0x6, dwReserved1=0x7000007, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.339] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.339] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0056.339] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0056.339] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0056.339] PathFindFileNameA (pszPath="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0056.339] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\da-DK\\" | out: lpString1="C:\\Boot\\da-DK\\") returned="C:\\Boot\\da-DK\\" [0056.339] PathAddBackslashA (in: pszPath="C:\\Boot\\da-DK\\" | out: pszPath="C:\\Boot\\da-DK\\") returned="" [0056.339] lstrcatA (in: lpString1="C:\\Boot\\da-DK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\da-DK\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\da-DK\\HOW TO DECRYPT FILES.txt" [0056.339] GetFileAttributesA (lpFileName="C:\\Boot\\da-DK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\da-dk\\how to decrypt files.txt")) returned 0x20 [0056.339] lstrcatA (in: lpString1="C:\\Boot\\da-DK\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\da-DK\\memtest.exe.mui") returned="C:\\Boot\\da-DK\\memtest.exe.mui" [0056.339] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0056.339] lstrlenA (lpString="*.zip") returned 5 [0056.339] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0056.340] lstrlenA (lpString="*.rar") returned 5 [0056.340] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0056.340] lstrlenA (lpString="*.7z") returned 4 [0056.340] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0056.340] lstrlenA (lpString="*.tar") returned 5 [0056.340] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0056.340] lstrlenA (lpString="*.gzip") returned 6 [0056.340] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0056.340] lstrlenA (lpString="*.jpg") returned 5 [0056.340] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0056.340] lstrlenA (lpString="*.jpeg") returned 6 [0056.340] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0056.340] lstrlenA (lpString="*.psd") returned 5 [0056.340] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0056.340] lstrlenA (lpString="*.cdr") returned 5 [0056.340] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0056.340] lstrlenA (lpString="*.dwg") returned 5 [0056.340] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.max") returned 0 [0056.340] lstrlenA (lpString="*.max") returned 5 [0056.340] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0056.340] lstrlenA (lpString="*.bmp") returned 5 [0056.340] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0056.340] lstrlenA (lpString="*.gif") returned 5 [0056.340] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.png") returned 0 [0056.340] lstrlenA (lpString="*.png") returned 5 [0056.340] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0056.340] lstrlenA (lpString="*.doc") returned 5 [0056.340] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0056.340] lstrlenA (lpString="*.docx") returned 6 [0056.340] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0056.340] lstrlenA (lpString="*.xls") returned 5 [0056.340] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0056.340] lstrlenA (lpString="*.xlsx") returned 6 [0056.340] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0056.341] lstrlenA (lpString="*.ppt") returned 5 [0056.341] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0056.341] lstrlenA (lpString="*.pptx") returned 6 [0056.341] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0056.341] lstrlenA (lpString="*.txt") returned 5 [0056.341] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0056.341] lstrlenA (lpString="*.pdf") returned 5 [0056.341] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0056.341] lstrlenA (lpString="*.djvu") returned 6 [0056.341] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0056.341] lstrlenA (lpString="*.htm") returned 5 [0056.341] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.html") returned 0 [0056.341] lstrlenA (lpString="*.html") returned 6 [0056.341] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0056.341] lstrlenA (lpString="*.mdb") returned 5 [0056.341] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0056.341] lstrlenA (lpString="*.cer") returned 5 [0056.341] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0056.341] lstrlenA (lpString="*.p12") returned 5 [0056.341] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0056.341] lstrlenA (lpString="*.pfx") returned 5 [0056.341] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0056.341] lstrlenA (lpString="*.kwm") returned 5 [0056.341] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0056.341] lstrlenA (lpString="*.pwm") returned 5 [0056.341] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0056.341] lstrlenA (lpString="*.1cd") returned 5 [0056.341] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.md") returned 0 [0056.341] lstrlenA (lpString="*.md") returned 4 [0056.341] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0056.341] lstrlenA (lpString="*.mdf") returned 5 [0056.341] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0056.342] lstrlenA (lpString="*.dbf") returned 5 [0056.342] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0056.342] lstrlenA (lpString="*.odt") returned 5 [0056.342] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0056.342] lstrlenA (lpString="*.vob") returned 5 [0056.342] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0056.342] lstrlenA (lpString="*.ifo") returned 5 [0056.342] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0056.342] lstrlenA (lpString="*.lnk") returned 5 [0056.342] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0056.342] lstrlenA (lpString="*.torrent") returned 9 [0056.342] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0056.342] lstrlenA (lpString="*.mov") returned 5 [0056.342] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0056.342] lstrlenA (lpString="*.m2v") returned 5 [0056.342] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0056.342] lstrlenA (lpString="*.3gp") returned 5 [0056.342] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0056.342] lstrlenA (lpString="*.mpeg") returned 6 [0056.342] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0056.342] lstrlenA (lpString="*.mpg") returned 5 [0056.342] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0056.342] lstrlenA (lpString="*.flv") returned 5 [0056.342] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0056.342] lstrlenA (lpString="*.avi") returned 5 [0056.342] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0056.342] lstrlenA (lpString="*.mp4") returned 5 [0056.342] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0056.342] lstrlenA (lpString="*.wmv") returned 5 [0056.342] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0056.342] lstrlenA (lpString="*.divx") returned 6 [0056.342] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0056.343] lstrlenA (lpString="*.mkv") returned 5 [0056.343] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0056.343] lstrlenA (lpString="*.mp3") returned 5 [0056.343] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0056.343] lstrlenA (lpString="*.wav") returned 5 [0056.343] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0056.343] lstrlenA (lpString="*.flac") returned 6 [0056.343] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0056.343] lstrlenA (lpString="*.ape") returned 5 [0056.343] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0056.343] lstrlenA (lpString="*.wma") returned 5 [0056.343] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0056.343] lstrlenA (lpString="*.ac3") returned 5 [0056.343] FindNextFileA (in: hFindFile=0x636b70, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160, dwReserved0=0x6, dwReserved1=0x7000007, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0056.343] FindClose (in: hFindFile=0x636b70 | out: hFindFile=0x636b70) returned 1 [0056.343] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789aa98c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62f540, dwReserved1=0x7, cFileName="de-DE", cAlternateFileName="")) returned 1 [0056.343] lstrcmpA (lpString1=".", lpString2="de-DE") returned -1 [0056.343] lstrcmpA (lpString1="..", lpString2="de-DE") returned -1 [0056.343] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.343] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="de-DE" | out: lpString1="C:\\Boot\\de-DE") returned="C:\\Boot\\de-DE" [0056.343] lstrlenA (lpString="C:\\Boot\\de-DE") returned 13 [0056.343] FindFirstFileA (in: lpFileName="C:\\Boot\\de-DE\\*.*" (normalized: "c:\\boot\\de-de\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789aa98c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636b70 [0056.344] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.344] FindNextFileA (in: hFindFile=0x636b70, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789aa98c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.344] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.344] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.344] FindNextFileA (in: hFindFile=0x636b70, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x6, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.344] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.344] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.344] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.344] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.344] PathFindFileNameA (pszPath="C:\\Boot\\de-DE\\*.*") returned="*.*" [0056.345] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\de-DE\\" | out: lpString1="C:\\Boot\\de-DE\\") returned="C:\\Boot\\de-DE\\" [0056.345] PathAddBackslashA (in: pszPath="C:\\Boot\\de-DE\\" | out: pszPath="C:\\Boot\\de-DE\\") returned="" [0056.345] lstrcatA (in: lpString1="C:\\Boot\\de-DE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\de-DE\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\de-DE\\HOW TO DECRYPT FILES.txt" [0056.345] GetFileAttributesA (lpFileName="C:\\Boot\\de-DE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\de-de\\how to decrypt files.txt")) returned 0xffffffff [0056.345] CreateFileA (lpFileName="C:\\Boot\\de-DE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\de-de\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.346] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.346] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.347] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.348] CloseHandle (hObject=0x1c4) returned 1 [0056.348] lstrcatA (in: lpString1="C:\\Boot\\de-DE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned="C:\\Boot\\de-DE\\bootmgr.exe.mui" [0056.348] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.348] lstrlenA (lpString="*.zip") returned 5 [0056.348] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.348] lstrlenA (lpString="*.rar") returned 5 [0056.348] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.348] lstrlenA (lpString="*.7z") returned 4 [0056.348] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.348] lstrlenA (lpString="*.tar") returned 5 [0056.348] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.348] lstrlenA (lpString="*.gzip") returned 6 [0056.348] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.348] lstrlenA (lpString="*.jpg") returned 5 [0056.348] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.348] lstrlenA (lpString="*.jpeg") returned 6 [0056.348] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.348] lstrlenA (lpString="*.psd") returned 5 [0056.348] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.348] lstrlenA (lpString="*.cdr") returned 5 [0056.348] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.349] lstrlenA (lpString="*.dwg") returned 5 [0056.349] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.349] lstrlenA (lpString="*.max") returned 5 [0056.349] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.349] lstrlenA (lpString="*.bmp") returned 5 [0056.349] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.349] lstrlenA (lpString="*.gif") returned 5 [0056.349] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.349] lstrlenA (lpString="*.png") returned 5 [0056.349] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.349] lstrlenA (lpString="*.doc") returned 5 [0056.349] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.349] lstrlenA (lpString="*.docx") returned 6 [0056.349] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.349] lstrlenA (lpString="*.xls") returned 5 [0056.349] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.349] lstrlenA (lpString="*.xlsx") returned 6 [0056.349] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.349] lstrlenA (lpString="*.ppt") returned 5 [0056.349] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.349] lstrlenA (lpString="*.pptx") returned 6 [0056.349] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.350] lstrlenA (lpString="*.txt") returned 5 [0056.350] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.350] lstrlenA (lpString="*.pdf") returned 5 [0056.350] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.350] lstrlenA (lpString="*.djvu") returned 6 [0056.350] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.350] lstrlenA (lpString="*.htm") returned 5 [0056.350] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.350] lstrlenA (lpString="*.html") returned 6 [0056.350] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.350] lstrlenA (lpString="*.mdb") returned 5 [0056.350] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.350] lstrlenA (lpString="*.cer") returned 5 [0056.350] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.350] lstrlenA (lpString="*.p12") returned 5 [0056.350] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.350] lstrlenA (lpString="*.pfx") returned 5 [0056.350] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.350] lstrlenA (lpString="*.kwm") returned 5 [0056.350] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.350] lstrlenA (lpString="*.pwm") returned 5 [0056.350] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.350] lstrlenA (lpString="*.1cd") returned 5 [0056.350] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.350] lstrlenA (lpString="*.md") returned 4 [0056.350] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.350] lstrlenA (lpString="*.mdf") returned 5 [0056.350] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.350] lstrlenA (lpString="*.dbf") returned 5 [0056.350] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.350] lstrlenA (lpString="*.odt") returned 5 [0056.350] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.350] lstrlenA (lpString="*.vob") returned 5 [0056.350] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.351] lstrlenA (lpString="*.ifo") returned 5 [0056.351] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.351] lstrlenA (lpString="*.lnk") returned 5 [0056.351] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.351] lstrlenA (lpString="*.torrent") returned 9 [0056.351] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.351] lstrlenA (lpString="*.mov") returned 5 [0056.351] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.351] lstrlenA (lpString="*.m2v") returned 5 [0056.351] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.351] lstrlenA (lpString="*.3gp") returned 5 [0056.351] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.351] lstrlenA (lpString="*.mpeg") returned 6 [0056.351] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.351] lstrlenA (lpString="*.mpg") returned 5 [0056.351] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.351] lstrlenA (lpString="*.flv") returned 5 [0056.351] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.351] lstrlenA (lpString="*.avi") returned 5 [0056.351] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.351] lstrlenA (lpString="*.mp4") returned 5 [0056.351] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.351] lstrlenA (lpString="*.wmv") returned 5 [0056.351] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.351] lstrlenA (lpString="*.divx") returned 6 [0056.351] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.351] lstrlenA (lpString="*.mkv") returned 5 [0056.351] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.351] lstrlenA (lpString="*.mp3") returned 5 [0056.351] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.351] lstrlenA (lpString="*.wav") returned 5 [0056.351] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.352] lstrlenA (lpString="*.flac") returned 6 [0056.352] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.352] lstrlenA (lpString="*.ape") returned 5 [0056.352] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.352] lstrlenA (lpString="*.wma") returned 5 [0056.352] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.352] lstrlenA (lpString="*.ac3") returned 5 [0056.352] FindNextFileA (in: hFindFile=0x636b70, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb358, dwReserved0=0x6, dwReserved1=0x7000007, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.352] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.352] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0056.352] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0056.352] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0056.352] PathFindFileNameA (pszPath="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0056.352] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\de-DE\\" | out: lpString1="C:\\Boot\\de-DE\\") returned="C:\\Boot\\de-DE\\" [0056.352] PathAddBackslashA (in: pszPath="C:\\Boot\\de-DE\\" | out: pszPath="C:\\Boot\\de-DE\\") returned="" [0056.352] lstrcatA (in: lpString1="C:\\Boot\\de-DE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\de-DE\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\de-DE\\HOW TO DECRYPT FILES.txt" [0056.352] GetFileAttributesA (lpFileName="C:\\Boot\\de-DE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\de-de\\how to decrypt files.txt")) returned 0x20 [0056.352] lstrcatA (in: lpString1="C:\\Boot\\de-DE\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\de-DE\\memtest.exe.mui") returned="C:\\Boot\\de-DE\\memtest.exe.mui" [0056.352] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0056.352] lstrlenA (lpString="*.zip") returned 5 [0056.352] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0056.352] lstrlenA (lpString="*.rar") returned 5 [0056.352] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0056.352] lstrlenA (lpString="*.7z") returned 4 [0056.352] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0056.352] lstrlenA (lpString="*.tar") returned 5 [0056.352] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0056.352] lstrlenA (lpString="*.gzip") returned 6 [0056.352] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0056.353] lstrlenA (lpString="*.jpg") returned 5 [0056.353] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0056.353] lstrlenA (lpString="*.jpeg") returned 6 [0056.353] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0056.353] lstrlenA (lpString="*.psd") returned 5 [0056.353] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0056.353] lstrlenA (lpString="*.cdr") returned 5 [0056.353] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0056.353] lstrlenA (lpString="*.dwg") returned 5 [0056.353] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.max") returned 0 [0056.353] lstrlenA (lpString="*.max") returned 5 [0056.353] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0056.353] lstrlenA (lpString="*.bmp") returned 5 [0056.353] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0056.353] lstrlenA (lpString="*.gif") returned 5 [0056.353] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.png") returned 0 [0056.353] lstrlenA (lpString="*.png") returned 5 [0056.353] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0056.353] lstrlenA (lpString="*.doc") returned 5 [0056.353] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0056.353] lstrlenA (lpString="*.docx") returned 6 [0056.353] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0056.353] lstrlenA (lpString="*.xls") returned 5 [0056.353] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0056.353] lstrlenA (lpString="*.xlsx") returned 6 [0056.353] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0056.353] lstrlenA (lpString="*.ppt") returned 5 [0056.353] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0056.353] lstrlenA (lpString="*.pptx") returned 6 [0056.353] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0056.353] lstrlenA (lpString="*.txt") returned 5 [0056.353] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0056.353] lstrlenA (lpString="*.pdf") returned 5 [0056.353] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0056.354] lstrlenA (lpString="*.djvu") returned 6 [0056.354] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0056.354] lstrlenA (lpString="*.htm") returned 5 [0056.354] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.html") returned 0 [0056.354] lstrlenA (lpString="*.html") returned 6 [0056.354] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0056.354] lstrlenA (lpString="*.mdb") returned 5 [0056.354] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0056.354] lstrlenA (lpString="*.cer") returned 5 [0056.354] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0056.354] lstrlenA (lpString="*.p12") returned 5 [0056.354] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0056.354] lstrlenA (lpString="*.pfx") returned 5 [0056.354] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0056.354] lstrlenA (lpString="*.kwm") returned 5 [0056.354] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0056.354] lstrlenA (lpString="*.pwm") returned 5 [0056.354] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0056.354] lstrlenA (lpString="*.1cd") returned 5 [0056.354] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.md") returned 0 [0056.354] lstrlenA (lpString="*.md") returned 4 [0056.354] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0056.354] lstrlenA (lpString="*.mdf") returned 5 [0056.354] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0056.354] lstrlenA (lpString="*.dbf") returned 5 [0056.354] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0056.354] lstrlenA (lpString="*.odt") returned 5 [0056.354] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0056.354] lstrlenA (lpString="*.vob") returned 5 [0056.354] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0056.354] lstrlenA (lpString="*.ifo") returned 5 [0056.354] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0056.354] lstrlenA (lpString="*.lnk") returned 5 [0056.354] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0056.354] lstrlenA (lpString="*.torrent") returned 9 [0056.354] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0056.355] lstrlenA (lpString="*.mov") returned 5 [0056.355] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0056.355] lstrlenA (lpString="*.m2v") returned 5 [0056.355] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0056.355] lstrlenA (lpString="*.3gp") returned 5 [0056.355] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0056.355] lstrlenA (lpString="*.mpeg") returned 6 [0056.355] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0056.355] lstrlenA (lpString="*.mpg") returned 5 [0056.355] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0056.355] lstrlenA (lpString="*.flv") returned 5 [0056.355] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0056.355] lstrlenA (lpString="*.avi") returned 5 [0056.355] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0056.355] lstrlenA (lpString="*.mp4") returned 5 [0056.355] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0056.355] lstrlenA (lpString="*.wmv") returned 5 [0056.355] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0056.355] lstrlenA (lpString="*.divx") returned 6 [0056.355] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0056.355] lstrlenA (lpString="*.mkv") returned 5 [0056.355] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0056.355] lstrlenA (lpString="*.mp3") returned 5 [0056.355] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0056.355] lstrlenA (lpString="*.wav") returned 5 [0056.355] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0056.355] lstrlenA (lpString="*.flac") returned 6 [0056.355] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0056.355] lstrlenA (lpString="*.ape") returned 5 [0056.355] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0056.355] lstrlenA (lpString="*.wma") returned 5 [0056.355] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0056.355] lstrlenA (lpString="*.ac3") returned 5 [0056.355] FindNextFileA (in: hFindFile=0x636b70, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb358, dwReserved0=0x6, dwReserved1=0x7000007, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0056.356] FindClose (in: hFindFile=0x636b70 | out: hFindFile=0x636b70) returned 1 [0056.356] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62f540, dwReserved1=0x7, cFileName="el-GR", cAlternateFileName="")) returned 1 [0056.356] lstrcmpA (lpString1=".", lpString2="el-GR") returned -1 [0056.356] lstrcmpA (lpString1="..", lpString2="el-GR") returned -1 [0056.356] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.356] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="el-GR" | out: lpString1="C:\\Boot\\el-GR") returned="C:\\Boot\\el-GR" [0056.356] lstrlenA (lpString="C:\\Boot\\el-GR") returned 13 [0056.356] FindFirstFileA (in: lpFileName="C:\\Boot\\el-GR\\*.*" (normalized: "c:\\boot\\el-gr\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636770 [0056.371] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.371] FindNextFileA (in: hFindFile=0x636770, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.371] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.371] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.371] FindNextFileA (in: hFindFile=0x636770, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x6, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.371] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.371] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.371] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.371] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.371] PathFindFileNameA (pszPath="C:\\Boot\\el-GR\\*.*") returned="*.*" [0056.371] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\el-GR\\" | out: lpString1="C:\\Boot\\el-GR\\") returned="C:\\Boot\\el-GR\\" [0056.371] PathAddBackslashA (in: pszPath="C:\\Boot\\el-GR\\" | out: pszPath="C:\\Boot\\el-GR\\") returned="" [0056.371] lstrcatA (in: lpString1="C:\\Boot\\el-GR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\el-GR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\el-GR\\HOW TO DECRYPT FILES.txt" [0056.371] GetFileAttributesA (lpFileName="C:\\Boot\\el-GR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\el-gr\\how to decrypt files.txt")) returned 0xffffffff [0056.371] CreateFileA (lpFileName="C:\\Boot\\el-GR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\el-gr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.373] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.373] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.374] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.375] CloseHandle (hObject=0x1c4) returned 1 [0056.375] lstrcatA (in: lpString1="C:\\Boot\\el-GR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned="C:\\Boot\\el-GR\\bootmgr.exe.mui" [0056.375] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.375] lstrlenA (lpString="*.zip") returned 5 [0056.375] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.375] lstrlenA (lpString="*.rar") returned 5 [0056.375] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.375] lstrlenA (lpString="*.7z") returned 4 [0056.375] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.375] lstrlenA (lpString="*.tar") returned 5 [0056.375] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.375] lstrlenA (lpString="*.gzip") returned 6 [0056.375] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.375] lstrlenA (lpString="*.jpg") returned 5 [0056.375] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.375] lstrlenA (lpString="*.jpeg") returned 6 [0056.375] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.375] lstrlenA (lpString="*.psd") returned 5 [0056.375] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.375] lstrlenA (lpString="*.cdr") returned 5 [0056.375] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.375] lstrlenA (lpString="*.dwg") returned 5 [0056.375] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.375] lstrlenA (lpString="*.max") returned 5 [0056.375] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.376] lstrlenA (lpString="*.bmp") returned 5 [0056.376] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.376] lstrlenA (lpString="*.gif") returned 5 [0056.376] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.376] lstrlenA (lpString="*.png") returned 5 [0056.376] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.376] lstrlenA (lpString="*.doc") returned 5 [0056.376] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.376] lstrlenA (lpString="*.docx") returned 6 [0056.376] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.376] lstrlenA (lpString="*.xls") returned 5 [0056.376] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.376] lstrlenA (lpString="*.xlsx") returned 6 [0056.376] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.376] lstrlenA (lpString="*.ppt") returned 5 [0056.376] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.376] lstrlenA (lpString="*.pptx") returned 6 [0056.376] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.376] lstrlenA (lpString="*.txt") returned 5 [0056.376] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.376] lstrlenA (lpString="*.pdf") returned 5 [0056.376] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.376] lstrlenA (lpString="*.djvu") returned 6 [0056.376] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.376] lstrlenA (lpString="*.htm") returned 5 [0056.376] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.376] lstrlenA (lpString="*.html") returned 6 [0056.376] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.376] lstrlenA (lpString="*.mdb") returned 5 [0056.376] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.376] lstrlenA (lpString="*.cer") returned 5 [0056.376] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.376] lstrlenA (lpString="*.p12") returned 5 [0056.377] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.377] lstrlenA (lpString="*.pfx") returned 5 [0056.377] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.377] lstrlenA (lpString="*.kwm") returned 5 [0056.377] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.377] lstrlenA (lpString="*.pwm") returned 5 [0056.377] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.377] lstrlenA (lpString="*.1cd") returned 5 [0056.377] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.377] lstrlenA (lpString="*.md") returned 4 [0056.377] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.377] lstrlenA (lpString="*.mdf") returned 5 [0056.377] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.377] lstrlenA (lpString="*.dbf") returned 5 [0056.377] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.377] lstrlenA (lpString="*.odt") returned 5 [0056.377] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.377] lstrlenA (lpString="*.vob") returned 5 [0056.377] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.377] lstrlenA (lpString="*.ifo") returned 5 [0056.377] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.377] lstrlenA (lpString="*.lnk") returned 5 [0056.377] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.377] lstrlenA (lpString="*.torrent") returned 9 [0056.377] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.377] lstrlenA (lpString="*.mov") returned 5 [0056.377] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.377] lstrlenA (lpString="*.m2v") returned 5 [0056.377] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.377] lstrlenA (lpString="*.3gp") returned 5 [0056.378] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.378] lstrlenA (lpString="*.mpeg") returned 6 [0056.378] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.378] lstrlenA (lpString="*.mpg") returned 5 [0056.378] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.378] lstrlenA (lpString="*.flv") returned 5 [0056.378] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.378] lstrlenA (lpString="*.avi") returned 5 [0056.378] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.378] lstrlenA (lpString="*.mp4") returned 5 [0056.378] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.378] lstrlenA (lpString="*.wmv") returned 5 [0056.378] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.378] lstrlenA (lpString="*.divx") returned 6 [0056.378] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.378] lstrlenA (lpString="*.mkv") returned 5 [0056.378] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.378] lstrlenA (lpString="*.mp3") returned 5 [0056.378] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.378] lstrlenA (lpString="*.wav") returned 5 [0056.378] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.378] lstrlenA (lpString="*.flac") returned 6 [0056.378] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.378] lstrlenA (lpString="*.ape") returned 5 [0056.378] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.378] lstrlenA (lpString="*.wma") returned 5 [0056.378] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.378] lstrlenA (lpString="*.ac3") returned 5 [0056.378] FindNextFileA (in: hFindFile=0x636770, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb560, dwReserved0=0x6, dwReserved1=0x7000007, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.378] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.378] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0056.379] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0056.379] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0056.379] PathFindFileNameA (pszPath="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0056.379] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\el-GR\\" | out: lpString1="C:\\Boot\\el-GR\\") returned="C:\\Boot\\el-GR\\" [0056.379] PathAddBackslashA (in: pszPath="C:\\Boot\\el-GR\\" | out: pszPath="C:\\Boot\\el-GR\\") returned="" [0056.379] lstrcatA (in: lpString1="C:\\Boot\\el-GR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\el-GR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\el-GR\\HOW TO DECRYPT FILES.txt" [0056.379] GetFileAttributesA (lpFileName="C:\\Boot\\el-GR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\el-gr\\how to decrypt files.txt")) returned 0x20 [0056.379] lstrcatA (in: lpString1="C:\\Boot\\el-GR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\el-GR\\memtest.exe.mui") returned="C:\\Boot\\el-GR\\memtest.exe.mui" [0056.379] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0056.379] lstrlenA (lpString="*.zip") returned 5 [0056.379] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0056.379] lstrlenA (lpString="*.rar") returned 5 [0056.379] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0056.379] lstrlenA (lpString="*.7z") returned 4 [0056.379] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0056.379] lstrlenA (lpString="*.tar") returned 5 [0056.379] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0056.379] lstrlenA (lpString="*.gzip") returned 6 [0056.379] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0056.379] lstrlenA (lpString="*.jpg") returned 5 [0056.379] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0056.379] lstrlenA (lpString="*.jpeg") returned 6 [0056.379] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0056.379] lstrlenA (lpString="*.psd") returned 5 [0056.379] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0056.379] lstrlenA (lpString="*.cdr") returned 5 [0056.379] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0056.379] lstrlenA (lpString="*.dwg") returned 5 [0056.380] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.max") returned 0 [0056.380] lstrlenA (lpString="*.max") returned 5 [0056.380] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0056.380] lstrlenA (lpString="*.bmp") returned 5 [0056.380] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0056.380] lstrlenA (lpString="*.gif") returned 5 [0056.380] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.png") returned 0 [0056.380] lstrlenA (lpString="*.png") returned 5 [0056.380] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0056.380] lstrlenA (lpString="*.doc") returned 5 [0056.380] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0056.380] lstrlenA (lpString="*.docx") returned 6 [0056.380] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0056.380] lstrlenA (lpString="*.xls") returned 5 [0056.380] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0056.380] lstrlenA (lpString="*.xlsx") returned 6 [0056.380] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0056.380] lstrlenA (lpString="*.ppt") returned 5 [0056.380] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0056.380] lstrlenA (lpString="*.pptx") returned 6 [0056.380] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0056.380] lstrlenA (lpString="*.txt") returned 5 [0056.380] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0056.380] lstrlenA (lpString="*.pdf") returned 5 [0056.380] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0056.380] lstrlenA (lpString="*.djvu") returned 6 [0056.380] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0056.380] lstrlenA (lpString="*.htm") returned 5 [0056.380] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.html") returned 0 [0056.380] lstrlenA (lpString="*.html") returned 6 [0056.380] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0056.380] lstrlenA (lpString="*.mdb") returned 5 [0056.381] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0056.381] lstrlenA (lpString="*.cer") returned 5 [0056.381] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0056.381] lstrlenA (lpString="*.p12") returned 5 [0056.381] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0056.381] lstrlenA (lpString="*.pfx") returned 5 [0056.381] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0056.381] lstrlenA (lpString="*.kwm") returned 5 [0056.381] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0056.381] lstrlenA (lpString="*.pwm") returned 5 [0056.381] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0056.381] lstrlenA (lpString="*.1cd") returned 5 [0056.381] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.md") returned 0 [0056.382] lstrlenA (lpString="*.md") returned 4 [0056.382] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0056.382] lstrlenA (lpString="*.mdf") returned 5 [0056.382] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0056.382] lstrlenA (lpString="*.dbf") returned 5 [0056.382] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0056.382] lstrlenA (lpString="*.odt") returned 5 [0056.382] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0056.382] lstrlenA (lpString="*.vob") returned 5 [0056.382] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0056.382] lstrlenA (lpString="*.ifo") returned 5 [0056.382] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0056.382] lstrlenA (lpString="*.lnk") returned 5 [0056.382] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0056.382] lstrlenA (lpString="*.torrent") returned 9 [0056.382] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0056.382] lstrlenA (lpString="*.mov") returned 5 [0056.382] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0056.382] lstrlenA (lpString="*.m2v") returned 5 [0056.382] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0056.382] lstrlenA (lpString="*.3gp") returned 5 [0056.382] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0056.382] lstrlenA (lpString="*.mpeg") returned 6 [0056.382] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0056.382] lstrlenA (lpString="*.mpg") returned 5 [0056.382] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0056.383] lstrlenA (lpString="*.flv") returned 5 [0056.383] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0056.383] lstrlenA (lpString="*.avi") returned 5 [0056.383] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0056.383] lstrlenA (lpString="*.mp4") returned 5 [0056.383] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0056.383] lstrlenA (lpString="*.wmv") returned 5 [0056.383] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0056.383] lstrlenA (lpString="*.divx") returned 6 [0056.383] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0056.383] lstrlenA (lpString="*.mkv") returned 5 [0056.383] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0056.383] lstrlenA (lpString="*.mp3") returned 5 [0056.383] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0056.383] lstrlenA (lpString="*.wav") returned 5 [0056.383] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0056.383] lstrlenA (lpString="*.flac") returned 6 [0056.383] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0056.383] lstrlenA (lpString="*.ape") returned 5 [0056.383] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0056.383] lstrlenA (lpString="*.wma") returned 5 [0056.383] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0056.383] lstrlenA (lpString="*.ac3") returned 5 [0056.383] FindNextFileA (in: hFindFile=0x636770, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb560, dwReserved0=0x6, dwReserved1=0x7000007, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0056.383] FindClose (in: hFindFile=0x636770 | out: hFindFile=0x636770) returned 1 [0056.383] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62f540, dwReserved1=0x7, cFileName="en-GB", cAlternateFileName="")) returned 1 [0056.383] lstrcmpA (lpString1=".", lpString2="en-GB") returned -1 [0056.384] lstrcmpA (lpString1="..", lpString2="en-GB") returned -1 [0056.384] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.384] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="en-GB" | out: lpString1="C:\\Boot\\en-GB") returned="C:\\Boot\\en-GB" [0056.384] lstrlenA (lpString="C:\\Boot\\en-GB") returned 13 [0056.384] FindFirstFileA (in: lpFileName="C:\\Boot\\en-GB\\*.*" (normalized: "c:\\boot\\en-gb\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6365b0 [0056.384] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.384] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.384] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.384] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.384] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x6, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.384] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.384] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.384] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.384] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.384] PathFindFileNameA (pszPath="C:\\Boot\\en-GB\\*.*") returned="*.*" [0056.384] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\en-GB\\" | out: lpString1="C:\\Boot\\en-GB\\") returned="C:\\Boot\\en-GB\\" [0056.384] PathAddBackslashA (in: pszPath="C:\\Boot\\en-GB\\" | out: pszPath="C:\\Boot\\en-GB\\") returned="" [0056.384] lstrcatA (in: lpString1="C:\\Boot\\en-GB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\en-GB\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\en-GB\\HOW TO DECRYPT FILES.txt" [0056.384] GetFileAttributesA (lpFileName="C:\\Boot\\en-GB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\en-gb\\how to decrypt files.txt")) returned 0xffffffff [0056.384] CreateFileA (lpFileName="C:\\Boot\\en-GB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\en-gb\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.385] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.385] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.386] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.386] CloseHandle (hObject=0x1c4) returned 1 [0056.386] lstrcatA (in: lpString1="C:\\Boot\\en-GB\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned="C:\\Boot\\en-GB\\bootmgr.exe.mui" [0056.386] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.386] lstrlenA (lpString="*.zip") returned 5 [0056.386] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.386] lstrlenA (lpString="*.rar") returned 5 [0056.386] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.386] lstrlenA (lpString="*.7z") returned 4 [0056.386] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.386] lstrlenA (lpString="*.tar") returned 5 [0056.386] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.386] lstrlenA (lpString="*.gzip") returned 6 [0056.386] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.387] lstrlenA (lpString="*.jpg") returned 5 [0056.387] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.387] lstrlenA (lpString="*.jpeg") returned 6 [0056.387] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.387] lstrlenA (lpString="*.psd") returned 5 [0056.387] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.387] lstrlenA (lpString="*.cdr") returned 5 [0056.387] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.387] lstrlenA (lpString="*.dwg") returned 5 [0056.387] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.387] lstrlenA (lpString="*.max") returned 5 [0056.387] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.387] lstrlenA (lpString="*.bmp") returned 5 [0056.387] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.387] lstrlenA (lpString="*.gif") returned 5 [0056.387] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.387] lstrlenA (lpString="*.png") returned 5 [0056.387] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.387] lstrlenA (lpString="*.doc") returned 5 [0056.387] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.387] lstrlenA (lpString="*.docx") returned 6 [0056.387] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.387] lstrlenA (lpString="*.xls") returned 5 [0056.387] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.387] lstrlenA (lpString="*.xlsx") returned 6 [0056.387] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.387] lstrlenA (lpString="*.ppt") returned 5 [0056.387] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.387] lstrlenA (lpString="*.pptx") returned 6 [0056.387] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.387] lstrlenA (lpString="*.txt") returned 5 [0056.387] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.388] lstrlenA (lpString="*.pdf") returned 5 [0056.388] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.388] lstrlenA (lpString="*.djvu") returned 6 [0056.388] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.388] lstrlenA (lpString="*.htm") returned 5 [0056.388] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.388] lstrlenA (lpString="*.html") returned 6 [0056.388] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.388] lstrlenA (lpString="*.mdb") returned 5 [0056.388] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.388] lstrlenA (lpString="*.cer") returned 5 [0056.388] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.388] lstrlenA (lpString="*.p12") returned 5 [0056.388] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.388] lstrlenA (lpString="*.pfx") returned 5 [0056.388] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.388] lstrlenA (lpString="*.kwm") returned 5 [0056.388] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.388] lstrlenA (lpString="*.pwm") returned 5 [0056.388] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.388] lstrlenA (lpString="*.1cd") returned 5 [0056.388] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.388] lstrlenA (lpString="*.md") returned 4 [0056.388] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.388] lstrlenA (lpString="*.mdf") returned 5 [0056.388] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.388] lstrlenA (lpString="*.dbf") returned 5 [0056.388] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.388] lstrlenA (lpString="*.odt") returned 5 [0056.388] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.388] lstrlenA (lpString="*.vob") returned 5 [0056.388] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.388] lstrlenA (lpString="*.ifo") returned 5 [0056.389] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.389] lstrlenA (lpString="*.lnk") returned 5 [0056.389] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.389] lstrlenA (lpString="*.torrent") returned 9 [0056.389] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.389] lstrlenA (lpString="*.mov") returned 5 [0056.389] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.389] lstrlenA (lpString="*.m2v") returned 5 [0056.389] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.389] lstrlenA (lpString="*.3gp") returned 5 [0056.389] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.389] lstrlenA (lpString="*.mpeg") returned 6 [0056.389] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.389] lstrlenA (lpString="*.mpg") returned 5 [0056.389] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.389] lstrlenA (lpString="*.flv") returned 5 [0056.389] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.389] lstrlenA (lpString="*.avi") returned 5 [0056.389] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.389] lstrlenA (lpString="*.mp4") returned 5 [0056.389] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.389] lstrlenA (lpString="*.wmv") returned 5 [0056.389] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.389] lstrlenA (lpString="*.divx") returned 6 [0056.389] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.389] lstrlenA (lpString="*.mkv") returned 5 [0056.389] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.389] lstrlenA (lpString="*.mp3") returned 5 [0056.389] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.389] lstrlenA (lpString="*.wav") returned 5 [0056.389] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.389] lstrlenA (lpString="*.flac") returned 6 [0056.389] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.390] lstrlenA (lpString="*.ape") returned 5 [0056.390] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.390] lstrlenA (lpString="*.wma") returned 5 [0056.390] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.390] lstrlenA (lpString="*.ac3") returned 5 [0056.390] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x6, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0056.390] FindClose (in: hFindFile=0x6365b0 | out: hFindFile=0x6365b0) returned 1 [0056.390] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62f540, dwReserved1=0x7, cFileName="en-US", cAlternateFileName="")) returned 1 [0056.390] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0056.390] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0056.390] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.390] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="en-US" | out: lpString1="C:\\Boot\\en-US") returned="C:\\Boot\\en-US" [0056.390] lstrlenA (lpString="C:\\Boot\\en-US") returned 13 [0056.390] FindFirstFileA (in: lpFileName="C:\\Boot\\en-US\\*.*" (normalized: "c:\\boot\\en-us\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6368b0 [0056.391] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.391] FindNextFileA (in: hFindFile=0x6368b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.391] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.391] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.391] FindNextFileA (in: hFindFile=0x6368b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0x6, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.391] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.391] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.391] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.391] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.391] PathFindFileNameA (pszPath="C:\\Boot\\en-US\\*.*") returned="*.*" [0056.391] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\en-US\\" | out: lpString1="C:\\Boot\\en-US\\") returned="C:\\Boot\\en-US\\" [0056.391] PathAddBackslashA (in: pszPath="C:\\Boot\\en-US\\" | out: pszPath="C:\\Boot\\en-US\\") returned="" [0056.391] lstrcatA (in: lpString1="C:\\Boot\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt" [0056.391] GetFileAttributesA (lpFileName="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0056.391] CreateFileA (lpFileName="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.393] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.393] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.395] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.395] CloseHandle (hObject=0x1c4) returned 1 [0056.396] lstrcatA (in: lpString1="C:\\Boot\\en-US\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\en-US\\bootmgr.exe.mui") returned="C:\\Boot\\en-US\\bootmgr.exe.mui" [0056.396] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.396] lstrlenA (lpString="*.zip") returned 5 [0056.396] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.396] lstrlenA (lpString="*.rar") returned 5 [0056.396] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.396] lstrlenA (lpString="*.7z") returned 4 [0056.396] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.396] lstrlenA (lpString="*.tar") returned 5 [0056.396] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.396] lstrlenA (lpString="*.gzip") returned 6 [0056.396] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.396] lstrlenA (lpString="*.jpg") returned 5 [0056.396] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.396] lstrlenA (lpString="*.jpeg") returned 6 [0056.396] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.396] lstrlenA (lpString="*.psd") returned 5 [0056.396] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.396] lstrlenA (lpString="*.cdr") returned 5 [0056.396] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.397] lstrlenA (lpString="*.dwg") returned 5 [0056.397] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.397] lstrlenA (lpString="*.max") returned 5 [0056.397] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.397] lstrlenA (lpString="*.bmp") returned 5 [0056.397] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.397] lstrlenA (lpString="*.gif") returned 5 [0056.397] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.397] lstrlenA (lpString="*.png") returned 5 [0056.397] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.397] lstrlenA (lpString="*.doc") returned 5 [0056.397] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.397] lstrlenA (lpString="*.docx") returned 6 [0056.397] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.397] lstrlenA (lpString="*.xls") returned 5 [0056.397] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.397] lstrlenA (lpString="*.xlsx") returned 6 [0056.397] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.397] lstrlenA (lpString="*.ppt") returned 5 [0056.397] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.397] lstrlenA (lpString="*.pptx") returned 6 [0056.397] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.397] lstrlenA (lpString="*.txt") returned 5 [0056.397] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.397] lstrlenA (lpString="*.pdf") returned 5 [0056.397] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.397] lstrlenA (lpString="*.djvu") returned 6 [0056.397] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.397] lstrlenA (lpString="*.htm") returned 5 [0056.397] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.397] lstrlenA (lpString="*.html") returned 6 [0056.398] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.398] lstrlenA (lpString="*.mdb") returned 5 [0056.398] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.398] lstrlenA (lpString="*.cer") returned 5 [0056.398] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.398] lstrlenA (lpString="*.p12") returned 5 [0056.398] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.398] lstrlenA (lpString="*.pfx") returned 5 [0056.398] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.398] lstrlenA (lpString="*.kwm") returned 5 [0056.398] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.398] lstrlenA (lpString="*.pwm") returned 5 [0056.398] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.398] lstrlenA (lpString="*.1cd") returned 5 [0056.398] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.398] lstrlenA (lpString="*.md") returned 4 [0056.398] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.398] lstrlenA (lpString="*.mdf") returned 5 [0056.398] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.398] lstrlenA (lpString="*.dbf") returned 5 [0056.398] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.398] lstrlenA (lpString="*.odt") returned 5 [0056.398] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.398] lstrlenA (lpString="*.vob") returned 5 [0056.398] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.398] lstrlenA (lpString="*.ifo") returned 5 [0056.398] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.398] lstrlenA (lpString="*.lnk") returned 5 [0056.398] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.398] lstrlenA (lpString="*.torrent") returned 9 [0056.398] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.398] lstrlenA (lpString="*.mov") returned 5 [0056.398] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.398] lstrlenA (lpString="*.m2v") returned 5 [0056.399] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.399] lstrlenA (lpString="*.3gp") returned 5 [0056.399] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.399] lstrlenA (lpString="*.mpeg") returned 6 [0056.399] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.399] lstrlenA (lpString="*.mpg") returned 5 [0056.399] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.399] lstrlenA (lpString="*.flv") returned 5 [0056.399] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.399] lstrlenA (lpString="*.avi") returned 5 [0056.399] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.399] lstrlenA (lpString="*.mp4") returned 5 [0056.399] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.399] lstrlenA (lpString="*.wmv") returned 5 [0056.399] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.399] lstrlenA (lpString="*.divx") returned 6 [0056.399] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.399] lstrlenA (lpString="*.mkv") returned 5 [0056.399] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.399] lstrlenA (lpString="*.mp3") returned 5 [0056.399] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.399] lstrlenA (lpString="*.wav") returned 5 [0056.399] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.399] lstrlenA (lpString="*.flac") returned 6 [0056.399] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.399] lstrlenA (lpString="*.ape") returned 5 [0056.399] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.399] lstrlenA (lpString="*.wma") returned 5 [0056.399] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.399] lstrlenA (lpString="*.ac3") returned 5 [0056.399] FindNextFileA (in: hFindFile=0x6368b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x6, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.399] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.399] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0056.399] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0056.399] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0056.400] PathFindFileNameA (pszPath="C:\\Boot\\en-US\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0056.400] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\en-US\\" | out: lpString1="C:\\Boot\\en-US\\") returned="C:\\Boot\\en-US\\" [0056.400] PathAddBackslashA (in: pszPath="C:\\Boot\\en-US\\" | out: pszPath="C:\\Boot\\en-US\\") returned="" [0056.400] lstrcatA (in: lpString1="C:\\Boot\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt" [0056.400] GetFileAttributesA (lpFileName="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\en-us\\how to decrypt files.txt")) returned 0x20 [0056.400] lstrcatA (in: lpString1="C:\\Boot\\en-US\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\en-US\\memtest.exe.mui") returned="C:\\Boot\\en-US\\memtest.exe.mui" [0056.400] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0056.400] lstrlenA (lpString="*.zip") returned 5 [0056.400] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0056.400] lstrlenA (lpString="*.rar") returned 5 [0056.400] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0056.400] lstrlenA (lpString="*.7z") returned 4 [0056.400] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0056.400] lstrlenA (lpString="*.tar") returned 5 [0056.400] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0056.400] lstrlenA (lpString="*.gzip") returned 6 [0056.400] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0056.400] lstrlenA (lpString="*.jpg") returned 5 [0056.400] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0056.400] lstrlenA (lpString="*.jpeg") returned 6 [0056.400] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0056.400] lstrlenA (lpString="*.psd") returned 5 [0056.400] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0056.400] lstrlenA (lpString="*.cdr") returned 5 [0056.400] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0056.400] lstrlenA (lpString="*.dwg") returned 5 [0056.400] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.max") returned 0 [0056.400] lstrlenA (lpString="*.max") returned 5 [0056.400] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0056.400] lstrlenA (lpString="*.bmp") returned 5 [0056.401] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0056.401] lstrlenA (lpString="*.gif") returned 5 [0056.401] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.png") returned 0 [0056.401] lstrlenA (lpString="*.png") returned 5 [0056.401] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0056.401] lstrlenA (lpString="*.doc") returned 5 [0056.401] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0056.401] lstrlenA (lpString="*.docx") returned 6 [0056.401] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0056.401] lstrlenA (lpString="*.xls") returned 5 [0056.401] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0056.401] lstrlenA (lpString="*.xlsx") returned 6 [0056.401] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0056.401] lstrlenA (lpString="*.ppt") returned 5 [0056.401] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0056.401] lstrlenA (lpString="*.pptx") returned 6 [0056.401] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0056.401] lstrlenA (lpString="*.txt") returned 5 [0056.401] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0056.401] lstrlenA (lpString="*.pdf") returned 5 [0056.401] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0056.401] lstrlenA (lpString="*.djvu") returned 6 [0056.401] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0056.401] lstrlenA (lpString="*.htm") returned 5 [0056.401] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.html") returned 0 [0056.401] lstrlenA (lpString="*.html") returned 6 [0056.401] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0056.401] lstrlenA (lpString="*.mdb") returned 5 [0056.401] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0056.401] lstrlenA (lpString="*.cer") returned 5 [0056.401] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0056.401] lstrlenA (lpString="*.p12") returned 5 [0056.401] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0056.401] lstrlenA (lpString="*.pfx") returned 5 [0056.402] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0056.402] lstrlenA (lpString="*.kwm") returned 5 [0056.402] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0056.402] lstrlenA (lpString="*.pwm") returned 5 [0056.402] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0056.402] lstrlenA (lpString="*.1cd") returned 5 [0056.402] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.md") returned 0 [0056.402] lstrlenA (lpString="*.md") returned 4 [0056.402] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0056.402] lstrlenA (lpString="*.mdf") returned 5 [0056.402] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0056.402] lstrlenA (lpString="*.dbf") returned 5 [0056.402] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0056.402] lstrlenA (lpString="*.odt") returned 5 [0056.402] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0056.402] lstrlenA (lpString="*.vob") returned 5 [0056.402] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0056.402] lstrlenA (lpString="*.ifo") returned 5 [0056.402] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0056.402] lstrlenA (lpString="*.lnk") returned 5 [0056.402] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0056.402] lstrlenA (lpString="*.torrent") returned 9 [0056.402] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0056.402] lstrlenA (lpString="*.mov") returned 5 [0056.402] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0056.402] lstrlenA (lpString="*.m2v") returned 5 [0056.402] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0056.402] lstrlenA (lpString="*.3gp") returned 5 [0056.402] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0056.402] lstrlenA (lpString="*.mpeg") returned 6 [0056.402] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0056.402] lstrlenA (lpString="*.mpg") returned 5 [0056.402] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0056.403] lstrlenA (lpString="*.flv") returned 5 [0056.403] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0056.403] lstrlenA (lpString="*.avi") returned 5 [0056.403] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0056.403] lstrlenA (lpString="*.mp4") returned 5 [0056.403] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0056.403] lstrlenA (lpString="*.wmv") returned 5 [0056.403] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0056.403] lstrlenA (lpString="*.divx") returned 6 [0056.403] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0056.403] lstrlenA (lpString="*.mkv") returned 5 [0056.403] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0056.403] lstrlenA (lpString="*.mp3") returned 5 [0056.403] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0056.403] lstrlenA (lpString="*.wav") returned 5 [0056.403] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0056.403] lstrlenA (lpString="*.flac") returned 6 [0056.403] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0056.403] lstrlenA (lpString="*.ape") returned 5 [0056.403] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0056.403] lstrlenA (lpString="*.wma") returned 5 [0056.403] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0056.403] lstrlenA (lpString="*.ac3") returned 5 [0056.403] FindNextFileA (in: hFindFile=0x6368b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x6, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0056.403] FindClose (in: hFindFile=0x6368b0 | out: hFindFile=0x6368b0) returned 1 [0056.403] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62f540, dwReserved1=0x7, cFileName="es-ES", cAlternateFileName="")) returned 1 [0056.403] lstrcmpA (lpString1=".", lpString2="es-ES") returned -1 [0056.403] lstrcmpA (lpString1="..", lpString2="es-ES") returned -1 [0056.404] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.404] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="es-ES" | out: lpString1="C:\\Boot\\es-ES") returned="C:\\Boot\\es-ES" [0056.404] lstrlenA (lpString="C:\\Boot\\es-ES") returned 13 [0056.404] FindFirstFileA (in: lpFileName="C:\\Boot\\es-ES\\*.*" (normalized: "c:\\boot\\es-es\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636630 [0056.427] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.427] FindNextFileA (in: hFindFile=0x636630, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.427] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.427] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.427] FindNextFileA (in: hFindFile=0x636630, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x6, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.427] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.427] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.427] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.427] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.427] PathFindFileNameA (pszPath="C:\\Boot\\es-ES\\*.*") returned="*.*" [0056.428] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\es-ES\\" | out: lpString1="C:\\Boot\\es-ES\\") returned="C:\\Boot\\es-ES\\" [0056.428] PathAddBackslashA (in: pszPath="C:\\Boot\\es-ES\\" | out: pszPath="C:\\Boot\\es-ES\\") returned="" [0056.428] lstrcatA (in: lpString1="C:\\Boot\\es-ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\es-ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\es-ES\\HOW TO DECRYPT FILES.txt" [0056.428] GetFileAttributesA (lpFileName="C:\\Boot\\es-ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\es-es\\how to decrypt files.txt")) returned 0xffffffff [0056.428] CreateFileA (lpFileName="C:\\Boot\\es-ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\es-es\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.430] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.430] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.431] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.431] CloseHandle (hObject=0x1c4) returned 1 [0056.431] lstrcatA (in: lpString1="C:\\Boot\\es-ES\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned="C:\\Boot\\es-ES\\bootmgr.exe.mui" [0056.431] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.431] lstrlenA (lpString="*.zip") returned 5 [0056.431] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.431] lstrlenA (lpString="*.rar") returned 5 [0056.431] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.431] lstrlenA (lpString="*.7z") returned 4 [0056.431] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.431] lstrlenA (lpString="*.tar") returned 5 [0056.431] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.432] lstrlenA (lpString="*.gzip") returned 6 [0056.432] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.432] lstrlenA (lpString="*.jpg") returned 5 [0056.432] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.432] lstrlenA (lpString="*.jpeg") returned 6 [0056.432] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.432] lstrlenA (lpString="*.psd") returned 5 [0056.432] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.432] lstrlenA (lpString="*.cdr") returned 5 [0056.432] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.432] lstrlenA (lpString="*.dwg") returned 5 [0056.432] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.432] lstrlenA (lpString="*.max") returned 5 [0056.432] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.432] lstrlenA (lpString="*.bmp") returned 5 [0056.432] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.432] lstrlenA (lpString="*.gif") returned 5 [0056.432] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.432] lstrlenA (lpString="*.png") returned 5 [0056.432] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.432] lstrlenA (lpString="*.doc") returned 5 [0056.432] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.432] lstrlenA (lpString="*.docx") returned 6 [0056.432] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.432] lstrlenA (lpString="*.xls") returned 5 [0056.432] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.432] lstrlenA (lpString="*.xlsx") returned 6 [0056.432] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.432] lstrlenA (lpString="*.ppt") returned 5 [0056.432] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.432] lstrlenA (lpString="*.pptx") returned 6 [0056.432] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.432] lstrlenA (lpString="*.txt") returned 5 [0056.432] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.432] lstrlenA (lpString="*.pdf") returned 5 [0056.433] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.433] lstrlenA (lpString="*.djvu") returned 6 [0056.433] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.433] lstrlenA (lpString="*.htm") returned 5 [0056.433] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.433] lstrlenA (lpString="*.html") returned 6 [0056.433] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.433] lstrlenA (lpString="*.mdb") returned 5 [0056.433] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.433] lstrlenA (lpString="*.cer") returned 5 [0056.433] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.433] lstrlenA (lpString="*.p12") returned 5 [0056.433] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.433] lstrlenA (lpString="*.pfx") returned 5 [0056.433] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.433] lstrlenA (lpString="*.kwm") returned 5 [0056.433] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.433] lstrlenA (lpString="*.pwm") returned 5 [0056.433] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.433] lstrlenA (lpString="*.1cd") returned 5 [0056.433] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.433] lstrlenA (lpString="*.md") returned 4 [0056.433] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.433] lstrlenA (lpString="*.mdf") returned 5 [0056.433] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.433] lstrlenA (lpString="*.dbf") returned 5 [0056.433] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.433] lstrlenA (lpString="*.odt") returned 5 [0056.433] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.433] lstrlenA (lpString="*.vob") returned 5 [0056.433] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.433] lstrlenA (lpString="*.ifo") returned 5 [0056.433] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.434] lstrlenA (lpString="*.lnk") returned 5 [0056.434] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.434] lstrlenA (lpString="*.torrent") returned 9 [0056.434] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.434] lstrlenA (lpString="*.mov") returned 5 [0056.434] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.434] lstrlenA (lpString="*.m2v") returned 5 [0056.434] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.434] lstrlenA (lpString="*.3gp") returned 5 [0056.434] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.434] lstrlenA (lpString="*.mpeg") returned 6 [0056.434] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.434] lstrlenA (lpString="*.mpg") returned 5 [0056.434] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.434] lstrlenA (lpString="*.flv") returned 5 [0056.434] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.434] lstrlenA (lpString="*.avi") returned 5 [0056.434] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.434] lstrlenA (lpString="*.mp4") returned 5 [0056.434] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.434] lstrlenA (lpString="*.wmv") returned 5 [0056.434] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.434] lstrlenA (lpString="*.divx") returned 6 [0056.434] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.434] lstrlenA (lpString="*.mkv") returned 5 [0056.434] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.434] lstrlenA (lpString="*.mp3") returned 5 [0056.434] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.434] lstrlenA (lpString="*.wav") returned 5 [0056.434] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.434] lstrlenA (lpString="*.flac") returned 6 [0056.434] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.434] lstrlenA (lpString="*.ape") returned 5 [0056.434] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.434] lstrlenA (lpString="*.wma") returned 5 [0056.435] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.435] lstrlenA (lpString="*.ac3") returned 5 [0056.435] FindNextFileA (in: hFindFile=0x636630, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb358, dwReserved0=0x6, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.435] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.435] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0056.435] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0056.435] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0056.435] PathFindFileNameA (pszPath="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0056.435] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\es-ES\\" | out: lpString1="C:\\Boot\\es-ES\\") returned="C:\\Boot\\es-ES\\" [0056.435] PathAddBackslashA (in: pszPath="C:\\Boot\\es-ES\\" | out: pszPath="C:\\Boot\\es-ES\\") returned="" [0056.435] lstrcatA (in: lpString1="C:\\Boot\\es-ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\es-ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\es-ES\\HOW TO DECRYPT FILES.txt" [0056.435] GetFileAttributesA (lpFileName="C:\\Boot\\es-ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\es-es\\how to decrypt files.txt")) returned 0x20 [0056.435] lstrcatA (in: lpString1="C:\\Boot\\es-ES\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\es-ES\\memtest.exe.mui") returned="C:\\Boot\\es-ES\\memtest.exe.mui" [0056.435] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0056.435] lstrlenA (lpString="*.zip") returned 5 [0056.435] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0056.435] lstrlenA (lpString="*.rar") returned 5 [0056.435] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0056.435] lstrlenA (lpString="*.7z") returned 4 [0056.435] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0056.435] lstrlenA (lpString="*.tar") returned 5 [0056.435] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0056.435] lstrlenA (lpString="*.gzip") returned 6 [0056.435] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0056.435] lstrlenA (lpString="*.jpg") returned 5 [0056.435] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0056.435] lstrlenA (lpString="*.jpeg") returned 6 [0056.435] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0056.435] lstrlenA (lpString="*.psd") returned 5 [0056.435] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0056.436] lstrlenA (lpString="*.cdr") returned 5 [0056.436] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0056.436] lstrlenA (lpString="*.dwg") returned 5 [0056.436] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.max") returned 0 [0056.436] lstrlenA (lpString="*.max") returned 5 [0056.436] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0056.436] lstrlenA (lpString="*.bmp") returned 5 [0056.436] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0056.436] lstrlenA (lpString="*.gif") returned 5 [0056.436] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.png") returned 0 [0056.436] lstrlenA (lpString="*.png") returned 5 [0056.436] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0056.436] lstrlenA (lpString="*.doc") returned 5 [0056.436] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0056.436] lstrlenA (lpString="*.docx") returned 6 [0056.436] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0056.436] lstrlenA (lpString="*.xls") returned 5 [0056.436] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0056.436] lstrlenA (lpString="*.xlsx") returned 6 [0056.436] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0056.436] lstrlenA (lpString="*.ppt") returned 5 [0056.436] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0056.436] lstrlenA (lpString="*.pptx") returned 6 [0056.436] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0056.436] lstrlenA (lpString="*.txt") returned 5 [0056.436] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0056.436] lstrlenA (lpString="*.pdf") returned 5 [0056.436] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0056.436] lstrlenA (lpString="*.djvu") returned 6 [0056.436] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0056.436] lstrlenA (lpString="*.htm") returned 5 [0056.436] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.html") returned 0 [0056.436] lstrlenA (lpString="*.html") returned 6 [0056.436] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0056.436] lstrlenA (lpString="*.mdb") returned 5 [0056.436] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0056.437] lstrlenA (lpString="*.cer") returned 5 [0056.437] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0056.437] lstrlenA (lpString="*.p12") returned 5 [0056.437] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0056.437] lstrlenA (lpString="*.pfx") returned 5 [0056.437] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0056.437] lstrlenA (lpString="*.kwm") returned 5 [0056.437] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0056.437] lstrlenA (lpString="*.pwm") returned 5 [0056.437] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0056.437] lstrlenA (lpString="*.1cd") returned 5 [0056.437] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.md") returned 0 [0056.437] lstrlenA (lpString="*.md") returned 4 [0056.437] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0056.437] lstrlenA (lpString="*.mdf") returned 5 [0056.437] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0056.437] lstrlenA (lpString="*.dbf") returned 5 [0056.437] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0056.437] lstrlenA (lpString="*.odt") returned 5 [0056.437] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0056.437] lstrlenA (lpString="*.vob") returned 5 [0056.437] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0056.437] lstrlenA (lpString="*.ifo") returned 5 [0056.437] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0056.437] lstrlenA (lpString="*.lnk") returned 5 [0056.437] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0056.437] lstrlenA (lpString="*.torrent") returned 9 [0056.437] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0056.437] lstrlenA (lpString="*.mov") returned 5 [0056.437] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0056.438] lstrlenA (lpString="*.m2v") returned 5 [0056.438] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0056.438] lstrlenA (lpString="*.3gp") returned 5 [0056.438] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0056.438] lstrlenA (lpString="*.mpeg") returned 6 [0056.438] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0056.438] lstrlenA (lpString="*.mpg") returned 5 [0056.438] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0056.438] lstrlenA (lpString="*.flv") returned 5 [0056.438] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0056.438] lstrlenA (lpString="*.avi") returned 5 [0056.438] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0056.438] lstrlenA (lpString="*.mp4") returned 5 [0056.438] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0056.438] lstrlenA (lpString="*.wmv") returned 5 [0056.438] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0056.438] lstrlenA (lpString="*.divx") returned 6 [0056.438] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0056.438] lstrlenA (lpString="*.mkv") returned 5 [0056.438] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0056.438] lstrlenA (lpString="*.mp3") returned 5 [0056.438] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0056.438] lstrlenA (lpString="*.wav") returned 5 [0056.438] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0056.439] lstrlenA (lpString="*.flac") returned 6 [0056.439] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0056.439] lstrlenA (lpString="*.ape") returned 5 [0056.439] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0056.439] lstrlenA (lpString="*.wma") returned 5 [0056.439] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0056.439] lstrlenA (lpString="*.ac3") returned 5 [0056.439] FindNextFileA (in: hFindFile=0x636630, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb358, dwReserved0=0x6, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0056.439] FindClose (in: hFindFile=0x636630 | out: hFindFile=0x636630) returned 1 [0056.439] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62f540, dwReserved1=0x7, cFileName="es-MX", cAlternateFileName="")) returned 1 [0056.439] lstrcmpA (lpString1=".", lpString2="es-MX") returned -1 [0056.439] lstrcmpA (lpString1="..", lpString2="es-MX") returned -1 [0056.439] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.439] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="es-MX" | out: lpString1="C:\\Boot\\es-MX") returned="C:\\Boot\\es-MX" [0056.439] lstrlenA (lpString="C:\\Boot\\es-MX") returned 13 [0056.439] FindFirstFileA (in: lpFileName="C:\\Boot\\es-MX\\*.*" (normalized: "c:\\boot\\es-mx\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636530 [0056.439] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.439] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.439] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.439] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.439] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x6, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.440] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.440] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.440] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.440] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.440] PathFindFileNameA (pszPath="C:\\Boot\\es-MX\\*.*") returned="*.*" [0056.440] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\es-MX\\" | out: lpString1="C:\\Boot\\es-MX\\") returned="C:\\Boot\\es-MX\\" [0056.440] PathAddBackslashA (in: pszPath="C:\\Boot\\es-MX\\" | out: pszPath="C:\\Boot\\es-MX\\") returned="" [0056.440] lstrcatA (in: lpString1="C:\\Boot\\es-MX\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\es-MX\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\es-MX\\HOW TO DECRYPT FILES.txt" [0056.440] GetFileAttributesA (lpFileName="C:\\Boot\\es-MX\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\es-mx\\how to decrypt files.txt")) returned 0xffffffff [0056.440] CreateFileA (lpFileName="C:\\Boot\\es-MX\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\es-mx\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.440] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.440] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.441] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.441] CloseHandle (hObject=0x1c4) returned 1 [0056.442] lstrcatA (in: lpString1="C:\\Boot\\es-MX\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned="C:\\Boot\\es-MX\\bootmgr.exe.mui" [0056.442] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.442] lstrlenA (lpString="*.zip") returned 5 [0056.442] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.442] lstrlenA (lpString="*.rar") returned 5 [0056.442] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.442] lstrlenA (lpString="*.7z") returned 4 [0056.442] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.442] lstrlenA (lpString="*.tar") returned 5 [0056.442] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.442] lstrlenA (lpString="*.gzip") returned 6 [0056.442] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.442] lstrlenA (lpString="*.jpg") returned 5 [0056.442] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.442] lstrlenA (lpString="*.jpeg") returned 6 [0056.442] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.442] lstrlenA (lpString="*.psd") returned 5 [0056.442] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.442] lstrlenA (lpString="*.cdr") returned 5 [0056.442] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.442] lstrlenA (lpString="*.dwg") returned 5 [0056.442] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.442] lstrlenA (lpString="*.max") returned 5 [0056.442] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.442] lstrlenA (lpString="*.bmp") returned 5 [0056.442] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.442] lstrlenA (lpString="*.gif") returned 5 [0056.442] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.443] lstrlenA (lpString="*.png") returned 5 [0056.443] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.443] lstrlenA (lpString="*.doc") returned 5 [0056.443] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.443] lstrlenA (lpString="*.docx") returned 6 [0056.443] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.443] lstrlenA (lpString="*.xls") returned 5 [0056.443] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.443] lstrlenA (lpString="*.xlsx") returned 6 [0056.443] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.443] lstrlenA (lpString="*.ppt") returned 5 [0056.443] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.443] lstrlenA (lpString="*.pptx") returned 6 [0056.443] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.443] lstrlenA (lpString="*.txt") returned 5 [0056.443] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.443] lstrlenA (lpString="*.pdf") returned 5 [0056.443] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.443] lstrlenA (lpString="*.djvu") returned 6 [0056.443] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.443] lstrlenA (lpString="*.htm") returned 5 [0056.443] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.443] lstrlenA (lpString="*.html") returned 6 [0056.443] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.443] lstrlenA (lpString="*.mdb") returned 5 [0056.443] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.443] lstrlenA (lpString="*.cer") returned 5 [0056.443] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.443] lstrlenA (lpString="*.p12") returned 5 [0056.443] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.443] lstrlenA (lpString="*.pfx") returned 5 [0056.443] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.444] lstrlenA (lpString="*.kwm") returned 5 [0056.444] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.444] lstrlenA (lpString="*.pwm") returned 5 [0056.444] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.444] lstrlenA (lpString="*.1cd") returned 5 [0056.444] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.444] lstrlenA (lpString="*.md") returned 4 [0056.444] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.444] lstrlenA (lpString="*.mdf") returned 5 [0056.444] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.444] lstrlenA (lpString="*.dbf") returned 5 [0056.444] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.444] lstrlenA (lpString="*.odt") returned 5 [0056.444] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.444] lstrlenA (lpString="*.vob") returned 5 [0056.444] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.444] lstrlenA (lpString="*.ifo") returned 5 [0056.444] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.444] lstrlenA (lpString="*.lnk") returned 5 [0056.444] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.444] lstrlenA (lpString="*.torrent") returned 9 [0056.444] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.444] lstrlenA (lpString="*.mov") returned 5 [0056.444] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.444] lstrlenA (lpString="*.m2v") returned 5 [0056.444] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.444] lstrlenA (lpString="*.3gp") returned 5 [0056.444] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.444] lstrlenA (lpString="*.mpeg") returned 6 [0056.444] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.444] lstrlenA (lpString="*.mpg") returned 5 [0056.444] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.444] lstrlenA (lpString="*.flv") returned 5 [0056.444] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.444] lstrlenA (lpString="*.avi") returned 5 [0056.444] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.445] lstrlenA (lpString="*.mp4") returned 5 [0056.445] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.445] lstrlenA (lpString="*.wmv") returned 5 [0056.445] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.445] lstrlenA (lpString="*.divx") returned 6 [0056.445] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.445] lstrlenA (lpString="*.mkv") returned 5 [0056.445] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.445] lstrlenA (lpString="*.mp3") returned 5 [0056.445] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.445] lstrlenA (lpString="*.wav") returned 5 [0056.445] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.445] lstrlenA (lpString="*.flac") returned 6 [0056.445] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.445] lstrlenA (lpString="*.ape") returned 5 [0056.445] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.445] lstrlenA (lpString="*.wma") returned 5 [0056.445] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.445] lstrlenA (lpString="*.ac3") returned 5 [0056.445] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x6, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0056.445] FindClose (in: hFindFile=0x636530 | out: hFindFile=0x636530) returned 1 [0056.445] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62f540, dwReserved1=0x7, cFileName="et-EE", cAlternateFileName="")) returned 1 [0056.445] lstrcmpA (lpString1=".", lpString2="et-EE") returned -1 [0056.445] lstrcmpA (lpString1="..", lpString2="et-EE") returned -1 [0056.445] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.445] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="et-EE" | out: lpString1="C:\\Boot\\et-EE") returned="C:\\Boot\\et-EE" [0056.445] lstrlenA (lpString="C:\\Boot\\et-EE") returned 13 [0056.445] FindFirstFileA (in: lpFileName="C:\\Boot\\et-EE\\*.*" (normalized: "c:\\boot\\et-ee\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636470 [0056.448] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.449] FindNextFileA (in: hFindFile=0x636470, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.449] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.449] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.449] FindNextFileA (in: hFindFile=0x636470, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x6, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.449] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.449] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.449] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.449] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.449] PathFindFileNameA (pszPath="C:\\Boot\\et-EE\\*.*") returned="*.*" [0056.449] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\et-EE\\" | out: lpString1="C:\\Boot\\et-EE\\") returned="C:\\Boot\\et-EE\\" [0056.449] PathAddBackslashA (in: pszPath="C:\\Boot\\et-EE\\" | out: pszPath="C:\\Boot\\et-EE\\") returned="" [0056.449] lstrcatA (in: lpString1="C:\\Boot\\et-EE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\et-EE\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\et-EE\\HOW TO DECRYPT FILES.txt" [0056.449] GetFileAttributesA (lpFileName="C:\\Boot\\et-EE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\et-ee\\how to decrypt files.txt")) returned 0xffffffff [0056.449] CreateFileA (lpFileName="C:\\Boot\\et-EE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\et-ee\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.449] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.449] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.451] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.451] CloseHandle (hObject=0x1c4) returned 1 [0056.451] lstrcatA (in: lpString1="C:\\Boot\\et-EE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned="C:\\Boot\\et-EE\\bootmgr.exe.mui" [0056.451] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.451] lstrlenA (lpString="*.zip") returned 5 [0056.451] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.451] lstrlenA (lpString="*.rar") returned 5 [0056.451] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.451] lstrlenA (lpString="*.7z") returned 4 [0056.451] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.451] lstrlenA (lpString="*.tar") returned 5 [0056.451] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.451] lstrlenA (lpString="*.gzip") returned 6 [0056.451] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.451] lstrlenA (lpString="*.jpg") returned 5 [0056.451] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.451] lstrlenA (lpString="*.jpeg") returned 6 [0056.451] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.451] lstrlenA (lpString="*.psd") returned 5 [0056.451] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.451] lstrlenA (lpString="*.cdr") returned 5 [0056.452] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.452] lstrlenA (lpString="*.dwg") returned 5 [0056.452] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.452] lstrlenA (lpString="*.max") returned 5 [0056.452] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.452] lstrlenA (lpString="*.bmp") returned 5 [0056.452] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.452] lstrlenA (lpString="*.gif") returned 5 [0056.452] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.452] lstrlenA (lpString="*.png") returned 5 [0056.452] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.452] lstrlenA (lpString="*.doc") returned 5 [0056.452] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.452] lstrlenA (lpString="*.docx") returned 6 [0056.452] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.452] lstrlenA (lpString="*.xls") returned 5 [0056.452] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.452] lstrlenA (lpString="*.xlsx") returned 6 [0056.452] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.452] lstrlenA (lpString="*.ppt") returned 5 [0056.452] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.452] lstrlenA (lpString="*.pptx") returned 6 [0056.452] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.452] lstrlenA (lpString="*.txt") returned 5 [0056.452] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.452] lstrlenA (lpString="*.pdf") returned 5 [0056.452] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.452] lstrlenA (lpString="*.djvu") returned 6 [0056.452] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.452] lstrlenA (lpString="*.htm") returned 5 [0056.452] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.452] lstrlenA (lpString="*.html") returned 6 [0056.452] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.452] lstrlenA (lpString="*.mdb") returned 5 [0056.452] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.453] lstrlenA (lpString="*.cer") returned 5 [0056.453] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.453] lstrlenA (lpString="*.p12") returned 5 [0056.453] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.453] lstrlenA (lpString="*.pfx") returned 5 [0056.453] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.453] lstrlenA (lpString="*.kwm") returned 5 [0056.453] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.453] lstrlenA (lpString="*.pwm") returned 5 [0056.453] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.453] lstrlenA (lpString="*.1cd") returned 5 [0056.453] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.453] lstrlenA (lpString="*.md") returned 4 [0056.453] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.453] lstrlenA (lpString="*.mdf") returned 5 [0056.453] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.453] lstrlenA (lpString="*.dbf") returned 5 [0056.453] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.453] lstrlenA (lpString="*.odt") returned 5 [0056.453] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.453] lstrlenA (lpString="*.vob") returned 5 [0056.453] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.453] lstrlenA (lpString="*.ifo") returned 5 [0056.453] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.453] lstrlenA (lpString="*.lnk") returned 5 [0056.453] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.453] lstrlenA (lpString="*.torrent") returned 9 [0056.453] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.453] lstrlenA (lpString="*.mov") returned 5 [0056.453] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.453] lstrlenA (lpString="*.m2v") returned 5 [0056.453] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.453] lstrlenA (lpString="*.3gp") returned 5 [0056.454] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.454] lstrlenA (lpString="*.mpeg") returned 6 [0056.454] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.454] lstrlenA (lpString="*.mpg") returned 5 [0056.454] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.454] lstrlenA (lpString="*.flv") returned 5 [0056.454] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.454] lstrlenA (lpString="*.avi") returned 5 [0056.454] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.454] lstrlenA (lpString="*.mp4") returned 5 [0056.454] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.454] lstrlenA (lpString="*.wmv") returned 5 [0056.454] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.454] lstrlenA (lpString="*.divx") returned 6 [0056.454] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.454] lstrlenA (lpString="*.mkv") returned 5 [0056.454] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.454] lstrlenA (lpString="*.mp3") returned 5 [0056.454] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.454] lstrlenA (lpString="*.wav") returned 5 [0056.454] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.454] lstrlenA (lpString="*.flac") returned 6 [0056.454] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.454] lstrlenA (lpString="*.ape") returned 5 [0056.454] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.454] lstrlenA (lpString="*.wma") returned 5 [0056.454] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.454] lstrlenA (lpString="*.ac3") returned 5 [0056.454] FindNextFileA (in: hFindFile=0x636470, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x6, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0056.454] FindClose (in: hFindFile=0x636470 | out: hFindFile=0x636470) returned 1 [0056.457] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62f540, dwReserved1=0x7, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0056.457] lstrcmpA (lpString1=".", lpString2="fi-FI") returned -1 [0056.457] lstrcmpA (lpString1="..", lpString2="fi-FI") returned -1 [0056.457] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.457] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="fi-FI" | out: lpString1="C:\\Boot\\fi-FI") returned="C:\\Boot\\fi-FI" [0056.457] lstrlenA (lpString="C:\\Boot\\fi-FI") returned 13 [0056.457] FindFirstFileA (in: lpFileName="C:\\Boot\\fi-FI\\*.*" (normalized: "c:\\boot\\fi-fi\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636930 [0056.457] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.457] FindNextFileA (in: hFindFile=0x636930, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.458] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.458] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.458] FindNextFileA (in: hFindFile=0x636930, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x6, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.458] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.458] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.458] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.458] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.458] PathFindFileNameA (pszPath="C:\\Boot\\fi-FI\\*.*") returned="*.*" [0056.458] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\fi-FI\\" | out: lpString1="C:\\Boot\\fi-FI\\") returned="C:\\Boot\\fi-FI\\" [0056.458] PathAddBackslashA (in: pszPath="C:\\Boot\\fi-FI\\" | out: pszPath="C:\\Boot\\fi-FI\\") returned="" [0056.458] lstrcatA (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\fi-FI\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\fi-FI\\HOW TO DECRYPT FILES.txt" [0056.458] GetFileAttributesA (lpFileName="C:\\Boot\\fi-FI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fi-fi\\how to decrypt files.txt")) returned 0xffffffff [0056.458] CreateFileA (lpFileName="C:\\Boot\\fi-FI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fi-fi\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.460] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.460] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.461] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.461] CloseHandle (hObject=0x1c4) returned 1 [0056.461] lstrcatA (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned="C:\\Boot\\fi-FI\\bootmgr.exe.mui" [0056.461] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.462] lstrlenA (lpString="*.zip") returned 5 [0056.462] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.462] lstrlenA (lpString="*.rar") returned 5 [0056.462] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.462] lstrlenA (lpString="*.7z") returned 4 [0056.462] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.462] lstrlenA (lpString="*.tar") returned 5 [0056.462] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.462] lstrlenA (lpString="*.gzip") returned 6 [0056.462] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.462] lstrlenA (lpString="*.jpg") returned 5 [0056.462] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.462] lstrlenA (lpString="*.jpeg") returned 6 [0056.462] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.462] lstrlenA (lpString="*.psd") returned 5 [0056.462] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.462] lstrlenA (lpString="*.cdr") returned 5 [0056.462] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.462] lstrlenA (lpString="*.dwg") returned 5 [0056.462] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.462] lstrlenA (lpString="*.max") returned 5 [0056.462] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.462] lstrlenA (lpString="*.bmp") returned 5 [0056.462] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.462] lstrlenA (lpString="*.gif") returned 5 [0056.462] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.462] lstrlenA (lpString="*.png") returned 5 [0056.462] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.462] lstrlenA (lpString="*.doc") returned 5 [0056.462] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.462] lstrlenA (lpString="*.docx") returned 6 [0056.462] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.462] lstrlenA (lpString="*.xls") returned 5 [0056.463] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.463] lstrlenA (lpString="*.xlsx") returned 6 [0056.463] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.463] lstrlenA (lpString="*.ppt") returned 5 [0056.463] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.463] lstrlenA (lpString="*.pptx") returned 6 [0056.463] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.463] lstrlenA (lpString="*.txt") returned 5 [0056.463] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.463] lstrlenA (lpString="*.pdf") returned 5 [0056.463] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.463] lstrlenA (lpString="*.djvu") returned 6 [0056.463] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.463] lstrlenA (lpString="*.htm") returned 5 [0056.463] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.463] lstrlenA (lpString="*.html") returned 6 [0056.463] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.463] lstrlenA (lpString="*.mdb") returned 5 [0056.463] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.463] lstrlenA (lpString="*.cer") returned 5 [0056.463] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.463] lstrlenA (lpString="*.p12") returned 5 [0056.463] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.463] lstrlenA (lpString="*.pfx") returned 5 [0056.463] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.463] lstrlenA (lpString="*.kwm") returned 5 [0056.463] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.463] lstrlenA (lpString="*.pwm") returned 5 [0056.463] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.463] lstrlenA (lpString="*.1cd") returned 5 [0056.463] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.464] lstrlenA (lpString="*.md") returned 4 [0056.464] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.464] lstrlenA (lpString="*.mdf") returned 5 [0056.464] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.464] lstrlenA (lpString="*.dbf") returned 5 [0056.464] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.464] lstrlenA (lpString="*.odt") returned 5 [0056.464] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.464] lstrlenA (lpString="*.vob") returned 5 [0056.464] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.464] lstrlenA (lpString="*.ifo") returned 5 [0056.464] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.464] lstrlenA (lpString="*.lnk") returned 5 [0056.464] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.464] lstrlenA (lpString="*.torrent") returned 9 [0056.464] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.464] lstrlenA (lpString="*.mov") returned 5 [0056.464] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.464] lstrlenA (lpString="*.m2v") returned 5 [0056.464] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.464] lstrlenA (lpString="*.3gp") returned 5 [0056.464] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.464] lstrlenA (lpString="*.mpeg") returned 6 [0056.464] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.464] lstrlenA (lpString="*.mpg") returned 5 [0056.464] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.464] lstrlenA (lpString="*.flv") returned 5 [0056.464] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.464] lstrlenA (lpString="*.avi") returned 5 [0056.464] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.464] lstrlenA (lpString="*.mp4") returned 5 [0056.464] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.464] lstrlenA (lpString="*.wmv") returned 5 [0056.465] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.465] lstrlenA (lpString="*.divx") returned 6 [0056.465] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.465] lstrlenA (lpString="*.mkv") returned 5 [0056.465] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.465] lstrlenA (lpString="*.mp3") returned 5 [0056.465] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.465] lstrlenA (lpString="*.wav") returned 5 [0056.465] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.465] lstrlenA (lpString="*.flac") returned 6 [0056.465] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.465] lstrlenA (lpString="*.ape") returned 5 [0056.465] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.465] lstrlenA (lpString="*.wma") returned 5 [0056.465] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.465] lstrlenA (lpString="*.ac3") returned 5 [0056.465] FindNextFileA (in: hFindFile=0x636930, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb158, dwReserved0=0x6, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.465] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.465] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0056.465] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0056.465] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0056.465] PathFindFileNameA (pszPath="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0056.465] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\fi-FI\\" | out: lpString1="C:\\Boot\\fi-FI\\") returned="C:\\Boot\\fi-FI\\" [0056.465] PathAddBackslashA (in: pszPath="C:\\Boot\\fi-FI\\" | out: pszPath="C:\\Boot\\fi-FI\\") returned="" [0056.465] lstrcatA (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\fi-FI\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\fi-FI\\HOW TO DECRYPT FILES.txt" [0056.465] GetFileAttributesA (lpFileName="C:\\Boot\\fi-FI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fi-fi\\how to decrypt files.txt")) returned 0x20 [0056.465] lstrcatA (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\fi-FI\\memtest.exe.mui") returned="C:\\Boot\\fi-FI\\memtest.exe.mui" [0056.465] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0056.466] lstrlenA (lpString="*.zip") returned 5 [0056.466] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0056.466] lstrlenA (lpString="*.rar") returned 5 [0056.466] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0056.466] lstrlenA (lpString="*.7z") returned 4 [0056.466] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0056.466] lstrlenA (lpString="*.tar") returned 5 [0056.466] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0056.466] lstrlenA (lpString="*.gzip") returned 6 [0056.466] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0056.466] lstrlenA (lpString="*.jpg") returned 5 [0056.466] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0056.466] lstrlenA (lpString="*.jpeg") returned 6 [0056.466] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0056.466] lstrlenA (lpString="*.psd") returned 5 [0056.466] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0056.466] lstrlenA (lpString="*.cdr") returned 5 [0056.466] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0056.466] lstrlenA (lpString="*.dwg") returned 5 [0056.466] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.max") returned 0 [0056.466] lstrlenA (lpString="*.max") returned 5 [0056.466] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0056.466] lstrlenA (lpString="*.bmp") returned 5 [0056.466] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0056.466] lstrlenA (lpString="*.gif") returned 5 [0056.466] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.png") returned 0 [0056.466] lstrlenA (lpString="*.png") returned 5 [0056.466] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0056.466] lstrlenA (lpString="*.doc") returned 5 [0056.466] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0056.466] lstrlenA (lpString="*.docx") returned 6 [0056.466] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0056.466] lstrlenA (lpString="*.xls") returned 5 [0056.467] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0056.467] lstrlenA (lpString="*.xlsx") returned 6 [0056.467] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0056.467] lstrlenA (lpString="*.ppt") returned 5 [0056.467] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0056.467] lstrlenA (lpString="*.pptx") returned 6 [0056.467] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0056.467] lstrlenA (lpString="*.txt") returned 5 [0056.467] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0056.467] lstrlenA (lpString="*.pdf") returned 5 [0056.467] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0056.467] lstrlenA (lpString="*.djvu") returned 6 [0056.467] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0056.467] lstrlenA (lpString="*.htm") returned 5 [0056.467] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.html") returned 0 [0056.467] lstrlenA (lpString="*.html") returned 6 [0056.467] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0056.467] lstrlenA (lpString="*.mdb") returned 5 [0056.467] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0056.467] lstrlenA (lpString="*.cer") returned 5 [0056.467] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0056.467] lstrlenA (lpString="*.p12") returned 5 [0056.467] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0056.467] lstrlenA (lpString="*.pfx") returned 5 [0056.467] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0056.467] lstrlenA (lpString="*.kwm") returned 5 [0056.467] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0056.467] lstrlenA (lpString="*.pwm") returned 5 [0056.467] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0056.467] lstrlenA (lpString="*.1cd") returned 5 [0056.467] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.md") returned 0 [0056.467] lstrlenA (lpString="*.md") returned 4 [0056.467] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0056.467] lstrlenA (lpString="*.mdf") returned 5 [0056.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0056.468] lstrlenA (lpString="*.dbf") returned 5 [0056.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0056.468] lstrlenA (lpString="*.odt") returned 5 [0056.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0056.468] lstrlenA (lpString="*.vob") returned 5 [0056.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0056.468] lstrlenA (lpString="*.ifo") returned 5 [0056.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0056.468] lstrlenA (lpString="*.lnk") returned 5 [0056.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0056.468] lstrlenA (lpString="*.torrent") returned 9 [0056.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0056.468] lstrlenA (lpString="*.mov") returned 5 [0056.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0056.468] lstrlenA (lpString="*.m2v") returned 5 [0056.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0056.468] lstrlenA (lpString="*.3gp") returned 5 [0056.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0056.468] lstrlenA (lpString="*.mpeg") returned 6 [0056.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0056.468] lstrlenA (lpString="*.mpg") returned 5 [0056.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0056.468] lstrlenA (lpString="*.flv") returned 5 [0056.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0056.468] lstrlenA (lpString="*.avi") returned 5 [0056.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0056.468] lstrlenA (lpString="*.mp4") returned 5 [0056.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0056.468] lstrlenA (lpString="*.wmv") returned 5 [0056.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0056.468] lstrlenA (lpString="*.divx") returned 6 [0056.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0056.469] lstrlenA (lpString="*.mkv") returned 5 [0056.469] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0056.469] lstrlenA (lpString="*.mp3") returned 5 [0056.469] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0056.469] lstrlenA (lpString="*.wav") returned 5 [0056.469] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0056.469] lstrlenA (lpString="*.flac") returned 6 [0056.469] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0056.469] lstrlenA (lpString="*.ape") returned 5 [0056.469] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0056.469] lstrlenA (lpString="*.wma") returned 5 [0056.469] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0056.469] lstrlenA (lpString="*.ac3") returned 5 [0056.469] FindNextFileA (in: hFindFile=0x636930, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb158, dwReserved0=0x6, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0056.469] FindClose (in: hFindFile=0x636930 | out: hFindFile=0x636930) returned 1 [0056.469] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62f540, dwReserved1=0x7, cFileName="Fonts", cAlternateFileName="")) returned 1 [0056.469] lstrcmpA (lpString1=".", lpString2="Fonts") returned -1 [0056.469] lstrcmpA (lpString1="..", lpString2="Fonts") returned -1 [0056.469] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.469] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="Fonts" | out: lpString1="C:\\Boot\\Fonts") returned="C:\\Boot\\Fonts" [0056.469] lstrlenA (lpString="C:\\Boot\\Fonts") returned 13 [0056.469] FindFirstFileA (in: lpFileName="C:\\Boot\\Fonts\\*.*" (normalized: "c:\\boot\\fonts\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6365b0 [0056.496] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.496] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.496] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.496] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.496] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211a0897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x6, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0056.496] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.496] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="chs_boot.ttf") returned 1 [0056.496] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chs_boot.ttf") returned 1 [0056.496] lstrcmpiA (lpString1="", lpString2="chs_boot.ttf") returned -1 [0056.496] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\*.*") returned="*.*" [0056.496] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0056.496] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0056.496] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0056.496] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0xffffffff [0056.496] CreateFileA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.497] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.497] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.498] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.498] CloseHandle (hObject=0x1c4) returned 1 [0056.498] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="chs_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\chs_boot.ttf") returned="C:\\Boot\\Fonts\\chs_boot.ttf" [0056.498] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.zip") returned 0 [0056.498] lstrlenA (lpString="*.zip") returned 5 [0056.498] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.rar") returned 0 [0056.498] lstrlenA (lpString="*.rar") returned 5 [0056.498] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.7z") returned 0 [0056.498] lstrlenA (lpString="*.7z") returned 4 [0056.499] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.tar") returned 0 [0056.499] lstrlenA (lpString="*.tar") returned 5 [0056.499] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.gzip") returned 0 [0056.499] lstrlenA (lpString="*.gzip") returned 6 [0056.499] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.jpg") returned 0 [0056.499] lstrlenA (lpString="*.jpg") returned 5 [0056.499] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.jpeg") returned 0 [0056.499] lstrlenA (lpString="*.jpeg") returned 6 [0056.499] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.psd") returned 0 [0056.499] lstrlenA (lpString="*.psd") returned 5 [0056.499] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.cdr") returned 0 [0056.499] lstrlenA (lpString="*.cdr") returned 5 [0056.499] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.dwg") returned 0 [0056.499] lstrlenA (lpString="*.dwg") returned 5 [0056.499] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.max") returned 0 [0056.499] lstrlenA (lpString="*.max") returned 5 [0056.499] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.bmp") returned 0 [0056.499] lstrlenA (lpString="*.bmp") returned 5 [0056.499] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.gif") returned 0 [0056.499] lstrlenA (lpString="*.gif") returned 5 [0056.499] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.png") returned 0 [0056.499] lstrlenA (lpString="*.png") returned 5 [0056.499] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.doc") returned 0 [0056.499] lstrlenA (lpString="*.doc") returned 5 [0056.499] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.docx") returned 0 [0056.499] lstrlenA (lpString="*.docx") returned 6 [0056.499] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.xls") returned 0 [0056.499] lstrlenA (lpString="*.xls") returned 5 [0056.499] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.xlsx") returned 0 [0056.499] lstrlenA (lpString="*.xlsx") returned 6 [0056.499] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.ppt") returned 0 [0056.499] lstrlenA (lpString="*.ppt") returned 5 [0056.499] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.pptx") returned 0 [0056.499] lstrlenA (lpString="*.pptx") returned 6 [0056.500] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.txt") returned 0 [0056.500] lstrlenA (lpString="*.txt") returned 5 [0056.500] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.pdf") returned 0 [0056.500] lstrlenA (lpString="*.pdf") returned 5 [0056.500] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.djvu") returned 0 [0056.500] lstrlenA (lpString="*.djvu") returned 6 [0056.500] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.htm") returned 0 [0056.500] lstrlenA (lpString="*.htm") returned 5 [0056.500] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.html") returned 0 [0056.500] lstrlenA (lpString="*.html") returned 6 [0056.500] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mdb") returned 0 [0056.500] lstrlenA (lpString="*.mdb") returned 5 [0056.500] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.cer") returned 0 [0056.500] lstrlenA (lpString="*.cer") returned 5 [0056.500] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.p12") returned 0 [0056.500] lstrlenA (lpString="*.p12") returned 5 [0056.500] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.pfx") returned 0 [0056.500] lstrlenA (lpString="*.pfx") returned 5 [0056.500] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.kwm") returned 0 [0056.500] lstrlenA (lpString="*.kwm") returned 5 [0056.500] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.pwm") returned 0 [0056.500] lstrlenA (lpString="*.pwm") returned 5 [0056.500] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.1cd") returned 0 [0056.500] lstrlenA (lpString="*.1cd") returned 5 [0056.500] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.md") returned 0 [0056.500] lstrlenA (lpString="*.md") returned 4 [0056.500] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mdf") returned 0 [0056.500] lstrlenA (lpString="*.mdf") returned 5 [0056.500] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.dbf") returned 0 [0056.500] lstrlenA (lpString="*.dbf") returned 5 [0056.500] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.odt") returned 0 [0056.500] lstrlenA (lpString="*.odt") returned 5 [0056.500] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.vob") returned 0 [0056.500] lstrlenA (lpString="*.vob") returned 5 [0056.501] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.ifo") returned 0 [0056.501] lstrlenA (lpString="*.ifo") returned 5 [0056.501] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.lnk") returned 0 [0056.501] lstrlenA (lpString="*.lnk") returned 5 [0056.501] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.torrent") returned 0 [0056.501] lstrlenA (lpString="*.torrent") returned 9 [0056.501] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mov") returned 0 [0056.501] lstrlenA (lpString="*.mov") returned 5 [0056.501] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.m2v") returned 0 [0056.501] lstrlenA (lpString="*.m2v") returned 5 [0056.501] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.3gp") returned 0 [0056.501] lstrlenA (lpString="*.3gp") returned 5 [0056.501] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mpeg") returned 0 [0056.501] lstrlenA (lpString="*.mpeg") returned 6 [0056.501] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mpg") returned 0 [0056.501] lstrlenA (lpString="*.mpg") returned 5 [0056.501] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.flv") returned 0 [0056.501] lstrlenA (lpString="*.flv") returned 5 [0056.501] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.avi") returned 0 [0056.501] lstrlenA (lpString="*.avi") returned 5 [0056.501] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mp4") returned 0 [0056.501] lstrlenA (lpString="*.mp4") returned 5 [0056.501] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.wmv") returned 0 [0056.501] lstrlenA (lpString="*.wmv") returned 5 [0056.501] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.divx") returned 0 [0056.501] lstrlenA (lpString="*.divx") returned 6 [0056.501] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mkv") returned 0 [0056.501] lstrlenA (lpString="*.mkv") returned 5 [0056.501] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mp3") returned 0 [0056.501] lstrlenA (lpString="*.mp3") returned 5 [0056.501] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.wav") returned 0 [0056.501] lstrlenA (lpString="*.wav") returned 5 [0056.501] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.flac") returned 0 [0056.502] lstrlenA (lpString="*.flac") returned 6 [0056.502] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.ape") returned 0 [0056.502] lstrlenA (lpString="*.ape") returned 5 [0056.502] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.wma") returned 0 [0056.502] lstrlenA (lpString="*.wma") returned 5 [0056.502] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.ac3") returned 0 [0056.502] lstrlenA (lpString="*.ac3") returned 5 [0056.502] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78adba97, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78adba97, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211ecd4c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x6, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0056.502] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.502] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cht_boot.ttf") returned 1 [0056.502] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cht_boot.ttf") returned 1 [0056.502] lstrcmpiA (lpString1="", lpString2="cht_boot.ttf") returned -1 [0056.502] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\chs_boot.ttf") returned="chs_boot.ttf" [0056.502] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0056.502] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0056.502] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0056.502] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0056.502] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="cht_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\cht_boot.ttf") returned="C:\\Boot\\Fonts\\cht_boot.ttf" [0056.502] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.zip") returned 0 [0056.502] lstrlenA (lpString="*.zip") returned 5 [0056.502] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.rar") returned 0 [0056.502] lstrlenA (lpString="*.rar") returned 5 [0056.502] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.7z") returned 0 [0056.502] lstrlenA (lpString="*.7z") returned 4 [0056.502] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.tar") returned 0 [0056.502] lstrlenA (lpString="*.tar") returned 5 [0056.502] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.gzip") returned 0 [0056.502] lstrlenA (lpString="*.gzip") returned 6 [0056.502] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.jpg") returned 0 [0056.503] lstrlenA (lpString="*.jpg") returned 5 [0056.503] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.jpeg") returned 0 [0056.503] lstrlenA (lpString="*.jpeg") returned 6 [0056.503] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.psd") returned 0 [0056.503] lstrlenA (lpString="*.psd") returned 5 [0056.503] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.cdr") returned 0 [0056.503] lstrlenA (lpString="*.cdr") returned 5 [0056.503] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.dwg") returned 0 [0056.503] lstrlenA (lpString="*.dwg") returned 5 [0056.503] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.max") returned 0 [0056.503] lstrlenA (lpString="*.max") returned 5 [0056.503] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.bmp") returned 0 [0056.503] lstrlenA (lpString="*.bmp") returned 5 [0056.503] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.gif") returned 0 [0056.503] lstrlenA (lpString="*.gif") returned 5 [0056.503] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.png") returned 0 [0056.503] lstrlenA (lpString="*.png") returned 5 [0056.503] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.doc") returned 0 [0056.503] lstrlenA (lpString="*.doc") returned 5 [0056.503] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.docx") returned 0 [0056.503] lstrlenA (lpString="*.docx") returned 6 [0056.503] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.xls") returned 0 [0056.503] lstrlenA (lpString="*.xls") returned 5 [0056.503] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.xlsx") returned 0 [0056.503] lstrlenA (lpString="*.xlsx") returned 6 [0056.503] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.ppt") returned 0 [0056.503] lstrlenA (lpString="*.ppt") returned 5 [0056.503] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.pptx") returned 0 [0056.503] lstrlenA (lpString="*.pptx") returned 6 [0056.503] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.txt") returned 0 [0056.503] lstrlenA (lpString="*.txt") returned 5 [0056.503] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.pdf") returned 0 [0056.503] lstrlenA (lpString="*.pdf") returned 5 [0056.504] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.djvu") returned 0 [0056.504] lstrlenA (lpString="*.djvu") returned 6 [0056.504] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.htm") returned 0 [0056.504] lstrlenA (lpString="*.htm") returned 5 [0056.504] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.html") returned 0 [0056.504] lstrlenA (lpString="*.html") returned 6 [0056.504] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mdb") returned 0 [0056.504] lstrlenA (lpString="*.mdb") returned 5 [0056.504] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.cer") returned 0 [0056.504] lstrlenA (lpString="*.cer") returned 5 [0056.504] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.p12") returned 0 [0056.504] lstrlenA (lpString="*.p12") returned 5 [0056.504] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.pfx") returned 0 [0056.504] lstrlenA (lpString="*.pfx") returned 5 [0056.504] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.kwm") returned 0 [0056.504] lstrlenA (lpString="*.kwm") returned 5 [0056.504] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.pwm") returned 0 [0056.504] lstrlenA (lpString="*.pwm") returned 5 [0056.504] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.1cd") returned 0 [0056.504] lstrlenA (lpString="*.1cd") returned 5 [0056.504] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.md") returned 0 [0056.504] lstrlenA (lpString="*.md") returned 4 [0056.504] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mdf") returned 0 [0056.504] lstrlenA (lpString="*.mdf") returned 5 [0056.504] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.dbf") returned 0 [0056.504] lstrlenA (lpString="*.dbf") returned 5 [0056.504] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.odt") returned 0 [0056.504] lstrlenA (lpString="*.odt") returned 5 [0056.504] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.vob") returned 0 [0056.504] lstrlenA (lpString="*.vob") returned 5 [0056.504] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.ifo") returned 0 [0056.504] lstrlenA (lpString="*.ifo") returned 5 [0056.504] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.lnk") returned 0 [0056.504] lstrlenA (lpString="*.lnk") returned 5 [0056.504] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.torrent") returned 0 [0056.505] lstrlenA (lpString="*.torrent") returned 9 [0056.505] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mov") returned 0 [0056.505] lstrlenA (lpString="*.mov") returned 5 [0056.505] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.m2v") returned 0 [0056.505] lstrlenA (lpString="*.m2v") returned 5 [0056.505] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.3gp") returned 0 [0056.505] lstrlenA (lpString="*.3gp") returned 5 [0056.505] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mpeg") returned 0 [0056.505] lstrlenA (lpString="*.mpeg") returned 6 [0056.505] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mpg") returned 0 [0056.505] lstrlenA (lpString="*.mpg") returned 5 [0056.505] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.flv") returned 0 [0056.505] lstrlenA (lpString="*.flv") returned 5 [0056.505] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.avi") returned 0 [0056.505] lstrlenA (lpString="*.avi") returned 5 [0056.505] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mp4") returned 0 [0056.506] lstrlenA (lpString="*.mp4") returned 5 [0056.506] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.wmv") returned 0 [0056.506] lstrlenA (lpString="*.wmv") returned 5 [0056.506] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.divx") returned 0 [0056.506] lstrlenA (lpString="*.divx") returned 6 [0056.506] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mkv") returned 0 [0056.506] lstrlenA (lpString="*.mkv") returned 5 [0056.506] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mp3") returned 0 [0056.506] lstrlenA (lpString="*.mp3") returned 5 [0056.506] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.wav") returned 0 [0056.506] lstrlenA (lpString="*.wav") returned 5 [0056.506] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.flac") returned 0 [0056.506] lstrlenA (lpString="*.flac") returned 6 [0056.506] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.ape") returned 0 [0056.506] lstrlenA (lpString="*.ape") returned 5 [0056.506] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.wma") returned 0 [0056.506] lstrlenA (lpString="*.wma") returned 5 [0056.506] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.ac3") returned 0 [0056.506] lstrlenA (lpString="*.ac3") returned 5 [0056.506] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78adba97, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78adba97, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x6, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0056.506] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.506] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="jpn_boot.ttf") returned -1 [0056.506] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jpn_boot.ttf") returned -1 [0056.506] lstrcmpiA (lpString1="", lpString2="jpn_boot.ttf") returned -1 [0056.506] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\cht_boot.ttf") returned="cht_boot.ttf" [0056.506] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0056.506] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0056.506] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0056.506] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0056.506] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="jpn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\jpn_boot.ttf") returned="C:\\Boot\\Fonts\\jpn_boot.ttf" [0056.506] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.zip") returned 0 [0056.507] lstrlenA (lpString="*.zip") returned 5 [0056.507] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.rar") returned 0 [0056.507] lstrlenA (lpString="*.rar") returned 5 [0056.507] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.7z") returned 0 [0056.507] lstrlenA (lpString="*.7z") returned 4 [0056.507] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.tar") returned 0 [0056.507] lstrlenA (lpString="*.tar") returned 5 [0056.507] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.gzip") returned 0 [0056.507] lstrlenA (lpString="*.gzip") returned 6 [0056.507] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.jpg") returned 0 [0056.507] lstrlenA (lpString="*.jpg") returned 5 [0056.507] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.jpeg") returned 0 [0056.507] lstrlenA (lpString="*.jpeg") returned 6 [0056.507] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.psd") returned 0 [0056.507] lstrlenA (lpString="*.psd") returned 5 [0056.507] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.cdr") returned 0 [0056.507] lstrlenA (lpString="*.cdr") returned 5 [0056.507] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.dwg") returned 0 [0056.507] lstrlenA (lpString="*.dwg") returned 5 [0056.507] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.max") returned 0 [0056.507] lstrlenA (lpString="*.max") returned 5 [0056.507] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.bmp") returned 0 [0056.507] lstrlenA (lpString="*.bmp") returned 5 [0056.507] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.gif") returned 0 [0056.507] lstrlenA (lpString="*.gif") returned 5 [0056.507] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.png") returned 0 [0056.507] lstrlenA (lpString="*.png") returned 5 [0056.507] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.doc") returned 0 [0056.507] lstrlenA (lpString="*.doc") returned 5 [0056.507] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.docx") returned 0 [0056.507] lstrlenA (lpString="*.docx") returned 6 [0056.507] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.xls") returned 0 [0056.507] lstrlenA (lpString="*.xls") returned 5 [0056.507] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.xlsx") returned 0 [0056.507] lstrlenA (lpString="*.xlsx") returned 6 [0056.507] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.ppt") returned 0 [0056.508] lstrlenA (lpString="*.ppt") returned 5 [0056.508] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.pptx") returned 0 [0056.508] lstrlenA (lpString="*.pptx") returned 6 [0056.508] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.txt") returned 0 [0056.508] lstrlenA (lpString="*.txt") returned 5 [0056.508] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.pdf") returned 0 [0056.508] lstrlenA (lpString="*.pdf") returned 5 [0056.508] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.djvu") returned 0 [0056.508] lstrlenA (lpString="*.djvu") returned 6 [0056.508] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.htm") returned 0 [0056.508] lstrlenA (lpString="*.htm") returned 5 [0056.508] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.html") returned 0 [0056.508] lstrlenA (lpString="*.html") returned 6 [0056.508] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mdb") returned 0 [0056.508] lstrlenA (lpString="*.mdb") returned 5 [0056.508] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.cer") returned 0 [0056.508] lstrlenA (lpString="*.cer") returned 5 [0056.508] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.p12") returned 0 [0056.508] lstrlenA (lpString="*.p12") returned 5 [0056.508] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.pfx") returned 0 [0056.508] lstrlenA (lpString="*.pfx") returned 5 [0056.508] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.kwm") returned 0 [0056.508] lstrlenA (lpString="*.kwm") returned 5 [0056.508] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.pwm") returned 0 [0056.508] lstrlenA (lpString="*.pwm") returned 5 [0056.508] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.1cd") returned 0 [0056.508] lstrlenA (lpString="*.1cd") returned 5 [0056.508] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.md") returned 0 [0056.508] lstrlenA (lpString="*.md") returned 4 [0056.508] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mdf") returned 0 [0056.508] lstrlenA (lpString="*.mdf") returned 5 [0056.508] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.dbf") returned 0 [0056.508] lstrlenA (lpString="*.dbf") returned 5 [0056.508] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.odt") returned 0 [0056.508] lstrlenA (lpString="*.odt") returned 5 [0056.509] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.vob") returned 0 [0056.509] lstrlenA (lpString="*.vob") returned 5 [0056.509] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.ifo") returned 0 [0056.509] lstrlenA (lpString="*.ifo") returned 5 [0056.509] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.lnk") returned 0 [0056.509] lstrlenA (lpString="*.lnk") returned 5 [0056.509] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.torrent") returned 0 [0056.509] lstrlenA (lpString="*.torrent") returned 9 [0056.509] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mov") returned 0 [0056.509] lstrlenA (lpString="*.mov") returned 5 [0056.509] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.m2v") returned 0 [0056.509] lstrlenA (lpString="*.m2v") returned 5 [0056.509] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.3gp") returned 0 [0056.509] lstrlenA (lpString="*.3gp") returned 5 [0056.509] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mpeg") returned 0 [0056.509] lstrlenA (lpString="*.mpeg") returned 6 [0056.509] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mpg") returned 0 [0056.509] lstrlenA (lpString="*.mpg") returned 5 [0056.509] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.flv") returned 0 [0056.509] lstrlenA (lpString="*.flv") returned 5 [0056.509] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.avi") returned 0 [0056.509] lstrlenA (lpString="*.avi") returned 5 [0056.509] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mp4") returned 0 [0056.509] lstrlenA (lpString="*.mp4") returned 5 [0056.509] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.wmv") returned 0 [0056.509] lstrlenA (lpString="*.wmv") returned 5 [0056.509] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.divx") returned 0 [0056.509] lstrlenA (lpString="*.divx") returned 6 [0056.509] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mkv") returned 0 [0056.509] lstrlenA (lpString="*.mkv") returned 5 [0056.509] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mp3") returned 0 [0056.509] lstrlenA (lpString="*.mp3") returned 5 [0056.510] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.wav") returned 0 [0056.510] lstrlenA (lpString="*.wav") returned 5 [0056.510] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.flac") returned 0 [0056.510] lstrlenA (lpString="*.flac") returned 6 [0056.510] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.ape") returned 0 [0056.510] lstrlenA (lpString="*.ape") returned 5 [0056.510] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.wma") returned 0 [0056.510] lstrlenA (lpString="*.wma") returned 5 [0056.510] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.ac3") returned 0 [0056.510] lstrlenA (lpString="*.ac3") returned 5 [0056.510] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78adba97, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78adba97, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x6, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0056.510] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.510] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="kor_boot.ttf") returned -1 [0056.510] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="kor_boot.ttf") returned -1 [0056.510] lstrcmpiA (lpString1="", lpString2="kor_boot.ttf") returned -1 [0056.510] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\jpn_boot.ttf") returned="jpn_boot.ttf" [0056.510] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0056.510] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0056.510] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0056.510] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0056.510] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="kor_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\kor_boot.ttf") returned="C:\\Boot\\Fonts\\kor_boot.ttf" [0056.510] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.zip") returned 0 [0056.510] lstrlenA (lpString="*.zip") returned 5 [0056.510] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.rar") returned 0 [0056.510] lstrlenA (lpString="*.rar") returned 5 [0056.510] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.7z") returned 0 [0056.510] lstrlenA (lpString="*.7z") returned 4 [0056.510] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.tar") returned 0 [0056.510] lstrlenA (lpString="*.tar") returned 5 [0056.510] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.gzip") returned 0 [0056.510] lstrlenA (lpString="*.gzip") returned 6 [0056.510] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.jpg") returned 0 [0056.511] lstrlenA (lpString="*.jpg") returned 5 [0056.511] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.jpeg") returned 0 [0056.511] lstrlenA (lpString="*.jpeg") returned 6 [0056.511] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.psd") returned 0 [0056.511] lstrlenA (lpString="*.psd") returned 5 [0056.511] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.cdr") returned 0 [0056.511] lstrlenA (lpString="*.cdr") returned 5 [0056.511] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.dwg") returned 0 [0056.511] lstrlenA (lpString="*.dwg") returned 5 [0056.511] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.max") returned 0 [0056.511] lstrlenA (lpString="*.max") returned 5 [0056.511] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.bmp") returned 0 [0056.511] lstrlenA (lpString="*.bmp") returned 5 [0056.511] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.gif") returned 0 [0056.511] lstrlenA (lpString="*.gif") returned 5 [0056.511] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.png") returned 0 [0056.511] lstrlenA (lpString="*.png") returned 5 [0056.511] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.doc") returned 0 [0056.511] lstrlenA (lpString="*.doc") returned 5 [0056.511] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.docx") returned 0 [0056.511] lstrlenA (lpString="*.docx") returned 6 [0056.511] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.xls") returned 0 [0056.511] lstrlenA (lpString="*.xls") returned 5 [0056.511] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.xlsx") returned 0 [0056.511] lstrlenA (lpString="*.xlsx") returned 6 [0056.511] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.ppt") returned 0 [0056.511] lstrlenA (lpString="*.ppt") returned 5 [0056.511] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.pptx") returned 0 [0056.511] lstrlenA (lpString="*.pptx") returned 6 [0056.511] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.txt") returned 0 [0056.511] lstrlenA (lpString="*.txt") returned 5 [0056.511] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.pdf") returned 0 [0056.511] lstrlenA (lpString="*.pdf") returned 5 [0056.511] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.djvu") returned 0 [0056.511] lstrlenA (lpString="*.djvu") returned 6 [0056.512] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.htm") returned 0 [0056.512] lstrlenA (lpString="*.htm") returned 5 [0056.512] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.html") returned 0 [0056.512] lstrlenA (lpString="*.html") returned 6 [0056.512] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mdb") returned 0 [0056.512] lstrlenA (lpString="*.mdb") returned 5 [0056.512] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.cer") returned 0 [0056.512] lstrlenA (lpString="*.cer") returned 5 [0056.512] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.p12") returned 0 [0056.512] lstrlenA (lpString="*.p12") returned 5 [0056.512] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.pfx") returned 0 [0056.512] lstrlenA (lpString="*.pfx") returned 5 [0056.512] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.kwm") returned 0 [0056.512] lstrlenA (lpString="*.kwm") returned 5 [0056.512] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.pwm") returned 0 [0056.512] lstrlenA (lpString="*.pwm") returned 5 [0056.512] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.1cd") returned 0 [0056.512] lstrlenA (lpString="*.1cd") returned 5 [0056.512] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.md") returned 0 [0056.512] lstrlenA (lpString="*.md") returned 4 [0056.512] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mdf") returned 0 [0056.512] lstrlenA (lpString="*.mdf") returned 5 [0056.512] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.dbf") returned 0 [0056.512] lstrlenA (lpString="*.dbf") returned 5 [0056.512] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.odt") returned 0 [0056.512] lstrlenA (lpString="*.odt") returned 5 [0056.512] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.vob") returned 0 [0056.512] lstrlenA (lpString="*.vob") returned 5 [0056.512] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.ifo") returned 0 [0056.512] lstrlenA (lpString="*.ifo") returned 5 [0056.512] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.lnk") returned 0 [0056.512] lstrlenA (lpString="*.lnk") returned 5 [0056.512] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.torrent") returned 0 [0056.512] lstrlenA (lpString="*.torrent") returned 9 [0056.512] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mov") returned 0 [0056.513] lstrlenA (lpString="*.mov") returned 5 [0056.513] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.m2v") returned 0 [0056.513] lstrlenA (lpString="*.m2v") returned 5 [0056.513] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.3gp") returned 0 [0056.513] lstrlenA (lpString="*.3gp") returned 5 [0056.513] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mpeg") returned 0 [0056.513] lstrlenA (lpString="*.mpeg") returned 6 [0056.513] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mpg") returned 0 [0056.513] lstrlenA (lpString="*.mpg") returned 5 [0056.513] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.flv") returned 0 [0056.513] lstrlenA (lpString="*.flv") returned 5 [0056.513] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.avi") returned 0 [0056.513] lstrlenA (lpString="*.avi") returned 5 [0056.513] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mp4") returned 0 [0056.513] lstrlenA (lpString="*.mp4") returned 5 [0056.513] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.wmv") returned 0 [0056.513] lstrlenA (lpString="*.wmv") returned 5 [0056.513] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.divx") returned 0 [0056.513] lstrlenA (lpString="*.divx") returned 6 [0056.513] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mkv") returned 0 [0056.513] lstrlenA (lpString="*.mkv") returned 5 [0056.513] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mp3") returned 0 [0056.513] lstrlenA (lpString="*.mp3") returned 5 [0056.513] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.wav") returned 0 [0056.513] lstrlenA (lpString="*.wav") returned 5 [0056.513] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.flac") returned 0 [0056.513] lstrlenA (lpString="*.flac") returned 6 [0056.513] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.ape") returned 0 [0056.513] lstrlenA (lpString="*.ape") returned 5 [0056.513] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.wma") returned 0 [0056.513] lstrlenA (lpString="*.wma") returned 5 [0056.513] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.ac3") returned 0 [0056.513] lstrlenA (lpString="*.ac3") returned 5 [0056.513] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b01e78, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b01e78, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x28784, dwReserved0=0x6, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1 [0056.513] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.514] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="malgunn_boot.ttf") returned -1 [0056.514] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="malgunn_boot.ttf") returned -1 [0056.514] lstrcmpiA (lpString1="", lpString2="malgunn_boot.ttf") returned -1 [0056.514] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\kor_boot.ttf") returned="kor_boot.ttf" [0056.514] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0056.514] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0056.514] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0056.514] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0056.514] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="malgunn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned="C:\\Boot\\Fonts\\malgunn_boot.ttf" [0056.514] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.zip") returned 0 [0056.514] lstrlenA (lpString="*.zip") returned 5 [0056.514] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.rar") returned 0 [0056.514] lstrlenA (lpString="*.rar") returned 5 [0056.514] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.7z") returned 0 [0056.514] lstrlenA (lpString="*.7z") returned 4 [0056.514] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.tar") returned 0 [0056.514] lstrlenA (lpString="*.tar") returned 5 [0056.514] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.gzip") returned 0 [0056.514] lstrlenA (lpString="*.gzip") returned 6 [0056.514] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.jpg") returned 0 [0056.514] lstrlenA (lpString="*.jpg") returned 5 [0056.514] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.jpeg") returned 0 [0056.514] lstrlenA (lpString="*.jpeg") returned 6 [0056.514] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.psd") returned 0 [0056.514] lstrlenA (lpString="*.psd") returned 5 [0056.514] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.cdr") returned 0 [0056.514] lstrlenA (lpString="*.cdr") returned 5 [0056.514] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.dwg") returned 0 [0056.514] lstrlenA (lpString="*.dwg") returned 5 [0056.514] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.max") returned 0 [0056.514] lstrlenA (lpString="*.max") returned 5 [0056.515] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.bmp") returned 0 [0056.515] lstrlenA (lpString="*.bmp") returned 5 [0056.515] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.gif") returned 0 [0056.515] lstrlenA (lpString="*.gif") returned 5 [0056.515] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.png") returned 0 [0056.515] lstrlenA (lpString="*.png") returned 5 [0056.515] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.doc") returned 0 [0056.515] lstrlenA (lpString="*.doc") returned 5 [0056.515] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.docx") returned 0 [0056.515] lstrlenA (lpString="*.docx") returned 6 [0056.515] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.xls") returned 0 [0056.515] lstrlenA (lpString="*.xls") returned 5 [0056.515] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.xlsx") returned 0 [0056.515] lstrlenA (lpString="*.xlsx") returned 6 [0056.515] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.ppt") returned 0 [0056.515] lstrlenA (lpString="*.ppt") returned 5 [0056.515] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.pptx") returned 0 [0056.515] lstrlenA (lpString="*.pptx") returned 6 [0056.515] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.txt") returned 0 [0056.515] lstrlenA (lpString="*.txt") returned 5 [0056.515] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.pdf") returned 0 [0056.515] lstrlenA (lpString="*.pdf") returned 5 [0056.515] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.djvu") returned 0 [0056.515] lstrlenA (lpString="*.djvu") returned 6 [0056.515] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.htm") returned 0 [0056.515] lstrlenA (lpString="*.htm") returned 5 [0056.515] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.html") returned 0 [0056.515] lstrlenA (lpString="*.html") returned 6 [0056.515] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.mdb") returned 0 [0056.515] lstrlenA (lpString="*.mdb") returned 5 [0056.515] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.cer") returned 0 [0056.515] lstrlenA (lpString="*.cer") returned 5 [0056.515] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.p12") returned 0 [0056.515] lstrlenA (lpString="*.p12") returned 5 [0056.515] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.pfx") returned 0 [0056.515] lstrlenA (lpString="*.pfx") returned 5 [0056.516] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.kwm") returned 0 [0056.516] lstrlenA (lpString="*.kwm") returned 5 [0056.516] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.pwm") returned 0 [0056.516] lstrlenA (lpString="*.pwm") returned 5 [0056.516] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.1cd") returned 0 [0056.516] lstrlenA (lpString="*.1cd") returned 5 [0056.516] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.md") returned 0 [0056.516] lstrlenA (lpString="*.md") returned 4 [0056.516] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.mdf") returned 0 [0056.516] lstrlenA (lpString="*.mdf") returned 5 [0056.516] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.dbf") returned 0 [0056.516] lstrlenA (lpString="*.dbf") returned 5 [0056.516] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.odt") returned 0 [0056.516] lstrlenA (lpString="*.odt") returned 5 [0056.516] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.vob") returned 0 [0056.516] lstrlenA (lpString="*.vob") returned 5 [0056.516] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.ifo") returned 0 [0056.516] lstrlenA (lpString="*.ifo") returned 5 [0056.516] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.lnk") returned 0 [0056.516] lstrlenA (lpString="*.lnk") returned 5 [0056.516] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.torrent") returned 0 [0056.516] lstrlenA (lpString="*.torrent") returned 9 [0056.516] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.mov") returned 0 [0056.516] lstrlenA (lpString="*.mov") returned 5 [0056.516] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.m2v") returned 0 [0056.516] lstrlenA (lpString="*.m2v") returned 5 [0056.516] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.3gp") returned 0 [0056.516] lstrlenA (lpString="*.3gp") returned 5 [0056.516] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.mpeg") returned 0 [0056.516] lstrlenA (lpString="*.mpeg") returned 6 [0056.516] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.mpg") returned 0 [0056.516] lstrlenA (lpString="*.mpg") returned 5 [0056.516] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.flv") returned 0 [0056.516] lstrlenA (lpString="*.flv") returned 5 [0056.516] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.avi") returned 0 [0056.516] lstrlenA (lpString="*.avi") returned 5 [0056.517] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.mp4") returned 0 [0056.517] lstrlenA (lpString="*.mp4") returned 5 [0056.517] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.wmv") returned 0 [0056.517] lstrlenA (lpString="*.wmv") returned 5 [0056.517] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.divx") returned 0 [0056.517] lstrlenA (lpString="*.divx") returned 6 [0056.517] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.mkv") returned 0 [0056.517] lstrlenA (lpString="*.mkv") returned 5 [0056.517] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.mp3") returned 0 [0056.517] lstrlenA (lpString="*.mp3") returned 5 [0056.517] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.wav") returned 0 [0056.517] lstrlenA (lpString="*.wav") returned 5 [0056.517] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.flac") returned 0 [0056.517] lstrlenA (lpString="*.flac") returned 6 [0056.517] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.ape") returned 0 [0056.517] lstrlenA (lpString="*.ape") returned 5 [0056.517] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.wma") returned 0 [0056.517] lstrlenA (lpString="*.wma") returned 5 [0056.517] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.ac3") returned 0 [0056.517] lstrlenA (lpString="*.ac3") returned 5 [0056.517] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b01e78, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b01e78, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x29114, dwReserved0=0x6, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1 [0056.517] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.517] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="malgun_boot.ttf") returned -1 [0056.517] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="malgun_boot.ttf") returned -1 [0056.517] lstrcmpiA (lpString1="", lpString2="malgun_boot.ttf") returned -1 [0056.517] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned="malgunn_boot.ttf" [0056.517] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0056.517] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0056.517] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0056.517] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0056.517] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="malgun_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\malgun_boot.ttf") returned="C:\\Boot\\Fonts\\malgun_boot.ttf" [0056.518] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.zip") returned 0 [0056.518] lstrlenA (lpString="*.zip") returned 5 [0056.518] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.rar") returned 0 [0056.518] lstrlenA (lpString="*.rar") returned 5 [0056.518] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.7z") returned 0 [0056.518] lstrlenA (lpString="*.7z") returned 4 [0056.518] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.tar") returned 0 [0056.518] lstrlenA (lpString="*.tar") returned 5 [0056.518] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.gzip") returned 0 [0056.518] lstrlenA (lpString="*.gzip") returned 6 [0056.518] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.jpg") returned 0 [0056.518] lstrlenA (lpString="*.jpg") returned 5 [0056.518] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.jpeg") returned 0 [0056.518] lstrlenA (lpString="*.jpeg") returned 6 [0056.518] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.psd") returned 0 [0056.518] lstrlenA (lpString="*.psd") returned 5 [0056.518] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.cdr") returned 0 [0056.518] lstrlenA (lpString="*.cdr") returned 5 [0056.518] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.dwg") returned 0 [0056.518] lstrlenA (lpString="*.dwg") returned 5 [0056.518] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.max") returned 0 [0056.518] lstrlenA (lpString="*.max") returned 5 [0056.518] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.bmp") returned 0 [0056.518] lstrlenA (lpString="*.bmp") returned 5 [0056.518] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.gif") returned 0 [0056.518] lstrlenA (lpString="*.gif") returned 5 [0056.518] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.png") returned 0 [0056.518] lstrlenA (lpString="*.png") returned 5 [0056.518] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.doc") returned 0 [0056.518] lstrlenA (lpString="*.doc") returned 5 [0056.518] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.docx") returned 0 [0056.518] lstrlenA (lpString="*.docx") returned 6 [0056.518] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.xls") returned 0 [0056.518] lstrlenA (lpString="*.xls") returned 5 [0056.518] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.xlsx") returned 0 [0056.518] lstrlenA (lpString="*.xlsx") returned 6 [0056.519] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.ppt") returned 0 [0056.519] lstrlenA (lpString="*.ppt") returned 5 [0056.519] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.pptx") returned 0 [0056.519] lstrlenA (lpString="*.pptx") returned 6 [0056.519] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.txt") returned 0 [0056.519] lstrlenA (lpString="*.txt") returned 5 [0056.519] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.pdf") returned 0 [0056.519] lstrlenA (lpString="*.pdf") returned 5 [0056.519] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.djvu") returned 0 [0056.519] lstrlenA (lpString="*.djvu") returned 6 [0056.519] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.htm") returned 0 [0056.519] lstrlenA (lpString="*.htm") returned 5 [0056.519] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.html") returned 0 [0056.519] lstrlenA (lpString="*.html") returned 6 [0056.519] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.mdb") returned 0 [0056.519] lstrlenA (lpString="*.mdb") returned 5 [0056.519] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.cer") returned 0 [0056.519] lstrlenA (lpString="*.cer") returned 5 [0056.519] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.p12") returned 0 [0056.519] lstrlenA (lpString="*.p12") returned 5 [0056.519] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.pfx") returned 0 [0056.519] lstrlenA (lpString="*.pfx") returned 5 [0056.519] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.kwm") returned 0 [0056.519] lstrlenA (lpString="*.kwm") returned 5 [0056.519] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.pwm") returned 0 [0056.519] lstrlenA (lpString="*.pwm") returned 5 [0056.519] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.1cd") returned 0 [0056.519] lstrlenA (lpString="*.1cd") returned 5 [0056.519] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.md") returned 0 [0056.519] lstrlenA (lpString="*.md") returned 4 [0056.519] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.mdf") returned 0 [0056.519] lstrlenA (lpString="*.mdf") returned 5 [0056.520] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.dbf") returned 0 [0056.520] lstrlenA (lpString="*.dbf") returned 5 [0056.520] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.odt") returned 0 [0056.520] lstrlenA (lpString="*.odt") returned 5 [0056.520] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.vob") returned 0 [0056.520] lstrlenA (lpString="*.vob") returned 5 [0056.520] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.ifo") returned 0 [0056.520] lstrlenA (lpString="*.ifo") returned 5 [0056.520] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.lnk") returned 0 [0056.520] lstrlenA (lpString="*.lnk") returned 5 [0056.520] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.torrent") returned 0 [0056.520] lstrlenA (lpString="*.torrent") returned 9 [0056.520] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.mov") returned 0 [0056.520] lstrlenA (lpString="*.mov") returned 5 [0056.520] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.m2v") returned 0 [0056.520] lstrlenA (lpString="*.m2v") returned 5 [0056.520] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.3gp") returned 0 [0056.520] lstrlenA (lpString="*.3gp") returned 5 [0056.520] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.mpeg") returned 0 [0056.520] lstrlenA (lpString="*.mpeg") returned 6 [0056.520] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.mpg") returned 0 [0056.520] lstrlenA (lpString="*.mpg") returned 5 [0056.520] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.flv") returned 0 [0056.520] lstrlenA (lpString="*.flv") returned 5 [0056.520] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.avi") returned 0 [0056.528] lstrlenA (lpString="*.avi") returned 5 [0056.528] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.mp4") returned 0 [0056.528] lstrlenA (lpString="*.mp4") returned 5 [0056.528] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.wmv") returned 0 [0056.528] lstrlenA (lpString="*.wmv") returned 5 [0056.528] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.divx") returned 0 [0056.528] lstrlenA (lpString="*.divx") returned 6 [0056.528] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.mkv") returned 0 [0056.528] lstrlenA (lpString="*.mkv") returned 5 [0056.528] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.mp3") returned 0 [0056.528] lstrlenA (lpString="*.mp3") returned 5 [0056.528] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.wav") returned 0 [0056.528] lstrlenA (lpString="*.wav") returned 5 [0056.528] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.flac") returned 0 [0056.528] lstrlenA (lpString="*.flac") returned 6 [0056.528] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.ape") returned 0 [0056.528] lstrlenA (lpString="*.ape") returned 5 [0056.528] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.wma") returned 0 [0056.528] lstrlenA (lpString="*.wma") returned 5 [0056.528] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.ac3") returned 0 [0056.528] lstrlenA (lpString="*.ac3") returned 5 [0056.528] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b01e78, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b01e78, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x20718, dwReserved0=0x6, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1 [0056.528] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.528] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="meiryon_boot.ttf") returned -1 [0056.528] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="meiryon_boot.ttf") returned -1 [0056.528] lstrcmpiA (lpString1="", lpString2="meiryon_boot.ttf") returned -1 [0056.528] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\malgun_boot.ttf") returned="malgun_boot.ttf" [0056.528] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0056.528] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0056.528] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0056.529] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0056.529] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="meiryon_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned="C:\\Boot\\Fonts\\meiryon_boot.ttf" [0056.529] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.zip") returned 0 [0056.529] lstrlenA (lpString="*.zip") returned 5 [0056.529] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.rar") returned 0 [0056.529] lstrlenA (lpString="*.rar") returned 5 [0056.529] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.7z") returned 0 [0056.529] lstrlenA (lpString="*.7z") returned 4 [0056.529] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.tar") returned 0 [0056.529] lstrlenA (lpString="*.tar") returned 5 [0056.529] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.gzip") returned 0 [0056.529] lstrlenA (lpString="*.gzip") returned 6 [0056.529] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.jpg") returned 0 [0056.529] lstrlenA (lpString="*.jpg") returned 5 [0056.529] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.jpeg") returned 0 [0056.529] lstrlenA (lpString="*.jpeg") returned 6 [0056.529] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.psd") returned 0 [0056.529] lstrlenA (lpString="*.psd") returned 5 [0056.529] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.cdr") returned 0 [0056.529] lstrlenA (lpString="*.cdr") returned 5 [0056.529] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.dwg") returned 0 [0056.529] lstrlenA (lpString="*.dwg") returned 5 [0056.529] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.max") returned 0 [0056.529] lstrlenA (lpString="*.max") returned 5 [0056.529] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.bmp") returned 0 [0056.529] lstrlenA (lpString="*.bmp") returned 5 [0056.529] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.gif") returned 0 [0056.530] lstrlenA (lpString="*.gif") returned 5 [0056.530] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.png") returned 0 [0056.530] lstrlenA (lpString="*.png") returned 5 [0056.530] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.doc") returned 0 [0056.530] lstrlenA (lpString="*.doc") returned 5 [0056.530] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.docx") returned 0 [0056.530] lstrlenA (lpString="*.docx") returned 6 [0056.530] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.xls") returned 0 [0056.530] lstrlenA (lpString="*.xls") returned 5 [0056.530] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.xlsx") returned 0 [0056.530] lstrlenA (lpString="*.xlsx") returned 6 [0056.530] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.ppt") returned 0 [0056.530] lstrlenA (lpString="*.ppt") returned 5 [0056.530] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.pptx") returned 0 [0056.530] lstrlenA (lpString="*.pptx") returned 6 [0056.530] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.txt") returned 0 [0056.530] lstrlenA (lpString="*.txt") returned 5 [0056.530] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.pdf") returned 0 [0056.530] lstrlenA (lpString="*.pdf") returned 5 [0056.530] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.djvu") returned 0 [0056.530] lstrlenA (lpString="*.djvu") returned 6 [0056.530] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.htm") returned 0 [0056.530] lstrlenA (lpString="*.htm") returned 5 [0056.530] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.html") returned 0 [0056.530] lstrlenA (lpString="*.html") returned 6 [0056.530] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.mdb") returned 0 [0056.530] lstrlenA (lpString="*.mdb") returned 5 [0056.530] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.cer") returned 0 [0056.530] lstrlenA (lpString="*.cer") returned 5 [0056.530] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.p12") returned 0 [0056.530] lstrlenA (lpString="*.p12") returned 5 [0056.530] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.pfx") returned 0 [0056.530] lstrlenA (lpString="*.pfx") returned 5 [0056.530] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.kwm") returned 0 [0056.530] lstrlenA (lpString="*.kwm") returned 5 [0056.531] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.pwm") returned 0 [0056.531] lstrlenA (lpString="*.pwm") returned 5 [0056.531] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.1cd") returned 0 [0056.531] lstrlenA (lpString="*.1cd") returned 5 [0056.531] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.md") returned 0 [0056.531] lstrlenA (lpString="*.md") returned 4 [0056.531] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.mdf") returned 0 [0056.531] lstrlenA (lpString="*.mdf") returned 5 [0056.531] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.dbf") returned 0 [0056.531] lstrlenA (lpString="*.dbf") returned 5 [0056.531] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.odt") returned 0 [0056.531] lstrlenA (lpString="*.odt") returned 5 [0056.531] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.vob") returned 0 [0056.531] lstrlenA (lpString="*.vob") returned 5 [0056.531] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.ifo") returned 0 [0056.531] lstrlenA (lpString="*.ifo") returned 5 [0056.531] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.lnk") returned 0 [0056.531] lstrlenA (lpString="*.lnk") returned 5 [0056.531] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.torrent") returned 0 [0056.531] lstrlenA (lpString="*.torrent") returned 9 [0056.531] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.mov") returned 0 [0056.531] lstrlenA (lpString="*.mov") returned 5 [0056.531] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.m2v") returned 0 [0056.531] lstrlenA (lpString="*.m2v") returned 5 [0056.531] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.3gp") returned 0 [0056.531] lstrlenA (lpString="*.3gp") returned 5 [0056.531] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.mpeg") returned 0 [0056.531] lstrlenA (lpString="*.mpeg") returned 6 [0056.531] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.mpg") returned 0 [0056.531] lstrlenA (lpString="*.mpg") returned 5 [0056.531] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.flv") returned 0 [0056.531] lstrlenA (lpString="*.flv") returned 5 [0056.531] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.avi") returned 0 [0056.531] lstrlenA (lpString="*.avi") returned 5 [0056.531] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.mp4") returned 0 [0056.532] lstrlenA (lpString="*.mp4") returned 5 [0056.532] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.wmv") returned 0 [0056.532] lstrlenA (lpString="*.wmv") returned 5 [0056.532] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.divx") returned 0 [0056.532] lstrlenA (lpString="*.divx") returned 6 [0056.532] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.mkv") returned 0 [0056.532] lstrlenA (lpString="*.mkv") returned 5 [0056.532] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.mp3") returned 0 [0056.532] lstrlenA (lpString="*.mp3") returned 5 [0056.532] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.wav") returned 0 [0056.532] lstrlenA (lpString="*.wav") returned 5 [0056.532] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.flac") returned 0 [0056.532] lstrlenA (lpString="*.flac") returned 6 [0056.532] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.ape") returned 0 [0056.532] lstrlenA (lpString="*.ape") returned 5 [0056.532] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.wma") returned 0 [0056.532] lstrlenA (lpString="*.wma") returned 5 [0056.532] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.ac3") returned 0 [0056.532] lstrlenA (lpString="*.ac3") returned 5 [0056.532] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b01e78, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b01e78, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x20d6c, dwReserved0=0x6, dwReserved1=0x0, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1 [0056.532] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.532] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="meiryo_boot.ttf") returned -1 [0056.532] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="meiryo_boot.ttf") returned -1 [0056.532] lstrcmpiA (lpString1="", lpString2="meiryo_boot.ttf") returned -1 [0056.532] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned="meiryon_boot.ttf" [0056.532] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0056.532] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0056.532] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0056.532] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0056.532] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="meiryo_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned="C:\\Boot\\Fonts\\meiryo_boot.ttf" [0056.532] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.zip") returned 0 [0056.533] lstrlenA (lpString="*.zip") returned 5 [0056.533] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.rar") returned 0 [0056.533] lstrlenA (lpString="*.rar") returned 5 [0056.533] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.7z") returned 0 [0056.533] lstrlenA (lpString="*.7z") returned 4 [0056.533] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.tar") returned 0 [0056.533] lstrlenA (lpString="*.tar") returned 5 [0056.533] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.gzip") returned 0 [0056.533] lstrlenA (lpString="*.gzip") returned 6 [0056.533] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.jpg") returned 0 [0056.533] lstrlenA (lpString="*.jpg") returned 5 [0056.533] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.jpeg") returned 0 [0056.533] lstrlenA (lpString="*.jpeg") returned 6 [0056.533] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.psd") returned 0 [0056.533] lstrlenA (lpString="*.psd") returned 5 [0056.533] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.cdr") returned 0 [0056.533] lstrlenA (lpString="*.cdr") returned 5 [0056.533] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.dwg") returned 0 [0056.533] lstrlenA (lpString="*.dwg") returned 5 [0056.533] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.max") returned 0 [0056.533] lstrlenA (lpString="*.max") returned 5 [0056.533] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.bmp") returned 0 [0056.533] lstrlenA (lpString="*.bmp") returned 5 [0056.533] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.gif") returned 0 [0056.533] lstrlenA (lpString="*.gif") returned 5 [0056.533] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.png") returned 0 [0056.533] lstrlenA (lpString="*.png") returned 5 [0056.533] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.doc") returned 0 [0056.533] lstrlenA (lpString="*.doc") returned 5 [0056.533] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.docx") returned 0 [0056.533] lstrlenA (lpString="*.docx") returned 6 [0056.533] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.xls") returned 0 [0056.533] lstrlenA (lpString="*.xls") returned 5 [0056.533] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.xlsx") returned 0 [0056.534] lstrlenA (lpString="*.xlsx") returned 6 [0056.534] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.ppt") returned 0 [0056.534] lstrlenA (lpString="*.ppt") returned 5 [0056.534] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.pptx") returned 0 [0056.534] lstrlenA (lpString="*.pptx") returned 6 [0056.534] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.txt") returned 0 [0056.534] lstrlenA (lpString="*.txt") returned 5 [0056.534] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.pdf") returned 0 [0056.534] lstrlenA (lpString="*.pdf") returned 5 [0056.534] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.djvu") returned 0 [0056.534] lstrlenA (lpString="*.djvu") returned 6 [0056.534] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.htm") returned 0 [0056.534] lstrlenA (lpString="*.htm") returned 5 [0056.534] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.html") returned 0 [0056.534] lstrlenA (lpString="*.html") returned 6 [0056.534] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.mdb") returned 0 [0056.534] lstrlenA (lpString="*.mdb") returned 5 [0056.534] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.cer") returned 0 [0056.534] lstrlenA (lpString="*.cer") returned 5 [0056.534] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.p12") returned 0 [0056.534] lstrlenA (lpString="*.p12") returned 5 [0056.534] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.pfx") returned 0 [0056.534] lstrlenA (lpString="*.pfx") returned 5 [0056.534] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.kwm") returned 0 [0056.534] lstrlenA (lpString="*.kwm") returned 5 [0056.534] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.pwm") returned 0 [0056.534] lstrlenA (lpString="*.pwm") returned 5 [0056.534] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.1cd") returned 0 [0056.534] lstrlenA (lpString="*.1cd") returned 5 [0056.534] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.md") returned 0 [0056.535] lstrlenA (lpString="*.md") returned 4 [0056.535] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.mdf") returned 0 [0056.535] lstrlenA (lpString="*.mdf") returned 5 [0056.535] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.dbf") returned 0 [0056.535] lstrlenA (lpString="*.dbf") returned 5 [0056.535] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.odt") returned 0 [0056.535] lstrlenA (lpString="*.odt") returned 5 [0056.535] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.vob") returned 0 [0056.535] lstrlenA (lpString="*.vob") returned 5 [0056.535] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.ifo") returned 0 [0056.535] lstrlenA (lpString="*.ifo") returned 5 [0056.535] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.lnk") returned 0 [0056.535] lstrlenA (lpString="*.lnk") returned 5 [0056.535] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.torrent") returned 0 [0056.535] lstrlenA (lpString="*.torrent") returned 9 [0056.535] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.mov") returned 0 [0056.535] lstrlenA (lpString="*.mov") returned 5 [0056.535] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.m2v") returned 0 [0056.535] lstrlenA (lpString="*.m2v") returned 5 [0056.535] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.3gp") returned 0 [0056.535] lstrlenA (lpString="*.3gp") returned 5 [0056.535] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.mpeg") returned 0 [0056.535] lstrlenA (lpString="*.mpeg") returned 6 [0056.535] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.mpg") returned 0 [0056.535] lstrlenA (lpString="*.mpg") returned 5 [0056.535] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.flv") returned 0 [0056.535] lstrlenA (lpString="*.flv") returned 5 [0056.535] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.avi") returned 0 [0056.535] lstrlenA (lpString="*.avi") returned 5 [0056.535] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.mp4") returned 0 [0056.535] lstrlenA (lpString="*.mp4") returned 5 [0056.535] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.wmv") returned 0 [0056.535] lstrlenA (lpString="*.wmv") returned 5 [0056.535] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.divx") returned 0 [0056.535] lstrlenA (lpString="*.divx") returned 6 [0056.536] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.mkv") returned 0 [0056.536] lstrlenA (lpString="*.mkv") returned 5 [0056.536] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.mp3") returned 0 [0056.536] lstrlenA (lpString="*.mp3") returned 5 [0056.536] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.wav") returned 0 [0056.536] lstrlenA (lpString="*.wav") returned 5 [0056.536] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.flac") returned 0 [0056.536] lstrlenA (lpString="*.flac") returned 6 [0056.536] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.ape") returned 0 [0056.536] lstrlenA (lpString="*.ape") returned 5 [0056.536] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.wma") returned 0 [0056.536] lstrlenA (lpString="*.wma") returned 5 [0056.536] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.ac3") returned 0 [0056.536] lstrlenA (lpString="*.ac3") returned 5 [0056.544] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b01e78, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b01e78, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211ecd4c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2553c, dwReserved0=0x6, dwReserved1=0x0, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1 [0056.544] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.544] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msjhn_boot.ttf") returned -1 [0056.544] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msjhn_boot.ttf") returned -1 [0056.544] lstrcmpiA (lpString1="", lpString2="msjhn_boot.ttf") returned -1 [0056.544] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned="meiryo_boot.ttf" [0056.544] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0056.544] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0056.544] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0056.544] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0056.544] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msjhn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned="C:\\Boot\\Fonts\\msjhn_boot.ttf" [0056.544] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.zip") returned 0 [0056.544] lstrlenA (lpString="*.zip") returned 5 [0056.545] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.rar") returned 0 [0056.545] lstrlenA (lpString="*.rar") returned 5 [0056.545] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.7z") returned 0 [0056.545] lstrlenA (lpString="*.7z") returned 4 [0056.545] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.tar") returned 0 [0056.545] lstrlenA (lpString="*.tar") returned 5 [0056.545] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.gzip") returned 0 [0056.545] lstrlenA (lpString="*.gzip") returned 6 [0056.545] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.jpg") returned 0 [0056.545] lstrlenA (lpString="*.jpg") returned 5 [0056.545] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.jpeg") returned 0 [0056.545] lstrlenA (lpString="*.jpeg") returned 6 [0056.545] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.psd") returned 0 [0056.545] lstrlenA (lpString="*.psd") returned 5 [0056.545] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.cdr") returned 0 [0056.545] lstrlenA (lpString="*.cdr") returned 5 [0056.545] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.dwg") returned 0 [0056.545] lstrlenA (lpString="*.dwg") returned 5 [0056.545] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.max") returned 0 [0056.545] lstrlenA (lpString="*.max") returned 5 [0056.545] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.bmp") returned 0 [0056.545] lstrlenA (lpString="*.bmp") returned 5 [0056.545] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.gif") returned 0 [0056.545] lstrlenA (lpString="*.gif") returned 5 [0056.545] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.png") returned 0 [0056.545] lstrlenA (lpString="*.png") returned 5 [0056.545] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.doc") returned 0 [0056.545] lstrlenA (lpString="*.doc") returned 5 [0056.545] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.docx") returned 0 [0056.545] lstrlenA (lpString="*.docx") returned 6 [0056.545] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.xls") returned 0 [0056.545] lstrlenA (lpString="*.xls") returned 5 [0056.545] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.xlsx") returned 0 [0056.545] lstrlenA (lpString="*.xlsx") returned 6 [0056.546] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.ppt") returned 0 [0056.546] lstrlenA (lpString="*.ppt") returned 5 [0056.546] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.pptx") returned 0 [0056.546] lstrlenA (lpString="*.pptx") returned 6 [0056.546] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.txt") returned 0 [0056.546] lstrlenA (lpString="*.txt") returned 5 [0056.546] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.pdf") returned 0 [0056.546] lstrlenA (lpString="*.pdf") returned 5 [0056.546] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.djvu") returned 0 [0056.546] lstrlenA (lpString="*.djvu") returned 6 [0056.546] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.htm") returned 0 [0056.546] lstrlenA (lpString="*.htm") returned 5 [0056.546] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.html") returned 0 [0056.546] lstrlenA (lpString="*.html") returned 6 [0056.546] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.mdb") returned 0 [0056.546] lstrlenA (lpString="*.mdb") returned 5 [0056.546] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.cer") returned 0 [0056.546] lstrlenA (lpString="*.cer") returned 5 [0056.546] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.p12") returned 0 [0056.546] lstrlenA (lpString="*.p12") returned 5 [0056.546] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.pfx") returned 0 [0056.546] lstrlenA (lpString="*.pfx") returned 5 [0056.546] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.kwm") returned 0 [0056.546] lstrlenA (lpString="*.kwm") returned 5 [0056.546] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.pwm") returned 0 [0056.546] lstrlenA (lpString="*.pwm") returned 5 [0056.546] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.1cd") returned 0 [0056.546] lstrlenA (lpString="*.1cd") returned 5 [0056.546] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.md") returned 0 [0056.546] lstrlenA (lpString="*.md") returned 4 [0056.546] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.mdf") returned 0 [0056.546] lstrlenA (lpString="*.mdf") returned 5 [0056.546] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.dbf") returned 0 [0056.546] lstrlenA (lpString="*.dbf") returned 5 [0056.546] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.odt") returned 0 [0056.546] lstrlenA (lpString="*.odt") returned 5 [0056.547] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.vob") returned 0 [0056.547] lstrlenA (lpString="*.vob") returned 5 [0056.547] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.ifo") returned 0 [0056.547] lstrlenA (lpString="*.ifo") returned 5 [0056.547] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.lnk") returned 0 [0056.547] lstrlenA (lpString="*.lnk") returned 5 [0056.547] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.torrent") returned 0 [0056.547] lstrlenA (lpString="*.torrent") returned 9 [0056.547] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.mov") returned 0 [0056.547] lstrlenA (lpString="*.mov") returned 5 [0056.547] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.m2v") returned 0 [0056.547] lstrlenA (lpString="*.m2v") returned 5 [0056.547] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.3gp") returned 0 [0056.547] lstrlenA (lpString="*.3gp") returned 5 [0056.547] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.mpeg") returned 0 [0056.547] lstrlenA (lpString="*.mpeg") returned 6 [0056.547] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.mpg") returned 0 [0056.547] lstrlenA (lpString="*.mpg") returned 5 [0056.547] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.flv") returned 0 [0056.547] lstrlenA (lpString="*.flv") returned 5 [0056.547] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.avi") returned 0 [0056.547] lstrlenA (lpString="*.avi") returned 5 [0056.547] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.mp4") returned 0 [0056.547] lstrlenA (lpString="*.mp4") returned 5 [0056.547] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.wmv") returned 0 [0056.547] lstrlenA (lpString="*.wmv") returned 5 [0056.547] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.divx") returned 0 [0056.547] lstrlenA (lpString="*.divx") returned 6 [0056.547] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.mkv") returned 0 [0056.547] lstrlenA (lpString="*.mkv") returned 5 [0056.547] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.mp3") returned 0 [0056.547] lstrlenA (lpString="*.mp3") returned 5 [0056.547] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.wav") returned 0 [0056.547] lstrlenA (lpString="*.wav") returned 5 [0056.548] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.flac") returned 0 [0056.548] lstrlenA (lpString="*.flac") returned 6 [0056.548] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.ape") returned 0 [0056.548] lstrlenA (lpString="*.ape") returned 5 [0056.548] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.wma") returned 0 [0056.548] lstrlenA (lpString="*.wma") returned 5 [0056.548] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.ac3") returned 0 [0056.548] lstrlenA (lpString="*.ac3") returned 5 [0056.548] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b01e78, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b01e78, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211ecd4c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x25d10, dwReserved0=0x6, dwReserved1=0x0, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1 [0056.548] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.548] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msjh_boot.ttf") returned -1 [0056.548] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msjh_boot.ttf") returned -1 [0056.548] lstrcmpiA (lpString1="", lpString2="msjh_boot.ttf") returned -1 [0056.548] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned="msjhn_boot.ttf" [0056.548] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0056.548] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0056.548] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0056.548] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0056.548] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msjh_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msjh_boot.ttf") returned="C:\\Boot\\Fonts\\msjh_boot.ttf" [0056.548] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.zip") returned 0 [0056.548] lstrlenA (lpString="*.zip") returned 5 [0056.548] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.rar") returned 0 [0056.548] lstrlenA (lpString="*.rar") returned 5 [0056.548] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.7z") returned 0 [0056.548] lstrlenA (lpString="*.7z") returned 4 [0056.548] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.tar") returned 0 [0056.548] lstrlenA (lpString="*.tar") returned 5 [0056.548] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.gzip") returned 0 [0056.548] lstrlenA (lpString="*.gzip") returned 6 [0056.548] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.jpg") returned 0 [0056.548] lstrlenA (lpString="*.jpg") returned 5 [0056.549] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.jpeg") returned 0 [0056.549] lstrlenA (lpString="*.jpeg") returned 6 [0056.549] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.psd") returned 0 [0056.549] lstrlenA (lpString="*.psd") returned 5 [0056.549] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.cdr") returned 0 [0056.549] lstrlenA (lpString="*.cdr") returned 5 [0056.549] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.dwg") returned 0 [0056.549] lstrlenA (lpString="*.dwg") returned 5 [0056.549] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.max") returned 0 [0056.549] lstrlenA (lpString="*.max") returned 5 [0056.549] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.bmp") returned 0 [0056.549] lstrlenA (lpString="*.bmp") returned 5 [0056.549] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.gif") returned 0 [0056.549] lstrlenA (lpString="*.gif") returned 5 [0056.549] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.png") returned 0 [0056.549] lstrlenA (lpString="*.png") returned 5 [0056.549] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.doc") returned 0 [0056.549] lstrlenA (lpString="*.doc") returned 5 [0056.549] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.docx") returned 0 [0056.549] lstrlenA (lpString="*.docx") returned 6 [0056.549] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.xls") returned 0 [0056.549] lstrlenA (lpString="*.xls") returned 5 [0056.549] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.xlsx") returned 0 [0056.549] lstrlenA (lpString="*.xlsx") returned 6 [0056.549] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.ppt") returned 0 [0056.549] lstrlenA (lpString="*.ppt") returned 5 [0056.549] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.pptx") returned 0 [0056.549] lstrlenA (lpString="*.pptx") returned 6 [0056.549] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.txt") returned 0 [0056.549] lstrlenA (lpString="*.txt") returned 5 [0056.549] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.pdf") returned 0 [0056.550] lstrlenA (lpString="*.pdf") returned 5 [0056.550] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.djvu") returned 0 [0056.550] lstrlenA (lpString="*.djvu") returned 6 [0056.550] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.htm") returned 0 [0056.550] lstrlenA (lpString="*.htm") returned 5 [0056.550] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.html") returned 0 [0056.550] lstrlenA (lpString="*.html") returned 6 [0056.550] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.mdb") returned 0 [0056.550] lstrlenA (lpString="*.mdb") returned 5 [0056.550] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.cer") returned 0 [0056.550] lstrlenA (lpString="*.cer") returned 5 [0056.550] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.p12") returned 0 [0056.550] lstrlenA (lpString="*.p12") returned 5 [0056.550] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.pfx") returned 0 [0056.550] lstrlenA (lpString="*.pfx") returned 5 [0056.550] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.kwm") returned 0 [0056.550] lstrlenA (lpString="*.kwm") returned 5 [0056.550] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.pwm") returned 0 [0056.550] lstrlenA (lpString="*.pwm") returned 5 [0056.550] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.1cd") returned 0 [0056.550] lstrlenA (lpString="*.1cd") returned 5 [0056.550] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.md") returned 0 [0056.550] lstrlenA (lpString="*.md") returned 4 [0056.550] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.mdf") returned 0 [0056.550] lstrlenA (lpString="*.mdf") returned 5 [0056.550] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.dbf") returned 0 [0056.550] lstrlenA (lpString="*.dbf") returned 5 [0056.550] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.odt") returned 0 [0056.550] lstrlenA (lpString="*.odt") returned 5 [0056.550] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.vob") returned 0 [0056.550] lstrlenA (lpString="*.vob") returned 5 [0056.550] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.ifo") returned 0 [0056.550] lstrlenA (lpString="*.ifo") returned 5 [0056.550] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.lnk") returned 0 [0056.550] lstrlenA (lpString="*.lnk") returned 5 [0056.550] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.torrent") returned 0 [0056.551] lstrlenA (lpString="*.torrent") returned 9 [0056.551] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.mov") returned 0 [0056.551] lstrlenA (lpString="*.mov") returned 5 [0056.551] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.m2v") returned 0 [0056.551] lstrlenA (lpString="*.m2v") returned 5 [0056.551] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.3gp") returned 0 [0056.551] lstrlenA (lpString="*.3gp") returned 5 [0056.551] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.mpeg") returned 0 [0056.551] lstrlenA (lpString="*.mpeg") returned 6 [0056.551] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.mpg") returned 0 [0056.551] lstrlenA (lpString="*.mpg") returned 5 [0056.551] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.flv") returned 0 [0056.551] lstrlenA (lpString="*.flv") returned 5 [0056.551] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.avi") returned 0 [0056.551] lstrlenA (lpString="*.avi") returned 5 [0056.551] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.mp4") returned 0 [0056.551] lstrlenA (lpString="*.mp4") returned 5 [0056.551] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.wmv") returned 0 [0056.551] lstrlenA (lpString="*.wmv") returned 5 [0056.551] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.divx") returned 0 [0056.551] lstrlenA (lpString="*.divx") returned 6 [0056.551] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.mkv") returned 0 [0056.551] lstrlenA (lpString="*.mkv") returned 5 [0056.551] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.mp3") returned 0 [0056.551] lstrlenA (lpString="*.mp3") returned 5 [0056.551] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.wav") returned 0 [0056.551] lstrlenA (lpString="*.wav") returned 5 [0056.551] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.flac") returned 0 [0056.551] lstrlenA (lpString="*.flac") returned 6 [0056.551] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.ape") returned 0 [0056.551] lstrlenA (lpString="*.ape") returned 5 [0056.551] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.wma") returned 0 [0056.551] lstrlenA (lpString="*.wma") returned 5 [0056.551] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.ac3") returned 0 [0056.551] lstrlenA (lpString="*.ac3") returned 5 [0056.551] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b01e78, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b01e78, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211a0897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x22b2c, dwReserved0=0x6, dwReserved1=0x0, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1 [0056.552] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.552] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msyhn_boot.ttf") returned -1 [0056.552] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msyhn_boot.ttf") returned -1 [0056.552] lstrcmpiA (lpString1="", lpString2="msyhn_boot.ttf") returned -1 [0056.552] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\msjh_boot.ttf") returned="msjh_boot.ttf" [0056.552] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0056.552] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0056.553] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0056.553] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0056.553] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msyhn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned="C:\\Boot\\Fonts\\msyhn_boot.ttf" [0056.553] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.zip") returned 0 [0056.553] lstrlenA (lpString="*.zip") returned 5 [0056.553] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.rar") returned 0 [0056.553] lstrlenA (lpString="*.rar") returned 5 [0056.553] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.7z") returned 0 [0056.553] lstrlenA (lpString="*.7z") returned 4 [0056.553] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.tar") returned 0 [0056.553] lstrlenA (lpString="*.tar") returned 5 [0056.553] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.gzip") returned 0 [0056.553] lstrlenA (lpString="*.gzip") returned 6 [0056.553] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.jpg") returned 0 [0056.553] lstrlenA (lpString="*.jpg") returned 5 [0056.553] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.jpeg") returned 0 [0056.553] lstrlenA (lpString="*.jpeg") returned 6 [0056.553] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.psd") returned 0 [0056.553] lstrlenA (lpString="*.psd") returned 5 [0056.553] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.cdr") returned 0 [0056.553] lstrlenA (lpString="*.cdr") returned 5 [0056.553] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.dwg") returned 0 [0056.553] lstrlenA (lpString="*.dwg") returned 5 [0056.553] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.max") returned 0 [0056.553] lstrlenA (lpString="*.max") returned 5 [0056.553] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.bmp") returned 0 [0056.553] lstrlenA (lpString="*.bmp") returned 5 [0056.553] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.gif") returned 0 [0056.553] lstrlenA (lpString="*.gif") returned 5 [0056.553] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.png") returned 0 [0056.553] lstrlenA (lpString="*.png") returned 5 [0056.553] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.doc") returned 0 [0056.554] lstrlenA (lpString="*.doc") returned 5 [0056.554] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.docx") returned 0 [0056.554] lstrlenA (lpString="*.docx") returned 6 [0056.554] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.xls") returned 0 [0056.554] lstrlenA (lpString="*.xls") returned 5 [0056.554] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.xlsx") returned 0 [0056.554] lstrlenA (lpString="*.xlsx") returned 6 [0056.554] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.ppt") returned 0 [0056.554] lstrlenA (lpString="*.ppt") returned 5 [0056.554] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.pptx") returned 0 [0056.554] lstrlenA (lpString="*.pptx") returned 6 [0056.554] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.txt") returned 0 [0056.554] lstrlenA (lpString="*.txt") returned 5 [0056.554] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.pdf") returned 0 [0056.554] lstrlenA (lpString="*.pdf") returned 5 [0056.554] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.djvu") returned 0 [0056.554] lstrlenA (lpString="*.djvu") returned 6 [0056.554] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.htm") returned 0 [0056.554] lstrlenA (lpString="*.htm") returned 5 [0056.554] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.html") returned 0 [0056.554] lstrlenA (lpString="*.html") returned 6 [0056.554] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.mdb") returned 0 [0056.554] lstrlenA (lpString="*.mdb") returned 5 [0056.554] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.cer") returned 0 [0056.554] lstrlenA (lpString="*.cer") returned 5 [0056.554] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.p12") returned 0 [0056.554] lstrlenA (lpString="*.p12") returned 5 [0056.554] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.pfx") returned 0 [0056.554] lstrlenA (lpString="*.pfx") returned 5 [0056.554] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.kwm") returned 0 [0056.554] lstrlenA (lpString="*.kwm") returned 5 [0056.554] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.pwm") returned 0 [0056.555] lstrlenA (lpString="*.pwm") returned 5 [0056.555] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.1cd") returned 0 [0056.555] lstrlenA (lpString="*.1cd") returned 5 [0056.555] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.md") returned 0 [0056.555] lstrlenA (lpString="*.md") returned 4 [0056.555] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.mdf") returned 0 [0056.555] lstrlenA (lpString="*.mdf") returned 5 [0056.555] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.dbf") returned 0 [0056.555] lstrlenA (lpString="*.dbf") returned 5 [0056.555] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.odt") returned 0 [0056.555] lstrlenA (lpString="*.odt") returned 5 [0056.555] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.vob") returned 0 [0056.555] lstrlenA (lpString="*.vob") returned 5 [0056.555] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.ifo") returned 0 [0056.555] lstrlenA (lpString="*.ifo") returned 5 [0056.555] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.lnk") returned 0 [0056.555] lstrlenA (lpString="*.lnk") returned 5 [0056.555] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.torrent") returned 0 [0056.555] lstrlenA (lpString="*.torrent") returned 9 [0056.555] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.mov") returned 0 [0056.555] lstrlenA (lpString="*.mov") returned 5 [0056.555] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.m2v") returned 0 [0056.555] lstrlenA (lpString="*.m2v") returned 5 [0056.555] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.3gp") returned 0 [0056.555] lstrlenA (lpString="*.3gp") returned 5 [0056.555] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.mpeg") returned 0 [0056.555] lstrlenA (lpString="*.mpeg") returned 6 [0056.555] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.mpg") returned 0 [0056.555] lstrlenA (lpString="*.mpg") returned 5 [0056.555] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.flv") returned 0 [0056.555] lstrlenA (lpString="*.flv") returned 5 [0056.555] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.avi") returned 0 [0056.555] lstrlenA (lpString="*.avi") returned 5 [0056.555] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.mp4") returned 0 [0056.555] lstrlenA (lpString="*.mp4") returned 5 [0056.556] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.wmv") returned 0 [0056.556] lstrlenA (lpString="*.wmv") returned 5 [0056.556] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.divx") returned 0 [0056.556] lstrlenA (lpString="*.divx") returned 6 [0056.556] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.mkv") returned 0 [0056.556] lstrlenA (lpString="*.mkv") returned 5 [0056.556] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.mp3") returned 0 [0056.556] lstrlenA (lpString="*.mp3") returned 5 [0056.556] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.wav") returned 0 [0056.556] lstrlenA (lpString="*.wav") returned 5 [0056.556] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.flac") returned 0 [0056.556] lstrlenA (lpString="*.flac") returned 6 [0056.556] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.ape") returned 0 [0056.556] lstrlenA (lpString="*.ape") returned 5 [0056.556] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.wma") returned 0 [0056.556] lstrlenA (lpString="*.wma") returned 5 [0056.556] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.ac3") returned 0 [0056.556] lstrlenA (lpString="*.ac3") returned 5 [0056.556] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b01e78, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b01e78, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211a0897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x23b34, dwReserved0=0x6, dwReserved1=0x800003, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1 [0056.556] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.556] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msyh_boot.ttf") returned -1 [0056.556] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msyh_boot.ttf") returned -1 [0056.556] lstrcmpiA (lpString1="", lpString2="msyh_boot.ttf") returned -1 [0056.556] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned="msyhn_boot.ttf" [0056.556] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0056.556] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0056.556] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0056.556] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0056.556] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msyh_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msyh_boot.ttf") returned="C:\\Boot\\Fonts\\msyh_boot.ttf" [0056.556] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.zip") returned 0 [0056.556] lstrlenA (lpString="*.zip") returned 5 [0056.556] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.rar") returned 0 [0056.557] lstrlenA (lpString="*.rar") returned 5 [0056.557] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.7z") returned 0 [0056.557] lstrlenA (lpString="*.7z") returned 4 [0056.557] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.tar") returned 0 [0056.557] lstrlenA (lpString="*.tar") returned 5 [0056.557] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.gzip") returned 0 [0056.557] lstrlenA (lpString="*.gzip") returned 6 [0056.557] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.jpg") returned 0 [0056.557] lstrlenA (lpString="*.jpg") returned 5 [0056.557] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.jpeg") returned 0 [0056.557] lstrlenA (lpString="*.jpeg") returned 6 [0056.557] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.psd") returned 0 [0056.557] lstrlenA (lpString="*.psd") returned 5 [0056.557] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.cdr") returned 0 [0056.557] lstrlenA (lpString="*.cdr") returned 5 [0056.557] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.dwg") returned 0 [0056.557] lstrlenA (lpString="*.dwg") returned 5 [0056.557] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.max") returned 0 [0056.557] lstrlenA (lpString="*.max") returned 5 [0056.557] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.bmp") returned 0 [0056.557] lstrlenA (lpString="*.bmp") returned 5 [0056.557] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.gif") returned 0 [0056.557] lstrlenA (lpString="*.gif") returned 5 [0056.557] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.png") returned 0 [0056.557] lstrlenA (lpString="*.png") returned 5 [0056.557] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.doc") returned 0 [0056.557] lstrlenA (lpString="*.doc") returned 5 [0056.557] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.docx") returned 0 [0056.557] lstrlenA (lpString="*.docx") returned 6 [0056.557] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.xls") returned 0 [0056.557] lstrlenA (lpString="*.xls") returned 5 [0056.557] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.xlsx") returned 0 [0056.557] lstrlenA (lpString="*.xlsx") returned 6 [0056.557] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.ppt") returned 0 [0056.558] lstrlenA (lpString="*.ppt") returned 5 [0056.558] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.pptx") returned 0 [0056.558] lstrlenA (lpString="*.pptx") returned 6 [0056.558] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.txt") returned 0 [0056.558] lstrlenA (lpString="*.txt") returned 5 [0056.558] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.pdf") returned 0 [0056.558] lstrlenA (lpString="*.pdf") returned 5 [0056.558] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.djvu") returned 0 [0056.558] lstrlenA (lpString="*.djvu") returned 6 [0056.558] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.htm") returned 0 [0056.558] lstrlenA (lpString="*.htm") returned 5 [0056.558] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.html") returned 0 [0056.558] lstrlenA (lpString="*.html") returned 6 [0056.558] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.mdb") returned 0 [0056.558] lstrlenA (lpString="*.mdb") returned 5 [0056.558] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.cer") returned 0 [0056.558] lstrlenA (lpString="*.cer") returned 5 [0056.558] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.p12") returned 0 [0056.558] lstrlenA (lpString="*.p12") returned 5 [0056.558] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.pfx") returned 0 [0056.558] lstrlenA (lpString="*.pfx") returned 5 [0056.558] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.kwm") returned 0 [0056.558] lstrlenA (lpString="*.kwm") returned 5 [0056.558] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.pwm") returned 0 [0056.558] lstrlenA (lpString="*.pwm") returned 5 [0056.558] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.1cd") returned 0 [0056.558] lstrlenA (lpString="*.1cd") returned 5 [0056.558] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.md") returned 0 [0056.558] lstrlenA (lpString="*.md") returned 4 [0056.558] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.mdf") returned 0 [0056.558] lstrlenA (lpString="*.mdf") returned 5 [0056.558] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.dbf") returned 0 [0056.558] lstrlenA (lpString="*.dbf") returned 5 [0056.558] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.odt") returned 0 [0056.559] lstrlenA (lpString="*.odt") returned 5 [0056.559] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.vob") returned 0 [0056.559] lstrlenA (lpString="*.vob") returned 5 [0056.559] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.ifo") returned 0 [0056.559] lstrlenA (lpString="*.ifo") returned 5 [0056.559] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.lnk") returned 0 [0056.559] lstrlenA (lpString="*.lnk") returned 5 [0056.559] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.torrent") returned 0 [0056.559] lstrlenA (lpString="*.torrent") returned 9 [0056.559] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.mov") returned 0 [0056.559] lstrlenA (lpString="*.mov") returned 5 [0056.559] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.m2v") returned 0 [0056.559] lstrlenA (lpString="*.m2v") returned 5 [0056.559] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.3gp") returned 0 [0056.559] lstrlenA (lpString="*.3gp") returned 5 [0056.559] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.mpeg") returned 0 [0056.559] lstrlenA (lpString="*.mpeg") returned 6 [0056.559] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.mpg") returned 0 [0056.559] lstrlenA (lpString="*.mpg") returned 5 [0056.559] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.flv") returned 0 [0056.559] lstrlenA (lpString="*.flv") returned 5 [0056.559] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.avi") returned 0 [0056.559] lstrlenA (lpString="*.avi") returned 5 [0056.559] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.mp4") returned 0 [0056.559] lstrlenA (lpString="*.mp4") returned 5 [0056.559] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.wmv") returned 0 [0056.559] lstrlenA (lpString="*.wmv") returned 5 [0056.559] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.divx") returned 0 [0056.559] lstrlenA (lpString="*.divx") returned 6 [0056.559] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.mkv") returned 0 [0056.559] lstrlenA (lpString="*.mkv") returned 5 [0056.559] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.mp3") returned 0 [0056.559] lstrlenA (lpString="*.mp3") returned 5 [0056.560] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.wav") returned 0 [0056.560] lstrlenA (lpString="*.wav") returned 5 [0056.560] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.flac") returned 0 [0056.560] lstrlenA (lpString="*.flac") returned 6 [0056.560] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.ape") returned 0 [0056.560] lstrlenA (lpString="*.ape") returned 5 [0056.560] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.wma") returned 0 [0056.560] lstrlenA (lpString="*.wma") returned 5 [0056.560] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.ac3") returned 0 [0056.560] lstrlenA (lpString="*.ac3") returned 5 [0056.560] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x1ae3c95a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8cb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1 [0056.560] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.560] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="segmono_boot.ttf") returned -1 [0056.560] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="segmono_boot.ttf") returned -1 [0056.560] lstrcmpiA (lpString1="", lpString2="segmono_boot.ttf") returned -1 [0056.560] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\msyh_boot.ttf") returned="msyh_boot.ttf" [0056.560] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0056.560] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0056.560] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0056.560] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0056.560] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="segmono_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\segmono_boot.ttf") returned="C:\\Boot\\Fonts\\segmono_boot.ttf" [0056.560] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.zip") returned 0 [0056.560] lstrlenA (lpString="*.zip") returned 5 [0056.560] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.rar") returned 0 [0056.560] lstrlenA (lpString="*.rar") returned 5 [0056.560] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.7z") returned 0 [0056.560] lstrlenA (lpString="*.7z") returned 4 [0056.560] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.tar") returned 0 [0056.560] lstrlenA (lpString="*.tar") returned 5 [0056.560] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.gzip") returned 0 [0056.560] lstrlenA (lpString="*.gzip") returned 6 [0056.561] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.jpg") returned 0 [0056.561] lstrlenA (lpString="*.jpg") returned 5 [0056.561] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.jpeg") returned 0 [0056.561] lstrlenA (lpString="*.jpeg") returned 6 [0056.561] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.psd") returned 0 [0056.561] lstrlenA (lpString="*.psd") returned 5 [0056.561] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.cdr") returned 0 [0056.561] lstrlenA (lpString="*.cdr") returned 5 [0056.561] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.dwg") returned 0 [0056.561] lstrlenA (lpString="*.dwg") returned 5 [0056.561] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.max") returned 0 [0056.561] lstrlenA (lpString="*.max") returned 5 [0056.561] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.bmp") returned 0 [0056.561] lstrlenA (lpString="*.bmp") returned 5 [0056.561] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.gif") returned 0 [0056.561] lstrlenA (lpString="*.gif") returned 5 [0056.561] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.png") returned 0 [0056.561] lstrlenA (lpString="*.png") returned 5 [0056.561] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.doc") returned 0 [0056.561] lstrlenA (lpString="*.doc") returned 5 [0056.561] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.docx") returned 0 [0056.561] lstrlenA (lpString="*.docx") returned 6 [0056.561] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.xls") returned 0 [0056.561] lstrlenA (lpString="*.xls") returned 5 [0056.561] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.xlsx") returned 0 [0056.561] lstrlenA (lpString="*.xlsx") returned 6 [0056.561] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.ppt") returned 0 [0056.561] lstrlenA (lpString="*.ppt") returned 5 [0056.561] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.pptx") returned 0 [0056.561] lstrlenA (lpString="*.pptx") returned 6 [0056.561] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.txt") returned 0 [0056.561] lstrlenA (lpString="*.txt") returned 5 [0056.561] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.pdf") returned 0 [0056.562] lstrlenA (lpString="*.pdf") returned 5 [0056.562] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.djvu") returned 0 [0056.562] lstrlenA (lpString="*.djvu") returned 6 [0056.562] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.htm") returned 0 [0056.562] lstrlenA (lpString="*.htm") returned 5 [0056.562] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.html") returned 0 [0056.562] lstrlenA (lpString="*.html") returned 6 [0056.562] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.mdb") returned 0 [0056.562] lstrlenA (lpString="*.mdb") returned 5 [0056.562] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.cer") returned 0 [0056.562] lstrlenA (lpString="*.cer") returned 5 [0056.562] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.p12") returned 0 [0056.562] lstrlenA (lpString="*.p12") returned 5 [0056.562] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.pfx") returned 0 [0056.562] lstrlenA (lpString="*.pfx") returned 5 [0056.562] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.kwm") returned 0 [0056.562] lstrlenA (lpString="*.kwm") returned 5 [0056.562] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.pwm") returned 0 [0056.562] lstrlenA (lpString="*.pwm") returned 5 [0056.562] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.1cd") returned 0 [0056.562] lstrlenA (lpString="*.1cd") returned 5 [0056.562] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.md") returned 0 [0056.562] lstrlenA (lpString="*.md") returned 4 [0056.562] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.mdf") returned 0 [0056.562] lstrlenA (lpString="*.mdf") returned 5 [0056.562] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.dbf") returned 0 [0056.562] lstrlenA (lpString="*.dbf") returned 5 [0056.562] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.odt") returned 0 [0056.562] lstrlenA (lpString="*.odt") returned 5 [0056.562] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.vob") returned 0 [0056.562] lstrlenA (lpString="*.vob") returned 5 [0056.562] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.ifo") returned 0 [0056.562] lstrlenA (lpString="*.ifo") returned 5 [0056.562] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.lnk") returned 0 [0056.563] lstrlenA (lpString="*.lnk") returned 5 [0056.563] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.torrent") returned 0 [0056.563] lstrlenA (lpString="*.torrent") returned 9 [0056.563] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.mov") returned 0 [0056.563] lstrlenA (lpString="*.mov") returned 5 [0056.563] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.m2v") returned 0 [0056.563] lstrlenA (lpString="*.m2v") returned 5 [0056.563] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.3gp") returned 0 [0056.563] lstrlenA (lpString="*.3gp") returned 5 [0056.563] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.mpeg") returned 0 [0056.563] lstrlenA (lpString="*.mpeg") returned 6 [0056.563] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.mpg") returned 0 [0056.563] lstrlenA (lpString="*.mpg") returned 5 [0056.563] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.flv") returned 0 [0056.563] lstrlenA (lpString="*.flv") returned 5 [0056.563] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.avi") returned 0 [0056.563] lstrlenA (lpString="*.avi") returned 5 [0056.563] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.mp4") returned 0 [0056.563] lstrlenA (lpString="*.mp4") returned 5 [0056.563] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.wmv") returned 0 [0056.563] lstrlenA (lpString="*.wmv") returned 5 [0056.563] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.divx") returned 0 [0056.563] lstrlenA (lpString="*.divx") returned 6 [0056.563] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.mkv") returned 0 [0056.563] lstrlenA (lpString="*.mkv") returned 5 [0056.563] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.mp3") returned 0 [0056.563] lstrlenA (lpString="*.mp3") returned 5 [0056.563] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.wav") returned 0 [0056.563] lstrlenA (lpString="*.wav") returned 5 [0056.563] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.flac") returned 0 [0056.563] lstrlenA (lpString="*.flac") returned 6 [0056.563] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.ape") returned 0 [0056.563] lstrlenA (lpString="*.ape") returned 5 [0056.563] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.wma") returned 0 [0056.564] lstrlenA (lpString="*.wma") returned 5 [0056.564] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.ac3") returned 0 [0056.564] lstrlenA (lpString="*.ac3") returned 5 [0056.564] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x1ae3c95a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d20, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1 [0056.564] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.564] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="segoen_slboot.ttf") returned -1 [0056.564] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="segoen_slboot.ttf") returned -1 [0056.564] lstrcmpiA (lpString1="", lpString2="segoen_slboot.ttf") returned -1 [0056.564] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\segmono_boot.ttf") returned="segmono_boot.ttf" [0056.564] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0056.564] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0056.564] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0056.564] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0056.564] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="segoen_slboot.ttf" | out: lpString1="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned="C:\\Boot\\Fonts\\segoen_slboot.ttf" [0056.564] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.zip") returned 0 [0056.564] lstrlenA (lpString="*.zip") returned 5 [0056.564] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.rar") returned 0 [0056.564] lstrlenA (lpString="*.rar") returned 5 [0056.564] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.7z") returned 0 [0056.564] lstrlenA (lpString="*.7z") returned 4 [0056.564] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.tar") returned 0 [0056.564] lstrlenA (lpString="*.tar") returned 5 [0056.564] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.gzip") returned 0 [0056.564] lstrlenA (lpString="*.gzip") returned 6 [0056.564] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.jpg") returned 0 [0056.564] lstrlenA (lpString="*.jpg") returned 5 [0056.564] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.jpeg") returned 0 [0056.564] lstrlenA (lpString="*.jpeg") returned 6 [0056.565] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.psd") returned 0 [0056.565] lstrlenA (lpString="*.psd") returned 5 [0056.565] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.cdr") returned 0 [0056.565] lstrlenA (lpString="*.cdr") returned 5 [0056.565] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.dwg") returned 0 [0056.565] lstrlenA (lpString="*.dwg") returned 5 [0056.565] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.max") returned 0 [0056.565] lstrlenA (lpString="*.max") returned 5 [0056.565] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.bmp") returned 0 [0056.565] lstrlenA (lpString="*.bmp") returned 5 [0056.565] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.gif") returned 0 [0056.565] lstrlenA (lpString="*.gif") returned 5 [0056.565] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.png") returned 0 [0056.565] lstrlenA (lpString="*.png") returned 5 [0056.565] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.doc") returned 0 [0056.565] lstrlenA (lpString="*.doc") returned 5 [0056.565] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.docx") returned 0 [0056.565] lstrlenA (lpString="*.docx") returned 6 [0056.565] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.xls") returned 0 [0056.565] lstrlenA (lpString="*.xls") returned 5 [0056.565] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.xlsx") returned 0 [0056.565] lstrlenA (lpString="*.xlsx") returned 6 [0056.565] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.ppt") returned 0 [0056.565] lstrlenA (lpString="*.ppt") returned 5 [0056.565] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.pptx") returned 0 [0056.565] lstrlenA (lpString="*.pptx") returned 6 [0056.565] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.txt") returned 0 [0056.565] lstrlenA (lpString="*.txt") returned 5 [0056.565] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.pdf") returned 0 [0056.565] lstrlenA (lpString="*.pdf") returned 5 [0056.565] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.djvu") returned 0 [0056.565] lstrlenA (lpString="*.djvu") returned 6 [0056.565] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.htm") returned 0 [0056.565] lstrlenA (lpString="*.htm") returned 5 [0056.565] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.html") returned 0 [0056.566] lstrlenA (lpString="*.html") returned 6 [0056.566] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.mdb") returned 0 [0056.566] lstrlenA (lpString="*.mdb") returned 5 [0056.566] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.cer") returned 0 [0056.566] lstrlenA (lpString="*.cer") returned 5 [0056.566] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.p12") returned 0 [0056.566] lstrlenA (lpString="*.p12") returned 5 [0056.566] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.pfx") returned 0 [0056.566] lstrlenA (lpString="*.pfx") returned 5 [0056.566] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.kwm") returned 0 [0056.566] lstrlenA (lpString="*.kwm") returned 5 [0056.566] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.pwm") returned 0 [0056.566] lstrlenA (lpString="*.pwm") returned 5 [0056.566] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.1cd") returned 0 [0056.566] lstrlenA (lpString="*.1cd") returned 5 [0056.566] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.md") returned 0 [0056.566] lstrlenA (lpString="*.md") returned 4 [0056.566] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.mdf") returned 0 [0056.566] lstrlenA (lpString="*.mdf") returned 5 [0056.566] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.dbf") returned 0 [0056.566] lstrlenA (lpString="*.dbf") returned 5 [0056.566] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.odt") returned 0 [0056.566] lstrlenA (lpString="*.odt") returned 5 [0056.566] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.vob") returned 0 [0056.566] lstrlenA (lpString="*.vob") returned 5 [0056.566] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.ifo") returned 0 [0056.566] lstrlenA (lpString="*.ifo") returned 5 [0056.566] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.lnk") returned 0 [0056.566] lstrlenA (lpString="*.lnk") returned 5 [0056.566] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.torrent") returned 0 [0056.566] lstrlenA (lpString="*.torrent") returned 9 [0056.566] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.mov") returned 0 [0056.566] lstrlenA (lpString="*.mov") returned 5 [0056.566] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.m2v") returned 0 [0056.566] lstrlenA (lpString="*.m2v") returned 5 [0056.566] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.3gp") returned 0 [0056.567] lstrlenA (lpString="*.3gp") returned 5 [0056.567] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.mpeg") returned 0 [0056.567] lstrlenA (lpString="*.mpeg") returned 6 [0056.567] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.mpg") returned 0 [0056.567] lstrlenA (lpString="*.mpg") returned 5 [0056.567] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.flv") returned 0 [0056.567] lstrlenA (lpString="*.flv") returned 5 [0056.567] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.avi") returned 0 [0056.567] lstrlenA (lpString="*.avi") returned 5 [0056.567] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.mp4") returned 0 [0056.567] lstrlenA (lpString="*.mp4") returned 5 [0056.567] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.wmv") returned 0 [0056.567] lstrlenA (lpString="*.wmv") returned 5 [0056.567] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.divx") returned 0 [0056.567] lstrlenA (lpString="*.divx") returned 6 [0056.567] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.mkv") returned 0 [0056.567] lstrlenA (lpString="*.mkv") returned 5 [0056.567] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.mp3") returned 0 [0056.567] lstrlenA (lpString="*.mp3") returned 5 [0056.567] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.wav") returned 0 [0056.567] lstrlenA (lpString="*.wav") returned 5 [0056.567] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.flac") returned 0 [0056.567] lstrlenA (lpString="*.flac") returned 6 [0056.567] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.ape") returned 0 [0056.568] lstrlenA (lpString="*.ape") returned 5 [0056.568] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.wma") returned 0 [0056.568] lstrlenA (lpString="*.wma") returned 5 [0056.568] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.ac3") returned 0 [0056.568] lstrlenA (lpString="*.ac3") returned 5 [0056.568] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x1ae62bb5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12e5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1 [0056.568] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.568] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="segoe_slboot.ttf") returned -1 [0056.568] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="segoe_slboot.ttf") returned -1 [0056.568] lstrcmpiA (lpString1="", lpString2="segoe_slboot.ttf") returned -1 [0056.568] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned="segoen_slboot.ttf" [0056.568] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0056.568] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0056.568] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0056.568] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0056.568] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="segoe_slboot.ttf" | out: lpString1="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned="C:\\Boot\\Fonts\\segoe_slboot.ttf" [0056.568] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.zip") returned 0 [0056.568] lstrlenA (lpString="*.zip") returned 5 [0056.568] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.rar") returned 0 [0056.568] lstrlenA (lpString="*.rar") returned 5 [0056.568] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.7z") returned 0 [0056.568] lstrlenA (lpString="*.7z") returned 4 [0056.568] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.tar") returned 0 [0056.568] lstrlenA (lpString="*.tar") returned 5 [0056.568] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.gzip") returned 0 [0056.568] lstrlenA (lpString="*.gzip") returned 6 [0056.568] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.jpg") returned 0 [0056.568] lstrlenA (lpString="*.jpg") returned 5 [0056.568] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.jpeg") returned 0 [0056.569] lstrlenA (lpString="*.jpeg") returned 6 [0056.569] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.psd") returned 0 [0056.569] lstrlenA (lpString="*.psd") returned 5 [0056.569] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.cdr") returned 0 [0056.569] lstrlenA (lpString="*.cdr") returned 5 [0056.569] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.dwg") returned 0 [0056.569] lstrlenA (lpString="*.dwg") returned 5 [0056.569] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.max") returned 0 [0056.569] lstrlenA (lpString="*.max") returned 5 [0056.569] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.bmp") returned 0 [0056.569] lstrlenA (lpString="*.bmp") returned 5 [0056.569] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.gif") returned 0 [0056.569] lstrlenA (lpString="*.gif") returned 5 [0056.569] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.png") returned 0 [0056.569] lstrlenA (lpString="*.png") returned 5 [0056.569] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.doc") returned 0 [0056.569] lstrlenA (lpString="*.doc") returned 5 [0056.569] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.docx") returned 0 [0056.569] lstrlenA (lpString="*.docx") returned 6 [0056.569] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.xls") returned 0 [0056.569] lstrlenA (lpString="*.xls") returned 5 [0056.569] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.xlsx") returned 0 [0056.569] lstrlenA (lpString="*.xlsx") returned 6 [0056.569] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.ppt") returned 0 [0056.569] lstrlenA (lpString="*.ppt") returned 5 [0056.569] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.pptx") returned 0 [0056.569] lstrlenA (lpString="*.pptx") returned 6 [0056.569] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.txt") returned 0 [0056.569] lstrlenA (lpString="*.txt") returned 5 [0056.569] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.pdf") returned 0 [0056.569] lstrlenA (lpString="*.pdf") returned 5 [0056.569] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.djvu") returned 0 [0056.570] lstrlenA (lpString="*.djvu") returned 6 [0056.570] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.htm") returned 0 [0056.570] lstrlenA (lpString="*.htm") returned 5 [0056.570] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.html") returned 0 [0056.570] lstrlenA (lpString="*.html") returned 6 [0056.570] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.mdb") returned 0 [0056.570] lstrlenA (lpString="*.mdb") returned 5 [0056.570] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.cer") returned 0 [0056.570] lstrlenA (lpString="*.cer") returned 5 [0056.570] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.p12") returned 0 [0056.570] lstrlenA (lpString="*.p12") returned 5 [0056.570] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.pfx") returned 0 [0056.570] lstrlenA (lpString="*.pfx") returned 5 [0056.570] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.kwm") returned 0 [0056.570] lstrlenA (lpString="*.kwm") returned 5 [0056.570] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.pwm") returned 0 [0056.570] lstrlenA (lpString="*.pwm") returned 5 [0056.570] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.1cd") returned 0 [0056.570] lstrlenA (lpString="*.1cd") returned 5 [0056.570] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.md") returned 0 [0056.570] lstrlenA (lpString="*.md") returned 4 [0056.570] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.mdf") returned 0 [0056.570] lstrlenA (lpString="*.mdf") returned 5 [0056.570] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.dbf") returned 0 [0056.570] lstrlenA (lpString="*.dbf") returned 5 [0056.570] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.odt") returned 0 [0056.570] lstrlenA (lpString="*.odt") returned 5 [0056.570] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.vob") returned 0 [0056.570] lstrlenA (lpString="*.vob") returned 5 [0056.570] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.ifo") returned 0 [0056.570] lstrlenA (lpString="*.ifo") returned 5 [0056.570] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.lnk") returned 0 [0056.570] lstrlenA (lpString="*.lnk") returned 5 [0056.570] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.torrent") returned 0 [0056.570] lstrlenA (lpString="*.torrent") returned 9 [0056.571] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.mov") returned 0 [0056.571] lstrlenA (lpString="*.mov") returned 5 [0056.571] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.m2v") returned 0 [0056.571] lstrlenA (lpString="*.m2v") returned 5 [0056.571] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.3gp") returned 0 [0056.571] lstrlenA (lpString="*.3gp") returned 5 [0056.571] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.mpeg") returned 0 [0056.571] lstrlenA (lpString="*.mpeg") returned 6 [0056.571] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.mpg") returned 0 [0056.571] lstrlenA (lpString="*.mpg") returned 5 [0056.571] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.flv") returned 0 [0056.571] lstrlenA (lpString="*.flv") returned 5 [0056.571] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.avi") returned 0 [0056.571] lstrlenA (lpString="*.avi") returned 5 [0056.571] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.mp4") returned 0 [0056.571] lstrlenA (lpString="*.mp4") returned 5 [0056.571] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.wmv") returned 0 [0056.571] lstrlenA (lpString="*.wmv") returned 5 [0056.571] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.divx") returned 0 [0056.571] lstrlenA (lpString="*.divx") returned 6 [0056.571] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.mkv") returned 0 [0056.571] lstrlenA (lpString="*.mkv") returned 5 [0056.571] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.mp3") returned 0 [0056.571] lstrlenA (lpString="*.mp3") returned 5 [0056.571] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.wav") returned 0 [0056.571] lstrlenA (lpString="*.wav") returned 5 [0056.571] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.flac") returned 0 [0056.571] lstrlenA (lpString="*.flac") returned 6 [0056.571] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.ape") returned 0 [0056.571] lstrlenA (lpString="*.ape") returned 5 [0056.571] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.wma") returned 0 [0056.571] lstrlenA (lpString="*.wma") returned 5 [0056.571] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.ac3") returned 0 [0056.571] lstrlenA (lpString="*.ac3") returned 5 [0056.571] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x1ae3c95a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0056.571] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.572] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="wgl4_boot.ttf") returned -1 [0056.572] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wgl4_boot.ttf") returned -1 [0056.572] lstrcmpiA (lpString1="", lpString2="wgl4_boot.ttf") returned -1 [0056.572] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned="segoe_slboot.ttf" [0056.572] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0056.572] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0056.572] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0056.572] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0056.572] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="wgl4_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned="C:\\Boot\\Fonts\\wgl4_boot.ttf" [0056.572] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.zip") returned 0 [0056.572] lstrlenA (lpString="*.zip") returned 5 [0056.572] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.rar") returned 0 [0056.572] lstrlenA (lpString="*.rar") returned 5 [0056.572] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.7z") returned 0 [0056.572] lstrlenA (lpString="*.7z") returned 4 [0056.572] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.tar") returned 0 [0056.572] lstrlenA (lpString="*.tar") returned 5 [0056.572] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.gzip") returned 0 [0056.572] lstrlenA (lpString="*.gzip") returned 6 [0056.572] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.jpg") returned 0 [0056.572] lstrlenA (lpString="*.jpg") returned 5 [0056.572] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.jpeg") returned 0 [0056.572] lstrlenA (lpString="*.jpeg") returned 6 [0056.572] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.psd") returned 0 [0056.572] lstrlenA (lpString="*.psd") returned 5 [0056.572] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.cdr") returned 0 [0056.572] lstrlenA (lpString="*.cdr") returned 5 [0056.572] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.dwg") returned 0 [0056.572] lstrlenA (lpString="*.dwg") returned 5 [0056.572] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.max") returned 0 [0056.572] lstrlenA (lpString="*.max") returned 5 [0056.572] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.bmp") returned 0 [0056.572] lstrlenA (lpString="*.bmp") returned 5 [0056.573] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.gif") returned 0 [0056.573] lstrlenA (lpString="*.gif") returned 5 [0056.573] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.png") returned 0 [0056.573] lstrlenA (lpString="*.png") returned 5 [0056.573] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.doc") returned 0 [0056.573] lstrlenA (lpString="*.doc") returned 5 [0056.573] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.docx") returned 0 [0056.573] lstrlenA (lpString="*.docx") returned 6 [0056.573] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.xls") returned 0 [0056.573] lstrlenA (lpString="*.xls") returned 5 [0056.573] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.xlsx") returned 0 [0056.573] lstrlenA (lpString="*.xlsx") returned 6 [0056.573] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.ppt") returned 0 [0056.573] lstrlenA (lpString="*.ppt") returned 5 [0056.573] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.pptx") returned 0 [0056.573] lstrlenA (lpString="*.pptx") returned 6 [0056.573] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.txt") returned 0 [0056.573] lstrlenA (lpString="*.txt") returned 5 [0056.573] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.pdf") returned 0 [0056.573] lstrlenA (lpString="*.pdf") returned 5 [0056.573] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.djvu") returned 0 [0056.573] lstrlenA (lpString="*.djvu") returned 6 [0056.573] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.htm") returned 0 [0056.573] lstrlenA (lpString="*.htm") returned 5 [0056.573] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.html") returned 0 [0056.573] lstrlenA (lpString="*.html") returned 6 [0056.573] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mdb") returned 0 [0056.573] lstrlenA (lpString="*.mdb") returned 5 [0056.573] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.cer") returned 0 [0056.573] lstrlenA (lpString="*.cer") returned 5 [0056.573] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.p12") returned 0 [0056.573] lstrlenA (lpString="*.p12") returned 5 [0056.573] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.pfx") returned 0 [0056.573] lstrlenA (lpString="*.pfx") returned 5 [0056.573] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.kwm") returned 0 [0056.574] lstrlenA (lpString="*.kwm") returned 5 [0056.574] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.pwm") returned 0 [0056.574] lstrlenA (lpString="*.pwm") returned 5 [0056.574] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.1cd") returned 0 [0056.574] lstrlenA (lpString="*.1cd") returned 5 [0056.574] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.md") returned 0 [0056.574] lstrlenA (lpString="*.md") returned 4 [0056.574] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mdf") returned 0 [0056.574] lstrlenA (lpString="*.mdf") returned 5 [0056.574] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.dbf") returned 0 [0056.574] lstrlenA (lpString="*.dbf") returned 5 [0056.574] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.odt") returned 0 [0056.574] lstrlenA (lpString="*.odt") returned 5 [0056.574] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.vob") returned 0 [0056.574] lstrlenA (lpString="*.vob") returned 5 [0056.574] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.ifo") returned 0 [0056.574] lstrlenA (lpString="*.ifo") returned 5 [0056.574] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.lnk") returned 0 [0056.574] lstrlenA (lpString="*.lnk") returned 5 [0056.574] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.torrent") returned 0 [0056.574] lstrlenA (lpString="*.torrent") returned 9 [0056.574] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mov") returned 0 [0056.574] lstrlenA (lpString="*.mov") returned 5 [0056.574] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.m2v") returned 0 [0056.574] lstrlenA (lpString="*.m2v") returned 5 [0056.574] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.3gp") returned 0 [0056.574] lstrlenA (lpString="*.3gp") returned 5 [0056.574] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mpeg") returned 0 [0056.574] lstrlenA (lpString="*.mpeg") returned 6 [0056.574] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mpg") returned 0 [0056.574] lstrlenA (lpString="*.mpg") returned 5 [0056.574] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.flv") returned 0 [0056.574] lstrlenA (lpString="*.flv") returned 5 [0056.574] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.avi") returned 0 [0056.575] lstrlenA (lpString="*.avi") returned 5 [0056.575] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mp4") returned 0 [0056.575] lstrlenA (lpString="*.mp4") returned 5 [0056.575] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.wmv") returned 0 [0056.575] lstrlenA (lpString="*.wmv") returned 5 [0056.575] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.divx") returned 0 [0056.575] lstrlenA (lpString="*.divx") returned 6 [0056.575] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mkv") returned 0 [0056.575] lstrlenA (lpString="*.mkv") returned 5 [0056.575] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mp3") returned 0 [0056.575] lstrlenA (lpString="*.mp3") returned 5 [0056.575] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.wav") returned 0 [0056.575] lstrlenA (lpString="*.wav") returned 5 [0056.575] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.flac") returned 0 [0056.575] lstrlenA (lpString="*.flac") returned 6 [0056.575] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.ape") returned 0 [0056.575] lstrlenA (lpString="*.ape") returned 5 [0056.575] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.wma") returned 0 [0056.575] lstrlenA (lpString="*.wma") returned 5 [0056.575] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.ac3") returned 0 [0056.575] lstrlenA (lpString="*.ac3") returned 5 [0056.575] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x1ae3c95a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0056.575] FindClose (in: hFindFile=0x6365b0 | out: hFindFile=0x6365b0) returned 1 [0056.575] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0056.575] lstrcmpA (lpString1=".", lpString2="fr-CA") returned -1 [0056.575] lstrcmpA (lpString1="..", lpString2="fr-CA") returned -1 [0056.575] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.575] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="fr-CA" | out: lpString1="C:\\Boot\\fr-CA") returned="C:\\Boot\\fr-CA" [0056.576] lstrlenA (lpString="C:\\Boot\\fr-CA") returned 13 [0056.576] FindFirstFileA (in: lpFileName="C:\\Boot\\fr-CA\\*.*" (normalized: "c:\\boot\\fr-ca\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636730 [0056.582] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.582] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.582] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.582] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.582] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.582] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.582] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.582] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.582] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.582] PathFindFileNameA (pszPath="C:\\Boot\\fr-CA\\*.*") returned="*.*" [0056.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\fr-CA\\" | out: lpString1="C:\\Boot\\fr-CA\\") returned="C:\\Boot\\fr-CA\\" [0056.582] PathAddBackslashA (in: pszPath="C:\\Boot\\fr-CA\\" | out: pszPath="C:\\Boot\\fr-CA\\") returned="" [0056.582] lstrcatA (in: lpString1="C:\\Boot\\fr-CA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\fr-CA\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\fr-CA\\HOW TO DECRYPT FILES.txt" [0056.582] GetFileAttributesA (lpFileName="C:\\Boot\\fr-CA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fr-ca\\how to decrypt files.txt")) returned 0xffffffff [0056.582] CreateFileA (lpFileName="C:\\Boot\\fr-CA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fr-ca\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.582] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.583] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.584] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.584] CloseHandle (hObject=0x1c4) returned 1 [0056.584] lstrcatA (in: lpString1="C:\\Boot\\fr-CA\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned="C:\\Boot\\fr-CA\\bootmgr.exe.mui" [0056.584] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.584] lstrlenA (lpString="*.zip") returned 5 [0056.584] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.584] lstrlenA (lpString="*.rar") returned 5 [0056.584] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.584] lstrlenA (lpString="*.7z") returned 4 [0056.584] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.584] lstrlenA (lpString="*.tar") returned 5 [0056.584] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.584] lstrlenA (lpString="*.gzip") returned 6 [0056.584] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.585] lstrlenA (lpString="*.jpg") returned 5 [0056.585] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.585] lstrlenA (lpString="*.jpeg") returned 6 [0056.585] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.585] lstrlenA (lpString="*.psd") returned 5 [0056.585] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.585] lstrlenA (lpString="*.cdr") returned 5 [0056.585] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.585] lstrlenA (lpString="*.dwg") returned 5 [0056.585] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.585] lstrlenA (lpString="*.max") returned 5 [0056.585] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.585] lstrlenA (lpString="*.bmp") returned 5 [0056.585] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.585] lstrlenA (lpString="*.gif") returned 5 [0056.585] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.585] lstrlenA (lpString="*.png") returned 5 [0056.585] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.585] lstrlenA (lpString="*.doc") returned 5 [0056.585] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.585] lstrlenA (lpString="*.docx") returned 6 [0056.585] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.585] lstrlenA (lpString="*.xls") returned 5 [0056.585] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.585] lstrlenA (lpString="*.xlsx") returned 6 [0056.585] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.585] lstrlenA (lpString="*.ppt") returned 5 [0056.585] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.585] lstrlenA (lpString="*.pptx") returned 6 [0056.585] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.585] lstrlenA (lpString="*.txt") returned 5 [0056.585] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.585] lstrlenA (lpString="*.pdf") returned 5 [0056.585] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.585] lstrlenA (lpString="*.djvu") returned 6 [0056.586] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.586] lstrlenA (lpString="*.htm") returned 5 [0056.586] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.586] lstrlenA (lpString="*.html") returned 6 [0056.586] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.586] lstrlenA (lpString="*.mdb") returned 5 [0056.586] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.586] lstrlenA (lpString="*.cer") returned 5 [0056.586] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.586] lstrlenA (lpString="*.p12") returned 5 [0056.586] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.586] lstrlenA (lpString="*.pfx") returned 5 [0056.586] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.586] lstrlenA (lpString="*.kwm") returned 5 [0056.586] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.586] lstrlenA (lpString="*.pwm") returned 5 [0056.586] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.586] lstrlenA (lpString="*.1cd") returned 5 [0056.586] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.586] lstrlenA (lpString="*.md") returned 4 [0056.586] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.586] lstrlenA (lpString="*.mdf") returned 5 [0056.586] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.586] lstrlenA (lpString="*.dbf") returned 5 [0056.586] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.586] lstrlenA (lpString="*.odt") returned 5 [0056.586] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.586] lstrlenA (lpString="*.vob") returned 5 [0056.586] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.586] lstrlenA (lpString="*.ifo") returned 5 [0056.586] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.586] lstrlenA (lpString="*.lnk") returned 5 [0056.586] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.586] lstrlenA (lpString="*.torrent") returned 9 [0056.586] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.587] lstrlenA (lpString="*.mov") returned 5 [0056.587] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.587] lstrlenA (lpString="*.m2v") returned 5 [0056.587] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.587] lstrlenA (lpString="*.3gp") returned 5 [0056.587] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.587] lstrlenA (lpString="*.mpeg") returned 6 [0056.587] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.587] lstrlenA (lpString="*.mpg") returned 5 [0056.587] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.587] lstrlenA (lpString="*.flv") returned 5 [0056.587] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.587] lstrlenA (lpString="*.avi") returned 5 [0056.587] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.587] lstrlenA (lpString="*.mp4") returned 5 [0056.587] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.587] lstrlenA (lpString="*.wmv") returned 5 [0056.587] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.587] lstrlenA (lpString="*.divx") returned 6 [0056.587] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.587] lstrlenA (lpString="*.mkv") returned 5 [0056.587] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.587] lstrlenA (lpString="*.mp3") returned 5 [0056.587] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.587] lstrlenA (lpString="*.wav") returned 5 [0056.587] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.587] lstrlenA (lpString="*.flac") returned 6 [0056.587] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.587] lstrlenA (lpString="*.ape") returned 5 [0056.587] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.587] lstrlenA (lpString="*.wma") returned 5 [0056.587] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.587] lstrlenA (lpString="*.ac3") returned 5 [0056.587] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0056.587] FindClose (in: hFindFile=0x636730 | out: hFindFile=0x636730) returned 1 [0056.588] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0056.588] lstrcmpA (lpString1=".", lpString2="fr-FR") returned -1 [0056.588] lstrcmpA (lpString1="..", lpString2="fr-FR") returned -1 [0056.588] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.588] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="fr-FR" | out: lpString1="C:\\Boot\\fr-FR") returned="C:\\Boot\\fr-FR" [0056.588] lstrlenA (lpString="C:\\Boot\\fr-FR") returned 13 [0056.588] FindFirstFileA (in: lpFileName="C:\\Boot\\fr-FR\\*.*" (normalized: "c:\\boot\\fr-fr\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636970 [0056.589] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.589] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.589] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.589] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.589] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.589] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.589] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.589] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.589] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.589] PathFindFileNameA (pszPath="C:\\Boot\\fr-FR\\*.*") returned="*.*" [0056.589] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\fr-FR\\" | out: lpString1="C:\\Boot\\fr-FR\\") returned="C:\\Boot\\fr-FR\\" [0056.589] PathAddBackslashA (in: pszPath="C:\\Boot\\fr-FR\\" | out: pszPath="C:\\Boot\\fr-FR\\") returned="" [0056.589] lstrcatA (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\fr-FR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\fr-FR\\HOW TO DECRYPT FILES.txt" [0056.589] GetFileAttributesA (lpFileName="C:\\Boot\\fr-FR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fr-fr\\how to decrypt files.txt")) returned 0xffffffff [0056.589] CreateFileA (lpFileName="C:\\Boot\\fr-FR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fr-fr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.591] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.591] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.592] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.592] CloseHandle (hObject=0x1c4) returned 1 [0056.592] lstrcatA (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned="C:\\Boot\\fr-FR\\bootmgr.exe.mui" [0056.592] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.592] lstrlenA (lpString="*.zip") returned 5 [0056.592] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.592] lstrlenA (lpString="*.rar") returned 5 [0056.592] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.592] lstrlenA (lpString="*.7z") returned 4 [0056.592] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.592] lstrlenA (lpString="*.tar") returned 5 [0056.592] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.592] lstrlenA (lpString="*.gzip") returned 6 [0056.592] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.592] lstrlenA (lpString="*.jpg") returned 5 [0056.592] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.592] lstrlenA (lpString="*.jpeg") returned 6 [0056.592] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.593] lstrlenA (lpString="*.psd") returned 5 [0056.593] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.593] lstrlenA (lpString="*.cdr") returned 5 [0056.593] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.593] lstrlenA (lpString="*.dwg") returned 5 [0056.593] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.593] lstrlenA (lpString="*.max") returned 5 [0056.593] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.593] lstrlenA (lpString="*.bmp") returned 5 [0056.593] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.593] lstrlenA (lpString="*.gif") returned 5 [0056.593] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.593] lstrlenA (lpString="*.png") returned 5 [0056.593] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.593] lstrlenA (lpString="*.doc") returned 5 [0056.593] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.593] lstrlenA (lpString="*.docx") returned 6 [0056.593] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.593] lstrlenA (lpString="*.xls") returned 5 [0056.593] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.593] lstrlenA (lpString="*.xlsx") returned 6 [0056.593] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.593] lstrlenA (lpString="*.ppt") returned 5 [0056.593] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.593] lstrlenA (lpString="*.pptx") returned 6 [0056.593] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.593] lstrlenA (lpString="*.txt") returned 5 [0056.593] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.593] lstrlenA (lpString="*.pdf") returned 5 [0056.593] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.593] lstrlenA (lpString="*.djvu") returned 6 [0056.593] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.593] lstrlenA (lpString="*.htm") returned 5 [0056.593] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.593] lstrlenA (lpString="*.html") returned 6 [0056.593] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.594] lstrlenA (lpString="*.mdb") returned 5 [0056.594] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.594] lstrlenA (lpString="*.cer") returned 5 [0056.594] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.594] lstrlenA (lpString="*.p12") returned 5 [0056.594] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.594] lstrlenA (lpString="*.pfx") returned 5 [0056.594] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.594] lstrlenA (lpString="*.kwm") returned 5 [0056.594] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.594] lstrlenA (lpString="*.pwm") returned 5 [0056.594] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.594] lstrlenA (lpString="*.1cd") returned 5 [0056.594] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.594] lstrlenA (lpString="*.md") returned 4 [0056.594] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.594] lstrlenA (lpString="*.mdf") returned 5 [0056.594] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.594] lstrlenA (lpString="*.dbf") returned 5 [0056.594] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.594] lstrlenA (lpString="*.odt") returned 5 [0056.594] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.594] lstrlenA (lpString="*.vob") returned 5 [0056.594] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.594] lstrlenA (lpString="*.ifo") returned 5 [0056.594] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.594] lstrlenA (lpString="*.lnk") returned 5 [0056.594] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.594] lstrlenA (lpString="*.torrent") returned 9 [0056.594] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.594] lstrlenA (lpString="*.mov") returned 5 [0056.594] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.594] lstrlenA (lpString="*.m2v") returned 5 [0056.594] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.595] lstrlenA (lpString="*.3gp") returned 5 [0056.595] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.595] lstrlenA (lpString="*.mpeg") returned 6 [0056.595] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.595] lstrlenA (lpString="*.mpg") returned 5 [0056.595] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.595] lstrlenA (lpString="*.flv") returned 5 [0056.595] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.595] lstrlenA (lpString="*.avi") returned 5 [0056.595] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.595] lstrlenA (lpString="*.mp4") returned 5 [0056.595] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.595] lstrlenA (lpString="*.wmv") returned 5 [0056.595] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.595] lstrlenA (lpString="*.divx") returned 6 [0056.595] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.595] lstrlenA (lpString="*.mkv") returned 5 [0056.595] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.595] lstrlenA (lpString="*.mp3") returned 5 [0056.595] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.595] lstrlenA (lpString="*.wav") returned 5 [0056.595] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.595] lstrlenA (lpString="*.flac") returned 6 [0056.595] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.595] lstrlenA (lpString="*.ape") returned 5 [0056.595] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.595] lstrlenA (lpString="*.wma") returned 5 [0056.595] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.595] lstrlenA (lpString="*.ac3") returned 5 [0056.595] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.596] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.596] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0056.596] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0056.596] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0056.596] PathFindFileNameA (pszPath="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0056.596] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\fr-FR\\" | out: lpString1="C:\\Boot\\fr-FR\\") returned="C:\\Boot\\fr-FR\\" [0056.596] PathAddBackslashA (in: pszPath="C:\\Boot\\fr-FR\\" | out: pszPath="C:\\Boot\\fr-FR\\") returned="" [0056.596] lstrcatA (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\fr-FR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\fr-FR\\HOW TO DECRYPT FILES.txt" [0056.596] GetFileAttributesA (lpFileName="C:\\Boot\\fr-FR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fr-fr\\how to decrypt files.txt")) returned 0x20 [0056.596] lstrcatA (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\fr-FR\\memtest.exe.mui") returned="C:\\Boot\\fr-FR\\memtest.exe.mui" [0056.596] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0056.596] lstrlenA (lpString="*.zip") returned 5 [0056.596] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0056.596] lstrlenA (lpString="*.rar") returned 5 [0056.596] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0056.596] lstrlenA (lpString="*.7z") returned 4 [0056.596] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0056.596] lstrlenA (lpString="*.tar") returned 5 [0056.596] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0056.596] lstrlenA (lpString="*.gzip") returned 6 [0056.596] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0056.596] lstrlenA (lpString="*.jpg") returned 5 [0056.596] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0056.596] lstrlenA (lpString="*.jpeg") returned 6 [0056.596] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0056.596] lstrlenA (lpString="*.psd") returned 5 [0056.596] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0056.596] lstrlenA (lpString="*.cdr") returned 5 [0056.596] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0056.596] lstrlenA (lpString="*.dwg") returned 5 [0056.596] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.max") returned 0 [0056.597] lstrlenA (lpString="*.max") returned 5 [0056.597] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0056.597] lstrlenA (lpString="*.bmp") returned 5 [0056.597] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0056.597] lstrlenA (lpString="*.gif") returned 5 [0056.597] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.png") returned 0 [0056.597] lstrlenA (lpString="*.png") returned 5 [0056.597] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0056.597] lstrlenA (lpString="*.doc") returned 5 [0056.597] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0056.597] lstrlenA (lpString="*.docx") returned 6 [0056.597] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0056.597] lstrlenA (lpString="*.xls") returned 5 [0056.597] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0056.597] lstrlenA (lpString="*.xlsx") returned 6 [0056.597] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0056.597] lstrlenA (lpString="*.ppt") returned 5 [0056.597] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0056.597] lstrlenA (lpString="*.pptx") returned 6 [0056.597] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0056.597] lstrlenA (lpString="*.txt") returned 5 [0056.597] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0056.597] lstrlenA (lpString="*.pdf") returned 5 [0056.597] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0056.597] lstrlenA (lpString="*.djvu") returned 6 [0056.597] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0056.597] lstrlenA (lpString="*.htm") returned 5 [0056.597] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.html") returned 0 [0056.597] lstrlenA (lpString="*.html") returned 6 [0056.597] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0056.597] lstrlenA (lpString="*.mdb") returned 5 [0056.597] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0056.598] lstrlenA (lpString="*.cer") returned 5 [0056.598] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0056.598] lstrlenA (lpString="*.p12") returned 5 [0056.598] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0056.598] lstrlenA (lpString="*.pfx") returned 5 [0056.598] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0056.598] lstrlenA (lpString="*.kwm") returned 5 [0056.598] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0056.598] lstrlenA (lpString="*.pwm") returned 5 [0056.598] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0056.598] lstrlenA (lpString="*.1cd") returned 5 [0056.598] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.md") returned 0 [0056.598] lstrlenA (lpString="*.md") returned 4 [0056.598] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0056.598] lstrlenA (lpString="*.mdf") returned 5 [0056.598] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0056.598] lstrlenA (lpString="*.dbf") returned 5 [0056.598] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0056.598] lstrlenA (lpString="*.odt") returned 5 [0056.598] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0056.598] lstrlenA (lpString="*.vob") returned 5 [0056.598] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0056.598] lstrlenA (lpString="*.ifo") returned 5 [0056.598] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0056.598] lstrlenA (lpString="*.lnk") returned 5 [0056.598] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0056.598] lstrlenA (lpString="*.torrent") returned 9 [0056.598] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0056.598] lstrlenA (lpString="*.mov") returned 5 [0056.598] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0056.598] lstrlenA (lpString="*.m2v") returned 5 [0056.600] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0056.600] lstrlenA (lpString="*.3gp") returned 5 [0056.600] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0056.600] lstrlenA (lpString="*.mpeg") returned 6 [0056.600] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0056.600] lstrlenA (lpString="*.mpg") returned 5 [0056.600] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0056.600] lstrlenA (lpString="*.flv") returned 5 [0056.600] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0056.600] lstrlenA (lpString="*.avi") returned 5 [0056.600] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0056.600] lstrlenA (lpString="*.mp4") returned 5 [0056.600] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0056.600] lstrlenA (lpString="*.wmv") returned 5 [0056.600] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0056.600] lstrlenA (lpString="*.divx") returned 6 [0056.600] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0056.600] lstrlenA (lpString="*.mkv") returned 5 [0056.600] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0056.600] lstrlenA (lpString="*.mp3") returned 5 [0056.600] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0056.600] lstrlenA (lpString="*.wav") returned 5 [0056.600] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0056.600] lstrlenA (lpString="*.flac") returned 6 [0056.600] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0056.600] lstrlenA (lpString="*.ape") returned 5 [0056.600] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0056.601] lstrlenA (lpString="*.wma") returned 5 [0056.601] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0056.601] lstrlenA (lpString="*.ac3") returned 5 [0056.601] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0056.601] FindClose (in: hFindFile=0x636970 | out: hFindFile=0x636970) returned 1 [0056.601] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0056.601] lstrcmpA (lpString1=".", lpString2="hr-HR") returned -1 [0056.601] lstrcmpA (lpString1="..", lpString2="hr-HR") returned -1 [0056.601] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.601] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="hr-HR" | out: lpString1="C:\\Boot\\hr-HR") returned="C:\\Boot\\hr-HR" [0056.601] lstrlenA (lpString="C:\\Boot\\hr-HR") returned 13 [0056.601] FindFirstFileA (in: lpFileName="C:\\Boot\\hr-HR\\*.*" (normalized: "c:\\boot\\hr-hr\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636730 [0056.601] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.601] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.601] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.601] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.601] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.601] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.601] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.601] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.601] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.602] PathFindFileNameA (pszPath="C:\\Boot\\hr-HR\\*.*") returned="*.*" [0056.602] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\hr-HR\\" | out: lpString1="C:\\Boot\\hr-HR\\") returned="C:\\Boot\\hr-HR\\" [0056.602] PathAddBackslashA (in: pszPath="C:\\Boot\\hr-HR\\" | out: pszPath="C:\\Boot\\hr-HR\\") returned="" [0056.602] lstrcatA (in: lpString1="C:\\Boot\\hr-HR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\hr-HR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\hr-HR\\HOW TO DECRYPT FILES.txt" [0056.602] GetFileAttributesA (lpFileName="C:\\Boot\\hr-HR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\hr-hr\\how to decrypt files.txt")) returned 0xffffffff [0056.602] CreateFileA (lpFileName="C:\\Boot\\hr-HR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\hr-hr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.602] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.602] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.603] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.603] CloseHandle (hObject=0x1c4) returned 1 [0056.604] lstrcatA (in: lpString1="C:\\Boot\\hr-HR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned="C:\\Boot\\hr-HR\\bootmgr.exe.mui" [0056.604] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.604] lstrlenA (lpString="*.zip") returned 5 [0056.604] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.604] lstrlenA (lpString="*.rar") returned 5 [0056.604] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.604] lstrlenA (lpString="*.7z") returned 4 [0056.604] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.604] lstrlenA (lpString="*.tar") returned 5 [0056.604] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.604] lstrlenA (lpString="*.gzip") returned 6 [0056.604] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.604] lstrlenA (lpString="*.jpg") returned 5 [0056.604] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.604] lstrlenA (lpString="*.jpeg") returned 6 [0056.604] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.604] lstrlenA (lpString="*.psd") returned 5 [0056.604] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.604] lstrlenA (lpString="*.cdr") returned 5 [0056.604] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.604] lstrlenA (lpString="*.dwg") returned 5 [0056.604] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.604] lstrlenA (lpString="*.max") returned 5 [0056.604] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.604] lstrlenA (lpString="*.bmp") returned 5 [0056.604] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.604] lstrlenA (lpString="*.gif") returned 5 [0056.604] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.604] lstrlenA (lpString="*.png") returned 5 [0056.604] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.604] lstrlenA (lpString="*.doc") returned 5 [0056.604] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.605] lstrlenA (lpString="*.docx") returned 6 [0056.605] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.605] lstrlenA (lpString="*.xls") returned 5 [0056.605] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.605] lstrlenA (lpString="*.xlsx") returned 6 [0056.605] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.605] lstrlenA (lpString="*.ppt") returned 5 [0056.605] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.605] lstrlenA (lpString="*.pptx") returned 6 [0056.605] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.605] lstrlenA (lpString="*.txt") returned 5 [0056.605] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.605] lstrlenA (lpString="*.pdf") returned 5 [0056.605] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.605] lstrlenA (lpString="*.djvu") returned 6 [0056.605] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.605] lstrlenA (lpString="*.htm") returned 5 [0056.605] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.605] lstrlenA (lpString="*.html") returned 6 [0056.605] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.605] lstrlenA (lpString="*.mdb") returned 5 [0056.605] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.605] lstrlenA (lpString="*.cer") returned 5 [0056.605] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.605] lstrlenA (lpString="*.p12") returned 5 [0056.605] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.605] lstrlenA (lpString="*.pfx") returned 5 [0056.605] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.605] lstrlenA (lpString="*.kwm") returned 5 [0056.605] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.605] lstrlenA (lpString="*.pwm") returned 5 [0056.606] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.606] lstrlenA (lpString="*.1cd") returned 5 [0056.606] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.606] lstrlenA (lpString="*.md") returned 4 [0056.606] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.606] lstrlenA (lpString="*.mdf") returned 5 [0056.606] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.606] lstrlenA (lpString="*.dbf") returned 5 [0056.606] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.606] lstrlenA (lpString="*.odt") returned 5 [0056.606] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.606] lstrlenA (lpString="*.vob") returned 5 [0056.606] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.606] lstrlenA (lpString="*.ifo") returned 5 [0056.606] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.606] lstrlenA (lpString="*.lnk") returned 5 [0056.606] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.606] lstrlenA (lpString="*.torrent") returned 9 [0056.606] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.606] lstrlenA (lpString="*.mov") returned 5 [0056.606] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.606] lstrlenA (lpString="*.m2v") returned 5 [0056.606] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.606] lstrlenA (lpString="*.3gp") returned 5 [0056.606] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.606] lstrlenA (lpString="*.mpeg") returned 6 [0056.606] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.606] lstrlenA (lpString="*.mpg") returned 5 [0056.606] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.606] lstrlenA (lpString="*.flv") returned 5 [0056.606] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.606] lstrlenA (lpString="*.avi") returned 5 [0056.606] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.606] lstrlenA (lpString="*.mp4") returned 5 [0056.607] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.607] lstrlenA (lpString="*.wmv") returned 5 [0056.607] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.607] lstrlenA (lpString="*.divx") returned 6 [0056.607] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.607] lstrlenA (lpString="*.mkv") returned 5 [0056.607] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.607] lstrlenA (lpString="*.mp3") returned 5 [0056.607] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.607] lstrlenA (lpString="*.wav") returned 5 [0056.607] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.607] lstrlenA (lpString="*.flac") returned 6 [0056.607] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.607] lstrlenA (lpString="*.ape") returned 5 [0056.607] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.607] lstrlenA (lpString="*.wma") returned 5 [0056.607] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.607] lstrlenA (lpString="*.ac3") returned 5 [0056.607] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0056.607] FindClose (in: hFindFile=0x636730 | out: hFindFile=0x636730) returned 1 [0056.607] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0056.607] lstrcmpA (lpString1=".", lpString2="hu-HU") returned -1 [0056.607] lstrcmpA (lpString1="..", lpString2="hu-HU") returned -1 [0056.607] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.607] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="hu-HU" | out: lpString1="C:\\Boot\\hu-HU") returned="C:\\Boot\\hu-HU" [0056.607] lstrlenA (lpString="C:\\Boot\\hu-HU") returned 13 [0056.607] FindFirstFileA (in: lpFileName="C:\\Boot\\hu-HU\\*.*" (normalized: "c:\\boot\\hu-hu\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6367f0 [0056.608] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.608] FindNextFileA (in: hFindFile=0x6367f0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.608] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.608] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.608] FindNextFileA (in: hFindFile=0x6367f0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.608] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.608] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.608] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.608] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.609] PathFindFileNameA (pszPath="C:\\Boot\\hu-HU\\*.*") returned="*.*" [0056.609] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\hu-HU\\" | out: lpString1="C:\\Boot\\hu-HU\\") returned="C:\\Boot\\hu-HU\\" [0056.609] PathAddBackslashA (in: pszPath="C:\\Boot\\hu-HU\\" | out: pszPath="C:\\Boot\\hu-HU\\") returned="" [0056.609] lstrcatA (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\hu-HU\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\hu-HU\\HOW TO DECRYPT FILES.txt" [0056.609] GetFileAttributesA (lpFileName="C:\\Boot\\hu-HU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\hu-hu\\how to decrypt files.txt")) returned 0xffffffff [0056.609] CreateFileA (lpFileName="C:\\Boot\\hu-HU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\hu-hu\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.614] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.614] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.615] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.615] CloseHandle (hObject=0x1c4) returned 1 [0056.615] lstrcatA (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned="C:\\Boot\\hu-HU\\bootmgr.exe.mui" [0056.615] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.615] lstrlenA (lpString="*.zip") returned 5 [0056.615] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.615] lstrlenA (lpString="*.rar") returned 5 [0056.615] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.615] lstrlenA (lpString="*.7z") returned 4 [0056.616] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.616] lstrlenA (lpString="*.tar") returned 5 [0056.616] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.616] lstrlenA (lpString="*.gzip") returned 6 [0056.616] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.616] lstrlenA (lpString="*.jpg") returned 5 [0056.616] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.616] lstrlenA (lpString="*.jpeg") returned 6 [0056.616] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.616] lstrlenA (lpString="*.psd") returned 5 [0056.616] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.616] lstrlenA (lpString="*.cdr") returned 5 [0056.616] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.616] lstrlenA (lpString="*.dwg") returned 5 [0056.616] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.616] lstrlenA (lpString="*.max") returned 5 [0056.616] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.616] lstrlenA (lpString="*.bmp") returned 5 [0056.616] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.616] lstrlenA (lpString="*.gif") returned 5 [0056.616] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.616] lstrlenA (lpString="*.png") returned 5 [0056.616] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.616] lstrlenA (lpString="*.doc") returned 5 [0056.616] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.616] lstrlenA (lpString="*.docx") returned 6 [0056.616] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.616] lstrlenA (lpString="*.xls") returned 5 [0056.616] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.616] lstrlenA (lpString="*.xlsx") returned 6 [0056.616] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.616] lstrlenA (lpString="*.ppt") returned 5 [0056.616] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.616] lstrlenA (lpString="*.pptx") returned 6 [0056.617] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.617] lstrlenA (lpString="*.txt") returned 5 [0056.617] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.617] lstrlenA (lpString="*.pdf") returned 5 [0056.617] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.617] lstrlenA (lpString="*.djvu") returned 6 [0056.617] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.617] lstrlenA (lpString="*.htm") returned 5 [0056.617] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.617] lstrlenA (lpString="*.html") returned 6 [0056.617] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.617] lstrlenA (lpString="*.mdb") returned 5 [0056.617] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.617] lstrlenA (lpString="*.cer") returned 5 [0056.617] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.617] lstrlenA (lpString="*.p12") returned 5 [0056.617] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.617] lstrlenA (lpString="*.pfx") returned 5 [0056.617] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.617] lstrlenA (lpString="*.kwm") returned 5 [0056.617] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.617] lstrlenA (lpString="*.pwm") returned 5 [0056.617] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.617] lstrlenA (lpString="*.1cd") returned 5 [0056.617] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.617] lstrlenA (lpString="*.md") returned 4 [0056.617] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.617] lstrlenA (lpString="*.mdf") returned 5 [0056.617] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.617] lstrlenA (lpString="*.dbf") returned 5 [0056.617] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.617] lstrlenA (lpString="*.odt") returned 5 [0056.617] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.618] lstrlenA (lpString="*.vob") returned 5 [0056.618] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.618] lstrlenA (lpString="*.ifo") returned 5 [0056.618] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.618] lstrlenA (lpString="*.lnk") returned 5 [0056.618] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.618] lstrlenA (lpString="*.torrent") returned 9 [0056.618] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.618] lstrlenA (lpString="*.mov") returned 5 [0056.618] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.618] lstrlenA (lpString="*.m2v") returned 5 [0056.618] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.618] lstrlenA (lpString="*.3gp") returned 5 [0056.618] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.618] lstrlenA (lpString="*.mpeg") returned 6 [0056.618] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.618] lstrlenA (lpString="*.mpg") returned 5 [0056.618] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.618] lstrlenA (lpString="*.flv") returned 5 [0056.618] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.618] lstrlenA (lpString="*.avi") returned 5 [0056.618] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.618] lstrlenA (lpString="*.mp4") returned 5 [0056.618] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.618] lstrlenA (lpString="*.wmv") returned 5 [0056.618] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.618] lstrlenA (lpString="*.divx") returned 6 [0056.618] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.618] lstrlenA (lpString="*.mkv") returned 5 [0056.618] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.618] lstrlenA (lpString="*.mp3") returned 5 [0056.618] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.618] lstrlenA (lpString="*.wav") returned 5 [0056.618] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.619] lstrlenA (lpString="*.flac") returned 6 [0056.619] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.619] lstrlenA (lpString="*.ape") returned 5 [0056.619] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.619] lstrlenA (lpString="*.wma") returned 5 [0056.619] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.619] lstrlenA (lpString="*.ac3") returned 5 [0056.619] FindNextFileA (in: hFindFile=0x6367f0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.619] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.619] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0056.619] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0056.619] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0056.619] PathFindFileNameA (pszPath="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0056.619] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\hu-HU\\" | out: lpString1="C:\\Boot\\hu-HU\\") returned="C:\\Boot\\hu-HU\\" [0056.619] PathAddBackslashA (in: pszPath="C:\\Boot\\hu-HU\\" | out: pszPath="C:\\Boot\\hu-HU\\") returned="" [0056.619] lstrcatA (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\hu-HU\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\hu-HU\\HOW TO DECRYPT FILES.txt" [0056.619] GetFileAttributesA (lpFileName="C:\\Boot\\hu-HU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\hu-hu\\how to decrypt files.txt")) returned 0x20 [0056.619] lstrcatA (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\hu-HU\\memtest.exe.mui") returned="C:\\Boot\\hu-HU\\memtest.exe.mui" [0056.619] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0056.619] lstrlenA (lpString="*.zip") returned 5 [0056.619] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0056.619] lstrlenA (lpString="*.rar") returned 5 [0056.619] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0056.619] lstrlenA (lpString="*.7z") returned 4 [0056.619] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0056.619] lstrlenA (lpString="*.tar") returned 5 [0056.619] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0056.619] lstrlenA (lpString="*.gzip") returned 6 [0056.619] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0056.620] lstrlenA (lpString="*.jpg") returned 5 [0056.620] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0056.620] lstrlenA (lpString="*.jpeg") returned 6 [0056.620] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0056.620] lstrlenA (lpString="*.psd") returned 5 [0056.620] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0056.620] lstrlenA (lpString="*.cdr") returned 5 [0056.620] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0056.620] lstrlenA (lpString="*.dwg") returned 5 [0056.620] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.max") returned 0 [0056.620] lstrlenA (lpString="*.max") returned 5 [0056.620] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0056.620] lstrlenA (lpString="*.bmp") returned 5 [0056.620] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0056.620] lstrlenA (lpString="*.gif") returned 5 [0056.620] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.png") returned 0 [0056.620] lstrlenA (lpString="*.png") returned 5 [0056.620] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0056.620] lstrlenA (lpString="*.doc") returned 5 [0056.620] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0056.620] lstrlenA (lpString="*.docx") returned 6 [0056.620] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0056.620] lstrlenA (lpString="*.xls") returned 5 [0056.620] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0056.620] lstrlenA (lpString="*.xlsx") returned 6 [0056.620] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0056.620] lstrlenA (lpString="*.ppt") returned 5 [0056.620] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0056.620] lstrlenA (lpString="*.pptx") returned 6 [0056.620] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0056.620] lstrlenA (lpString="*.txt") returned 5 [0056.620] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0056.621] lstrlenA (lpString="*.pdf") returned 5 [0056.621] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0056.621] lstrlenA (lpString="*.djvu") returned 6 [0056.621] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0056.621] lstrlenA (lpString="*.htm") returned 5 [0056.621] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.html") returned 0 [0056.621] lstrlenA (lpString="*.html") returned 6 [0056.621] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0056.621] lstrlenA (lpString="*.mdb") returned 5 [0056.621] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0056.621] lstrlenA (lpString="*.cer") returned 5 [0056.621] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0056.621] lstrlenA (lpString="*.p12") returned 5 [0056.621] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0056.621] lstrlenA (lpString="*.pfx") returned 5 [0056.621] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0056.621] lstrlenA (lpString="*.kwm") returned 5 [0056.621] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0056.621] lstrlenA (lpString="*.pwm") returned 5 [0056.621] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0056.621] lstrlenA (lpString="*.1cd") returned 5 [0056.621] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.md") returned 0 [0056.621] lstrlenA (lpString="*.md") returned 4 [0056.621] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0056.621] lstrlenA (lpString="*.mdf") returned 5 [0056.621] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0056.621] lstrlenA (lpString="*.dbf") returned 5 [0056.621] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0056.621] lstrlenA (lpString="*.odt") returned 5 [0056.621] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0056.621] lstrlenA (lpString="*.vob") returned 5 [0056.621] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0056.622] lstrlenA (lpString="*.ifo") returned 5 [0056.622] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0056.622] lstrlenA (lpString="*.lnk") returned 5 [0056.622] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0056.622] lstrlenA (lpString="*.torrent") returned 9 [0056.622] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0056.622] lstrlenA (lpString="*.mov") returned 5 [0056.622] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0056.622] lstrlenA (lpString="*.m2v") returned 5 [0056.622] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0056.622] lstrlenA (lpString="*.3gp") returned 5 [0056.622] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0056.622] lstrlenA (lpString="*.mpeg") returned 6 [0056.622] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0056.622] lstrlenA (lpString="*.mpg") returned 5 [0056.622] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0056.622] lstrlenA (lpString="*.flv") returned 5 [0056.622] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0056.622] lstrlenA (lpString="*.avi") returned 5 [0056.622] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0056.622] lstrlenA (lpString="*.mp4") returned 5 [0056.622] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0056.622] lstrlenA (lpString="*.wmv") returned 5 [0056.622] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0056.622] lstrlenA (lpString="*.divx") returned 6 [0056.622] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0056.622] lstrlenA (lpString="*.mkv") returned 5 [0056.622] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0056.622] lstrlenA (lpString="*.mp3") returned 5 [0056.622] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0056.622] lstrlenA (lpString="*.wav") returned 5 [0056.622] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0056.622] lstrlenA (lpString="*.flac") returned 6 [0056.622] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0056.623] lstrlenA (lpString="*.ape") returned 5 [0056.623] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0056.623] lstrlenA (lpString="*.wma") returned 5 [0056.623] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0056.623] lstrlenA (lpString="*.ac3") returned 5 [0056.623] FindNextFileA (in: hFindFile=0x6367f0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0056.623] FindClose (in: hFindFile=0x6367f0 | out: hFindFile=0x6367f0) returned 1 [0056.623] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="it-IT", cAlternateFileName="")) returned 1 [0056.623] lstrcmpA (lpString1=".", lpString2="it-IT") returned -1 [0056.623] lstrcmpA (lpString1="..", lpString2="it-IT") returned -1 [0056.623] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.623] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="it-IT" | out: lpString1="C:\\Boot\\it-IT") returned="C:\\Boot\\it-IT" [0056.623] lstrlenA (lpString="C:\\Boot\\it-IT") returned 13 [0056.623] FindFirstFileA (in: lpFileName="C:\\Boot\\it-IT\\*.*" (normalized: "c:\\boot\\it-it\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636430 [0056.629] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.629] FindNextFileA (in: hFindFile=0x636430, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.629] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.629] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.629] FindNextFileA (in: hFindFile=0x636430, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.629] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.629] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.629] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.629] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.629] PathFindFileNameA (pszPath="C:\\Boot\\it-IT\\*.*") returned="*.*" [0056.629] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\it-IT\\" | out: lpString1="C:\\Boot\\it-IT\\") returned="C:\\Boot\\it-IT\\" [0056.630] PathAddBackslashA (in: pszPath="C:\\Boot\\it-IT\\" | out: pszPath="C:\\Boot\\it-IT\\") returned="" [0056.630] lstrcatA (in: lpString1="C:\\Boot\\it-IT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\it-IT\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\it-IT\\HOW TO DECRYPT FILES.txt" [0056.630] GetFileAttributesA (lpFileName="C:\\Boot\\it-IT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\it-it\\how to decrypt files.txt")) returned 0xffffffff [0056.630] CreateFileA (lpFileName="C:\\Boot\\it-IT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\it-it\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.632] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.632] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.633] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.633] CloseHandle (hObject=0x1c4) returned 1 [0056.633] lstrcatA (in: lpString1="C:\\Boot\\it-IT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned="C:\\Boot\\it-IT\\bootmgr.exe.mui" [0056.633] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.633] lstrlenA (lpString="*.zip") returned 5 [0056.633] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.633] lstrlenA (lpString="*.rar") returned 5 [0056.633] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.633] lstrlenA (lpString="*.7z") returned 4 [0056.633] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.633] lstrlenA (lpString="*.tar") returned 5 [0056.633] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.633] lstrlenA (lpString="*.gzip") returned 6 [0056.633] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.633] lstrlenA (lpString="*.jpg") returned 5 [0056.633] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.633] lstrlenA (lpString="*.jpeg") returned 6 [0056.633] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.633] lstrlenA (lpString="*.psd") returned 5 [0056.633] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.633] lstrlenA (lpString="*.cdr") returned 5 [0056.634] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.634] lstrlenA (lpString="*.dwg") returned 5 [0056.634] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.634] lstrlenA (lpString="*.max") returned 5 [0056.634] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.634] lstrlenA (lpString="*.bmp") returned 5 [0056.634] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.634] lstrlenA (lpString="*.gif") returned 5 [0056.634] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.634] lstrlenA (lpString="*.png") returned 5 [0056.634] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.634] lstrlenA (lpString="*.doc") returned 5 [0056.634] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.634] lstrlenA (lpString="*.docx") returned 6 [0056.634] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.634] lstrlenA (lpString="*.xls") returned 5 [0056.634] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.634] lstrlenA (lpString="*.xlsx") returned 6 [0056.634] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.634] lstrlenA (lpString="*.ppt") returned 5 [0056.634] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.634] lstrlenA (lpString="*.pptx") returned 6 [0056.634] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.634] lstrlenA (lpString="*.txt") returned 5 [0056.634] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.634] lstrlenA (lpString="*.pdf") returned 5 [0056.634] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.634] lstrlenA (lpString="*.djvu") returned 6 [0056.634] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.634] lstrlenA (lpString="*.htm") returned 5 [0056.634] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.634] lstrlenA (lpString="*.html") returned 6 [0056.635] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.635] lstrlenA (lpString="*.mdb") returned 5 [0056.635] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.635] lstrlenA (lpString="*.cer") returned 5 [0056.635] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.635] lstrlenA (lpString="*.p12") returned 5 [0056.635] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.635] lstrlenA (lpString="*.pfx") returned 5 [0056.635] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.635] lstrlenA (lpString="*.kwm") returned 5 [0056.635] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.635] lstrlenA (lpString="*.pwm") returned 5 [0056.635] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.635] lstrlenA (lpString="*.1cd") returned 5 [0056.635] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.635] lstrlenA (lpString="*.md") returned 4 [0056.635] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.635] lstrlenA (lpString="*.mdf") returned 5 [0056.635] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.635] lstrlenA (lpString="*.dbf") returned 5 [0056.635] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.635] lstrlenA (lpString="*.odt") returned 5 [0056.635] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.635] lstrlenA (lpString="*.vob") returned 5 [0056.635] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.635] lstrlenA (lpString="*.ifo") returned 5 [0056.635] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.635] lstrlenA (lpString="*.lnk") returned 5 [0056.635] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.635] lstrlenA (lpString="*.torrent") returned 9 [0056.635] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.635] lstrlenA (lpString="*.mov") returned 5 [0056.636] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.636] lstrlenA (lpString="*.m2v") returned 5 [0056.636] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.636] lstrlenA (lpString="*.3gp") returned 5 [0056.636] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.636] lstrlenA (lpString="*.mpeg") returned 6 [0056.636] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.636] lstrlenA (lpString="*.mpg") returned 5 [0056.636] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.636] lstrlenA (lpString="*.flv") returned 5 [0056.636] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.636] lstrlenA (lpString="*.avi") returned 5 [0056.636] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.636] lstrlenA (lpString="*.mp4") returned 5 [0056.636] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.636] lstrlenA (lpString="*.wmv") returned 5 [0056.636] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.636] lstrlenA (lpString="*.divx") returned 6 [0056.636] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.636] lstrlenA (lpString="*.mkv") returned 5 [0056.636] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.636] lstrlenA (lpString="*.mp3") returned 5 [0056.636] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.636] lstrlenA (lpString="*.wav") returned 5 [0056.636] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.636] lstrlenA (lpString="*.flac") returned 6 [0056.636] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.636] lstrlenA (lpString="*.ape") returned 5 [0056.636] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.636] lstrlenA (lpString="*.wma") returned 5 [0056.636] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.636] lstrlenA (lpString="*.ac3") returned 5 [0056.636] FindNextFileA (in: hFindFile=0x636430, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb158, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.637] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.637] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0056.637] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0056.637] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0056.637] PathFindFileNameA (pszPath="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0056.637] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\it-IT\\" | out: lpString1="C:\\Boot\\it-IT\\") returned="C:\\Boot\\it-IT\\" [0056.637] PathAddBackslashA (in: pszPath="C:\\Boot\\it-IT\\" | out: pszPath="C:\\Boot\\it-IT\\") returned="" [0056.637] lstrcatA (in: lpString1="C:\\Boot\\it-IT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\it-IT\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\it-IT\\HOW TO DECRYPT FILES.txt" [0056.637] GetFileAttributesA (lpFileName="C:\\Boot\\it-IT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\it-it\\how to decrypt files.txt")) returned 0x20 [0056.637] lstrcatA (in: lpString1="C:\\Boot\\it-IT\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\it-IT\\memtest.exe.mui") returned="C:\\Boot\\it-IT\\memtest.exe.mui" [0056.637] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0056.637] lstrlenA (lpString="*.zip") returned 5 [0056.637] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0056.637] lstrlenA (lpString="*.rar") returned 5 [0056.637] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0056.637] lstrlenA (lpString="*.7z") returned 4 [0056.637] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0056.637] lstrlenA (lpString="*.tar") returned 5 [0056.637] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0056.637] lstrlenA (lpString="*.gzip") returned 6 [0056.637] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0056.637] lstrlenA (lpString="*.jpg") returned 5 [0056.637] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0056.637] lstrlenA (lpString="*.jpeg") returned 6 [0056.637] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0056.637] lstrlenA (lpString="*.psd") returned 5 [0056.637] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0056.637] lstrlenA (lpString="*.cdr") returned 5 [0056.637] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0056.637] lstrlenA (lpString="*.dwg") returned 5 [0056.638] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.max") returned 0 [0056.638] lstrlenA (lpString="*.max") returned 5 [0056.638] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0056.638] lstrlenA (lpString="*.bmp") returned 5 [0056.638] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0056.638] lstrlenA (lpString="*.gif") returned 5 [0056.638] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.png") returned 0 [0056.638] lstrlenA (lpString="*.png") returned 5 [0056.638] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0056.638] lstrlenA (lpString="*.doc") returned 5 [0056.638] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0056.638] lstrlenA (lpString="*.docx") returned 6 [0056.638] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0056.638] lstrlenA (lpString="*.xls") returned 5 [0056.638] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0056.638] lstrlenA (lpString="*.xlsx") returned 6 [0056.638] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0056.638] lstrlenA (lpString="*.ppt") returned 5 [0056.638] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0056.638] lstrlenA (lpString="*.pptx") returned 6 [0056.638] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0056.638] lstrlenA (lpString="*.txt") returned 5 [0056.638] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0056.638] lstrlenA (lpString="*.pdf") returned 5 [0056.638] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0056.638] lstrlenA (lpString="*.djvu") returned 6 [0056.638] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0056.638] lstrlenA (lpString="*.htm") returned 5 [0056.638] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.html") returned 0 [0056.638] lstrlenA (lpString="*.html") returned 6 [0056.638] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0056.638] lstrlenA (lpString="*.mdb") returned 5 [0056.638] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0056.638] lstrlenA (lpString="*.cer") returned 5 [0056.639] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0056.639] lstrlenA (lpString="*.p12") returned 5 [0056.639] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0056.639] lstrlenA (lpString="*.pfx") returned 5 [0056.639] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0056.639] lstrlenA (lpString="*.kwm") returned 5 [0056.639] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0056.639] lstrlenA (lpString="*.pwm") returned 5 [0056.639] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0056.639] lstrlenA (lpString="*.1cd") returned 5 [0056.639] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.md") returned 0 [0056.639] lstrlenA (lpString="*.md") returned 4 [0056.639] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0056.639] lstrlenA (lpString="*.mdf") returned 5 [0056.639] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0056.639] lstrlenA (lpString="*.dbf") returned 5 [0056.639] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0056.639] lstrlenA (lpString="*.odt") returned 5 [0056.639] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0056.639] lstrlenA (lpString="*.vob") returned 5 [0056.639] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0056.639] lstrlenA (lpString="*.ifo") returned 5 [0056.639] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0056.639] lstrlenA (lpString="*.lnk") returned 5 [0056.639] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0056.639] lstrlenA (lpString="*.torrent") returned 9 [0056.639] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0056.639] lstrlenA (lpString="*.mov") returned 5 [0056.639] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0056.639] lstrlenA (lpString="*.m2v") returned 5 [0056.639] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0056.639] lstrlenA (lpString="*.3gp") returned 5 [0056.639] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0056.639] lstrlenA (lpString="*.mpeg") returned 6 [0056.639] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0056.640] lstrlenA (lpString="*.mpg") returned 5 [0056.640] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0056.640] lstrlenA (lpString="*.flv") returned 5 [0056.640] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0056.640] lstrlenA (lpString="*.avi") returned 5 [0056.640] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0056.640] lstrlenA (lpString="*.mp4") returned 5 [0056.640] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0056.640] lstrlenA (lpString="*.wmv") returned 5 [0056.640] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0056.640] lstrlenA (lpString="*.divx") returned 6 [0056.640] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0056.640] lstrlenA (lpString="*.mkv") returned 5 [0056.640] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0056.640] lstrlenA (lpString="*.mp3") returned 5 [0056.640] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0056.640] lstrlenA (lpString="*.wav") returned 5 [0056.640] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0056.640] lstrlenA (lpString="*.flac") returned 6 [0056.640] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0056.640] lstrlenA (lpString="*.ape") returned 5 [0056.640] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0056.640] lstrlenA (lpString="*.wma") returned 5 [0056.640] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0056.640] lstrlenA (lpString="*.ac3") returned 5 [0056.640] FindNextFileA (in: hFindFile=0x636430, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb158, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0056.640] FindClose (in: hFindFile=0x636430 | out: hFindFile=0x636430) returned 1 [0056.640] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0056.640] lstrcmpA (lpString1=".", lpString2="ja-JP") returned -1 [0056.641] lstrcmpA (lpString1="..", lpString2="ja-JP") returned -1 [0056.641] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.641] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="ja-JP" | out: lpString1="C:\\Boot\\ja-JP") returned="C:\\Boot\\ja-JP" [0056.641] lstrlenA (lpString="C:\\Boot\\ja-JP") returned 13 [0056.641] FindFirstFileA (in: lpFileName="C:\\Boot\\ja-JP\\*.*" (normalized: "c:\\boot\\ja-jp\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6368f0 [0056.641] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.641] FindNextFileA (in: hFindFile=0x6368f0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.641] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.641] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.641] FindNextFileA (in: hFindFile=0x6368f0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.641] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.641] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.641] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.641] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.641] PathFindFileNameA (pszPath="C:\\Boot\\ja-JP\\*.*") returned="*.*" [0056.641] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ja-JP\\" | out: lpString1="C:\\Boot\\ja-JP\\") returned="C:\\Boot\\ja-JP\\" [0056.641] PathAddBackslashA (in: pszPath="C:\\Boot\\ja-JP\\" | out: pszPath="C:\\Boot\\ja-JP\\") returned="" [0056.641] lstrcatA (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\ja-JP\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\ja-JP\\HOW TO DECRYPT FILES.txt" [0056.641] GetFileAttributesA (lpFileName="C:\\Boot\\ja-JP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ja-jp\\how to decrypt files.txt")) returned 0xffffffff [0056.641] CreateFileA (lpFileName="C:\\Boot\\ja-JP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ja-jp\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.647] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.647] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.648] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.648] CloseHandle (hObject=0x1c4) returned 1 [0056.648] lstrcatA (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned="C:\\Boot\\ja-JP\\bootmgr.exe.mui" [0056.648] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.648] lstrlenA (lpString="*.zip") returned 5 [0056.648] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.648] lstrlenA (lpString="*.rar") returned 5 [0056.648] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.648] lstrlenA (lpString="*.7z") returned 4 [0056.648] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.648] lstrlenA (lpString="*.tar") returned 5 [0056.648] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.648] lstrlenA (lpString="*.gzip") returned 6 [0056.648] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.648] lstrlenA (lpString="*.jpg") returned 5 [0056.649] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.649] lstrlenA (lpString="*.jpeg") returned 6 [0056.649] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.649] lstrlenA (lpString="*.psd") returned 5 [0056.649] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.649] lstrlenA (lpString="*.cdr") returned 5 [0056.649] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.649] lstrlenA (lpString="*.dwg") returned 5 [0056.649] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.649] lstrlenA (lpString="*.max") returned 5 [0056.649] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.649] lstrlenA (lpString="*.bmp") returned 5 [0056.649] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.649] lstrlenA (lpString="*.gif") returned 5 [0056.649] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.649] lstrlenA (lpString="*.png") returned 5 [0056.649] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.649] lstrlenA (lpString="*.doc") returned 5 [0056.649] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.649] lstrlenA (lpString="*.docx") returned 6 [0056.649] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.649] lstrlenA (lpString="*.xls") returned 5 [0056.649] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.649] lstrlenA (lpString="*.xlsx") returned 6 [0056.649] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.649] lstrlenA (lpString="*.ppt") returned 5 [0056.649] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.649] lstrlenA (lpString="*.pptx") returned 6 [0056.649] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.649] lstrlenA (lpString="*.txt") returned 5 [0056.649] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.649] lstrlenA (lpString="*.pdf") returned 5 [0056.650] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.650] lstrlenA (lpString="*.djvu") returned 6 [0056.650] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.650] lstrlenA (lpString="*.htm") returned 5 [0056.650] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.650] lstrlenA (lpString="*.html") returned 6 [0056.650] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.650] lstrlenA (lpString="*.mdb") returned 5 [0056.650] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.650] lstrlenA (lpString="*.cer") returned 5 [0056.650] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.650] lstrlenA (lpString="*.p12") returned 5 [0056.650] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.650] lstrlenA (lpString="*.pfx") returned 5 [0056.650] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.650] lstrlenA (lpString="*.kwm") returned 5 [0056.650] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.650] lstrlenA (lpString="*.pwm") returned 5 [0056.650] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.650] lstrlenA (lpString="*.1cd") returned 5 [0056.650] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.650] lstrlenA (lpString="*.md") returned 4 [0056.650] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.650] lstrlenA (lpString="*.mdf") returned 5 [0056.650] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.650] lstrlenA (lpString="*.dbf") returned 5 [0056.650] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.650] lstrlenA (lpString="*.odt") returned 5 [0056.650] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.650] lstrlenA (lpString="*.vob") returned 5 [0056.650] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.650] lstrlenA (lpString="*.ifo") returned 5 [0056.650] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.651] lstrlenA (lpString="*.lnk") returned 5 [0056.651] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.651] lstrlenA (lpString="*.torrent") returned 9 [0056.651] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.651] lstrlenA (lpString="*.mov") returned 5 [0056.651] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.651] lstrlenA (lpString="*.m2v") returned 5 [0056.651] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.651] lstrlenA (lpString="*.3gp") returned 5 [0056.651] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.651] lstrlenA (lpString="*.mpeg") returned 6 [0056.651] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.651] lstrlenA (lpString="*.mpg") returned 5 [0056.651] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.651] lstrlenA (lpString="*.flv") returned 5 [0056.651] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.651] lstrlenA (lpString="*.avi") returned 5 [0056.651] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.651] lstrlenA (lpString="*.mp4") returned 5 [0056.651] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.651] lstrlenA (lpString="*.wmv") returned 5 [0056.651] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.651] lstrlenA (lpString="*.divx") returned 6 [0056.651] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.651] lstrlenA (lpString="*.mkv") returned 5 [0056.651] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.651] lstrlenA (lpString="*.mp3") returned 5 [0056.651] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.651] lstrlenA (lpString="*.wav") returned 5 [0056.651] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.651] lstrlenA (lpString="*.flac") returned 6 [0056.651] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.651] lstrlenA (lpString="*.ape") returned 5 [0056.652] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.652] lstrlenA (lpString="*.wma") returned 5 [0056.652] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.652] lstrlenA (lpString="*.ac3") returned 5 [0056.652] FindNextFileA (in: hFindFile=0x6368f0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa760, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.652] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.652] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0056.652] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0056.652] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0056.652] PathFindFileNameA (pszPath="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0056.652] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ja-JP\\" | out: lpString1="C:\\Boot\\ja-JP\\") returned="C:\\Boot\\ja-JP\\" [0056.652] PathAddBackslashA (in: pszPath="C:\\Boot\\ja-JP\\" | out: pszPath="C:\\Boot\\ja-JP\\") returned="" [0056.652] lstrcatA (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\ja-JP\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\ja-JP\\HOW TO DECRYPT FILES.txt" [0056.652] GetFileAttributesA (lpFileName="C:\\Boot\\ja-JP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ja-jp\\how to decrypt files.txt")) returned 0x20 [0056.652] lstrcatA (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\ja-JP\\memtest.exe.mui") returned="C:\\Boot\\ja-JP\\memtest.exe.mui" [0056.652] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0056.652] lstrlenA (lpString="*.zip") returned 5 [0056.652] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0056.652] lstrlenA (lpString="*.rar") returned 5 [0056.652] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0056.652] lstrlenA (lpString="*.7z") returned 4 [0056.652] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0056.652] lstrlenA (lpString="*.tar") returned 5 [0056.652] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0056.652] lstrlenA (lpString="*.gzip") returned 6 [0056.652] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0056.652] lstrlenA (lpString="*.jpg") returned 5 [0056.652] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0056.652] lstrlenA (lpString="*.jpeg") returned 6 [0056.652] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0056.653] lstrlenA (lpString="*.psd") returned 5 [0056.653] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0056.653] lstrlenA (lpString="*.cdr") returned 5 [0056.653] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0056.653] lstrlenA (lpString="*.dwg") returned 5 [0056.653] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.max") returned 0 [0056.653] lstrlenA (lpString="*.max") returned 5 [0056.653] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0056.653] lstrlenA (lpString="*.bmp") returned 5 [0056.653] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0056.653] lstrlenA (lpString="*.gif") returned 5 [0056.653] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.png") returned 0 [0056.653] lstrlenA (lpString="*.png") returned 5 [0056.653] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0056.653] lstrlenA (lpString="*.doc") returned 5 [0056.653] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0056.653] lstrlenA (lpString="*.docx") returned 6 [0056.653] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0056.653] lstrlenA (lpString="*.xls") returned 5 [0056.653] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0056.653] lstrlenA (lpString="*.xlsx") returned 6 [0056.653] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0056.653] lstrlenA (lpString="*.ppt") returned 5 [0056.653] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0056.653] lstrlenA (lpString="*.pptx") returned 6 [0056.653] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0056.653] lstrlenA (lpString="*.txt") returned 5 [0056.653] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0056.653] lstrlenA (lpString="*.pdf") returned 5 [0056.653] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0056.653] lstrlenA (lpString="*.djvu") returned 6 [0056.653] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0056.653] lstrlenA (lpString="*.htm") returned 5 [0056.654] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.html") returned 0 [0056.654] lstrlenA (lpString="*.html") returned 6 [0056.654] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0056.654] lstrlenA (lpString="*.mdb") returned 5 [0056.654] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0056.654] lstrlenA (lpString="*.cer") returned 5 [0056.654] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0056.654] lstrlenA (lpString="*.p12") returned 5 [0056.654] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0056.654] lstrlenA (lpString="*.pfx") returned 5 [0056.654] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0056.654] lstrlenA (lpString="*.kwm") returned 5 [0056.654] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0056.654] lstrlenA (lpString="*.pwm") returned 5 [0056.654] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0056.654] lstrlenA (lpString="*.1cd") returned 5 [0056.654] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.md") returned 0 [0056.654] lstrlenA (lpString="*.md") returned 4 [0056.654] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0056.654] lstrlenA (lpString="*.mdf") returned 5 [0056.654] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0056.654] lstrlenA (lpString="*.dbf") returned 5 [0056.654] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0056.654] lstrlenA (lpString="*.odt") returned 5 [0056.654] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0056.654] lstrlenA (lpString="*.vob") returned 5 [0056.654] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0056.654] lstrlenA (lpString="*.ifo") returned 5 [0056.654] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0056.654] lstrlenA (lpString="*.lnk") returned 5 [0056.654] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0056.654] lstrlenA (lpString="*.torrent") returned 9 [0056.654] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0056.654] lstrlenA (lpString="*.mov") returned 5 [0056.655] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0056.655] lstrlenA (lpString="*.m2v") returned 5 [0056.655] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0056.655] lstrlenA (lpString="*.3gp") returned 5 [0056.655] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0056.655] lstrlenA (lpString="*.mpeg") returned 6 [0056.655] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0056.655] lstrlenA (lpString="*.mpg") returned 5 [0056.655] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0056.655] lstrlenA (lpString="*.flv") returned 5 [0056.655] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0056.655] lstrlenA (lpString="*.avi") returned 5 [0056.655] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0056.655] lstrlenA (lpString="*.mp4") returned 5 [0056.655] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0056.655] lstrlenA (lpString="*.wmv") returned 5 [0056.655] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0056.655] lstrlenA (lpString="*.divx") returned 6 [0056.655] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0056.655] lstrlenA (lpString="*.mkv") returned 5 [0056.655] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0056.655] lstrlenA (lpString="*.mp3") returned 5 [0056.655] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0056.655] lstrlenA (lpString="*.wav") returned 5 [0056.655] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0056.655] lstrlenA (lpString="*.flac") returned 6 [0056.655] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0056.655] lstrlenA (lpString="*.ape") returned 5 [0056.655] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0056.655] lstrlenA (lpString="*.wma") returned 5 [0056.655] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0056.655] lstrlenA (lpString="*.ac3") returned 5 [0056.655] FindNextFileA (in: hFindFile=0x6368f0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa760, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0056.656] FindClose (in: hFindFile=0x6368f0 | out: hFindFile=0x6368f0) returned 1 [0056.656] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0056.656] lstrcmpA (lpString1=".", lpString2="ko-KR") returned -1 [0056.656] lstrcmpA (lpString1="..", lpString2="ko-KR") returned -1 [0056.656] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.656] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="ko-KR" | out: lpString1="C:\\Boot\\ko-KR") returned="C:\\Boot\\ko-KR" [0056.656] lstrlenA (lpString="C:\\Boot\\ko-KR") returned 13 [0056.656] FindFirstFileA (in: lpFileName="C:\\Boot\\ko-KR\\*.*" (normalized: "c:\\boot\\ko-kr\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6367f0 [0056.657] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.657] FindNextFileA (in: hFindFile=0x6367f0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.657] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.657] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.657] FindNextFileA (in: hFindFile=0x6367f0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.657] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.657] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.657] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.657] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.657] PathFindFileNameA (pszPath="C:\\Boot\\ko-KR\\*.*") returned="*.*" [0056.657] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ko-KR\\" | out: lpString1="C:\\Boot\\ko-KR\\") returned="C:\\Boot\\ko-KR\\" [0056.657] PathAddBackslashA (in: pszPath="C:\\Boot\\ko-KR\\" | out: pszPath="C:\\Boot\\ko-KR\\") returned="" [0056.657] lstrcatA (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\ko-KR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\ko-KR\\HOW TO DECRYPT FILES.txt" [0056.657] GetFileAttributesA (lpFileName="C:\\Boot\\ko-KR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ko-kr\\how to decrypt files.txt")) returned 0xffffffff [0056.657] CreateFileA (lpFileName="C:\\Boot\\ko-KR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ko-kr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.659] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.659] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.660] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.661] CloseHandle (hObject=0x1c4) returned 1 [0056.661] lstrcatA (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned="C:\\Boot\\ko-KR\\bootmgr.exe.mui" [0056.661] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.661] lstrlenA (lpString="*.zip") returned 5 [0056.661] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.661] lstrlenA (lpString="*.rar") returned 5 [0056.661] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.661] lstrlenA (lpString="*.7z") returned 4 [0056.661] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.661] lstrlenA (lpString="*.tar") returned 5 [0056.661] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.661] lstrlenA (lpString="*.gzip") returned 6 [0056.661] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.661] lstrlenA (lpString="*.jpg") returned 5 [0056.661] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.661] lstrlenA (lpString="*.jpeg") returned 6 [0056.661] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.661] lstrlenA (lpString="*.psd") returned 5 [0056.662] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.662] lstrlenA (lpString="*.cdr") returned 5 [0056.662] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.662] lstrlenA (lpString="*.dwg") returned 5 [0056.662] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.662] lstrlenA (lpString="*.max") returned 5 [0056.662] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.662] lstrlenA (lpString="*.bmp") returned 5 [0056.662] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.662] lstrlenA (lpString="*.gif") returned 5 [0056.662] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.662] lstrlenA (lpString="*.png") returned 5 [0056.662] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.662] lstrlenA (lpString="*.doc") returned 5 [0056.662] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.662] lstrlenA (lpString="*.docx") returned 6 [0056.662] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.662] lstrlenA (lpString="*.xls") returned 5 [0056.662] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.662] lstrlenA (lpString="*.xlsx") returned 6 [0056.662] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.662] lstrlenA (lpString="*.ppt") returned 5 [0056.662] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.662] lstrlenA (lpString="*.pptx") returned 6 [0056.662] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.662] lstrlenA (lpString="*.txt") returned 5 [0056.662] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.662] lstrlenA (lpString="*.pdf") returned 5 [0056.662] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.662] lstrlenA (lpString="*.djvu") returned 6 [0056.662] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.662] lstrlenA (lpString="*.htm") returned 5 [0056.662] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.662] lstrlenA (lpString="*.html") returned 6 [0056.662] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.662] lstrlenA (lpString="*.mdb") returned 5 [0056.663] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.663] lstrlenA (lpString="*.cer") returned 5 [0056.663] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.663] lstrlenA (lpString="*.p12") returned 5 [0056.663] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.663] lstrlenA (lpString="*.pfx") returned 5 [0056.663] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.663] lstrlenA (lpString="*.kwm") returned 5 [0056.663] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.663] lstrlenA (lpString="*.pwm") returned 5 [0056.663] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.663] lstrlenA (lpString="*.1cd") returned 5 [0056.663] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.663] lstrlenA (lpString="*.md") returned 4 [0056.663] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.663] lstrlenA (lpString="*.mdf") returned 5 [0056.663] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.663] lstrlenA (lpString="*.dbf") returned 5 [0056.663] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.663] lstrlenA (lpString="*.odt") returned 5 [0056.663] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.663] lstrlenA (lpString="*.vob") returned 5 [0056.663] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.663] lstrlenA (lpString="*.ifo") returned 5 [0056.663] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.663] lstrlenA (lpString="*.lnk") returned 5 [0056.663] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.663] lstrlenA (lpString="*.torrent") returned 9 [0056.663] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.663] lstrlenA (lpString="*.mov") returned 5 [0056.663] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.663] lstrlenA (lpString="*.m2v") returned 5 [0056.663] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.663] lstrlenA (lpString="*.3gp") returned 5 [0056.663] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.663] lstrlenA (lpString="*.mpeg") returned 6 [0056.664] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.664] lstrlenA (lpString="*.mpg") returned 5 [0056.664] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.664] lstrlenA (lpString="*.flv") returned 5 [0056.664] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.664] lstrlenA (lpString="*.avi") returned 5 [0056.664] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.664] lstrlenA (lpString="*.mp4") returned 5 [0056.664] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.664] lstrlenA (lpString="*.wmv") returned 5 [0056.664] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.664] lstrlenA (lpString="*.divx") returned 6 [0056.664] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.664] lstrlenA (lpString="*.mkv") returned 5 [0056.664] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.664] lstrlenA (lpString="*.mp3") returned 5 [0056.664] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.664] lstrlenA (lpString="*.wav") returned 5 [0056.664] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.664] lstrlenA (lpString="*.flac") returned 6 [0056.664] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.664] lstrlenA (lpString="*.ape") returned 5 [0056.664] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.664] lstrlenA (lpString="*.wma") returned 5 [0056.664] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.664] lstrlenA (lpString="*.ac3") returned 5 [0056.664] FindNextFileA (in: hFindFile=0x6367f0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa760, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.664] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.664] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0056.664] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0056.664] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0056.664] PathFindFileNameA (pszPath="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0056.664] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ko-KR\\" | out: lpString1="C:\\Boot\\ko-KR\\") returned="C:\\Boot\\ko-KR\\" [0056.664] PathAddBackslashA (in: pszPath="C:\\Boot\\ko-KR\\" | out: pszPath="C:\\Boot\\ko-KR\\") returned="" [0056.665] lstrcatA (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\ko-KR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\ko-KR\\HOW TO DECRYPT FILES.txt" [0056.665] GetFileAttributesA (lpFileName="C:\\Boot\\ko-KR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ko-kr\\how to decrypt files.txt")) returned 0x20 [0056.665] lstrcatA (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\ko-KR\\memtest.exe.mui") returned="C:\\Boot\\ko-KR\\memtest.exe.mui" [0056.665] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0056.665] lstrlenA (lpString="*.zip") returned 5 [0056.665] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0056.665] lstrlenA (lpString="*.rar") returned 5 [0056.665] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0056.665] lstrlenA (lpString="*.7z") returned 4 [0056.665] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0056.665] lstrlenA (lpString="*.tar") returned 5 [0056.665] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0056.665] lstrlenA (lpString="*.gzip") returned 6 [0056.665] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0056.665] lstrlenA (lpString="*.jpg") returned 5 [0056.665] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0056.665] lstrlenA (lpString="*.jpeg") returned 6 [0056.665] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0056.665] lstrlenA (lpString="*.psd") returned 5 [0056.665] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0056.665] lstrlenA (lpString="*.cdr") returned 5 [0056.665] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0056.665] lstrlenA (lpString="*.dwg") returned 5 [0056.665] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.max") returned 0 [0056.665] lstrlenA (lpString="*.max") returned 5 [0056.665] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0056.665] lstrlenA (lpString="*.bmp") returned 5 [0056.665] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0056.665] lstrlenA (lpString="*.gif") returned 5 [0056.665] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.png") returned 0 [0056.665] lstrlenA (lpString="*.png") returned 5 [0056.666] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0056.666] lstrlenA (lpString="*.doc") returned 5 [0056.666] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0056.666] lstrlenA (lpString="*.docx") returned 6 [0056.666] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0056.666] lstrlenA (lpString="*.xls") returned 5 [0056.666] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0056.666] lstrlenA (lpString="*.xlsx") returned 6 [0056.666] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0056.666] lstrlenA (lpString="*.ppt") returned 5 [0056.666] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0056.666] lstrlenA (lpString="*.pptx") returned 6 [0056.666] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0056.666] lstrlenA (lpString="*.txt") returned 5 [0056.666] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0056.666] lstrlenA (lpString="*.pdf") returned 5 [0056.666] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0056.666] lstrlenA (lpString="*.djvu") returned 6 [0056.666] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0056.666] lstrlenA (lpString="*.htm") returned 5 [0056.666] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.html") returned 0 [0056.666] lstrlenA (lpString="*.html") returned 6 [0056.666] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0056.666] lstrlenA (lpString="*.mdb") returned 5 [0056.666] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0056.666] lstrlenA (lpString="*.cer") returned 5 [0056.666] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0056.666] lstrlenA (lpString="*.p12") returned 5 [0056.666] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0056.666] lstrlenA (lpString="*.pfx") returned 5 [0056.666] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0056.666] lstrlenA (lpString="*.kwm") returned 5 [0056.666] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0056.666] lstrlenA (lpString="*.pwm") returned 5 [0056.667] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0056.667] lstrlenA (lpString="*.1cd") returned 5 [0056.667] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.md") returned 0 [0056.667] lstrlenA (lpString="*.md") returned 4 [0056.667] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0056.667] lstrlenA (lpString="*.mdf") returned 5 [0056.667] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0056.667] lstrlenA (lpString="*.dbf") returned 5 [0056.667] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0056.667] lstrlenA (lpString="*.odt") returned 5 [0056.667] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0056.667] lstrlenA (lpString="*.vob") returned 5 [0056.667] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0056.667] lstrlenA (lpString="*.ifo") returned 5 [0056.667] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0056.667] lstrlenA (lpString="*.lnk") returned 5 [0056.667] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0056.667] lstrlenA (lpString="*.torrent") returned 9 [0056.667] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0056.667] lstrlenA (lpString="*.mov") returned 5 [0056.667] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0056.667] lstrlenA (lpString="*.m2v") returned 5 [0056.667] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0056.667] lstrlenA (lpString="*.3gp") returned 5 [0056.667] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0056.667] lstrlenA (lpString="*.mpeg") returned 6 [0056.667] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0056.667] lstrlenA (lpString="*.mpg") returned 5 [0056.667] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0056.667] lstrlenA (lpString="*.flv") returned 5 [0056.667] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0056.667] lstrlenA (lpString="*.avi") returned 5 [0056.667] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0056.668] lstrlenA (lpString="*.mp4") returned 5 [0056.668] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0056.668] lstrlenA (lpString="*.wmv") returned 5 [0056.668] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0056.668] lstrlenA (lpString="*.divx") returned 6 [0056.668] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0056.668] lstrlenA (lpString="*.mkv") returned 5 [0056.668] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0056.668] lstrlenA (lpString="*.mp3") returned 5 [0056.668] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0056.668] lstrlenA (lpString="*.wav") returned 5 [0056.668] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0056.668] lstrlenA (lpString="*.flac") returned 6 [0056.668] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0056.668] lstrlenA (lpString="*.ape") returned 5 [0056.668] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0056.668] lstrlenA (lpString="*.wma") returned 5 [0056.668] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0056.668] lstrlenA (lpString="*.ac3") returned 5 [0056.668] FindNextFileA (in: hFindFile=0x6367f0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa760, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0056.668] FindClose (in: hFindFile=0x6367f0 | out: hFindFile=0x6367f0) returned 1 [0056.668] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0056.668] lstrcmpA (lpString1=".", lpString2="lt-LT") returned -1 [0056.668] lstrcmpA (lpString1="..", lpString2="lt-LT") returned -1 [0056.668] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.668] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="lt-LT" | out: lpString1="C:\\Boot\\lt-LT") returned="C:\\Boot\\lt-LT" [0056.668] lstrlenA (lpString="C:\\Boot\\lt-LT") returned 13 [0056.668] FindFirstFileA (in: lpFileName="C:\\Boot\\lt-LT\\*.*" (normalized: "c:\\boot\\lt-lt\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636470 [0056.672] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.672] FindNextFileA (in: hFindFile=0x636470, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.672] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.672] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.672] FindNextFileA (in: hFindFile=0x636470, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.672] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.672] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.672] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.672] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.672] PathFindFileNameA (pszPath="C:\\Boot\\lt-LT\\*.*") returned="*.*" [0056.672] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\lt-LT\\" | out: lpString1="C:\\Boot\\lt-LT\\") returned="C:\\Boot\\lt-LT\\" [0056.672] PathAddBackslashA (in: pszPath="C:\\Boot\\lt-LT\\" | out: pszPath="C:\\Boot\\lt-LT\\") returned="" [0056.672] lstrcatA (in: lpString1="C:\\Boot\\lt-LT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\lt-LT\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\lt-LT\\HOW TO DECRYPT FILES.txt" [0056.672] GetFileAttributesA (lpFileName="C:\\Boot\\lt-LT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\lt-lt\\how to decrypt files.txt")) returned 0xffffffff [0056.672] CreateFileA (lpFileName="C:\\Boot\\lt-LT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\lt-lt\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.672] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.672] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.674] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.674] CloseHandle (hObject=0x1c4) returned 1 [0056.674] lstrcatA (in: lpString1="C:\\Boot\\lt-LT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned="C:\\Boot\\lt-LT\\bootmgr.exe.mui" [0056.674] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.674] lstrlenA (lpString="*.zip") returned 5 [0056.674] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.674] lstrlenA (lpString="*.rar") returned 5 [0056.674] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.674] lstrlenA (lpString="*.7z") returned 4 [0056.674] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.674] lstrlenA (lpString="*.tar") returned 5 [0056.674] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.674] lstrlenA (lpString="*.gzip") returned 6 [0056.674] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.674] lstrlenA (lpString="*.jpg") returned 5 [0056.674] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.674] lstrlenA (lpString="*.jpeg") returned 6 [0056.674] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.674] lstrlenA (lpString="*.psd") returned 5 [0056.674] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.674] lstrlenA (lpString="*.cdr") returned 5 [0056.674] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.674] lstrlenA (lpString="*.dwg") returned 5 [0056.674] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.674] lstrlenA (lpString="*.max") returned 5 [0056.675] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.675] lstrlenA (lpString="*.bmp") returned 5 [0056.675] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.675] lstrlenA (lpString="*.gif") returned 5 [0056.675] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.675] lstrlenA (lpString="*.png") returned 5 [0056.675] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.675] lstrlenA (lpString="*.doc") returned 5 [0056.675] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.675] lstrlenA (lpString="*.docx") returned 6 [0056.675] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.675] lstrlenA (lpString="*.xls") returned 5 [0056.675] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.675] lstrlenA (lpString="*.xlsx") returned 6 [0056.675] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.675] lstrlenA (lpString="*.ppt") returned 5 [0056.675] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.675] lstrlenA (lpString="*.pptx") returned 6 [0056.675] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.675] lstrlenA (lpString="*.txt") returned 5 [0056.675] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.675] lstrlenA (lpString="*.pdf") returned 5 [0056.675] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.675] lstrlenA (lpString="*.djvu") returned 6 [0056.675] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.675] lstrlenA (lpString="*.htm") returned 5 [0056.675] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.675] lstrlenA (lpString="*.html") returned 6 [0056.675] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.675] lstrlenA (lpString="*.mdb") returned 5 [0056.675] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.675] lstrlenA (lpString="*.cer") returned 5 [0056.675] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.675] lstrlenA (lpString="*.p12") returned 5 [0056.676] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.676] lstrlenA (lpString="*.pfx") returned 5 [0056.676] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.676] lstrlenA (lpString="*.kwm") returned 5 [0056.676] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.676] lstrlenA (lpString="*.pwm") returned 5 [0056.676] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.676] lstrlenA (lpString="*.1cd") returned 5 [0056.676] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.676] lstrlenA (lpString="*.md") returned 4 [0056.676] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.676] lstrlenA (lpString="*.mdf") returned 5 [0056.676] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.676] lstrlenA (lpString="*.dbf") returned 5 [0056.676] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.676] lstrlenA (lpString="*.odt") returned 5 [0056.676] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.676] lstrlenA (lpString="*.vob") returned 5 [0056.676] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.676] lstrlenA (lpString="*.ifo") returned 5 [0056.676] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.676] lstrlenA (lpString="*.lnk") returned 5 [0056.676] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.676] lstrlenA (lpString="*.torrent") returned 9 [0056.676] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.676] lstrlenA (lpString="*.mov") returned 5 [0056.676] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.676] lstrlenA (lpString="*.m2v") returned 5 [0056.676] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.676] lstrlenA (lpString="*.3gp") returned 5 [0056.676] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.676] lstrlenA (lpString="*.mpeg") returned 6 [0056.676] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.677] lstrlenA (lpString="*.mpg") returned 5 [0056.677] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.677] lstrlenA (lpString="*.flv") returned 5 [0056.677] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.677] lstrlenA (lpString="*.avi") returned 5 [0056.677] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.677] lstrlenA (lpString="*.mp4") returned 5 [0056.677] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.677] lstrlenA (lpString="*.wmv") returned 5 [0056.677] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.677] lstrlenA (lpString="*.divx") returned 6 [0056.677] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.677] lstrlenA (lpString="*.mkv") returned 5 [0056.677] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.677] lstrlenA (lpString="*.mp3") returned 5 [0056.677] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.677] lstrlenA (lpString="*.wav") returned 5 [0056.677] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.677] lstrlenA (lpString="*.flac") returned 6 [0056.677] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.677] lstrlenA (lpString="*.ape") returned 5 [0056.677] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.677] lstrlenA (lpString="*.wma") returned 5 [0056.677] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.677] lstrlenA (lpString="*.ac3") returned 5 [0056.677] FindNextFileA (in: hFindFile=0x636470, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0056.677] FindClose (in: hFindFile=0x636470 | out: hFindFile=0x636470) returned 1 [0056.678] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0056.678] lstrcmpA (lpString1=".", lpString2="lv-LV") returned -1 [0056.678] lstrcmpA (lpString1="..", lpString2="lv-LV") returned -1 [0056.678] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.678] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="lv-LV" | out: lpString1="C:\\Boot\\lv-LV") returned="C:\\Boot\\lv-LV" [0056.678] lstrlenA (lpString="C:\\Boot\\lv-LV") returned 13 [0056.678] FindFirstFileA (in: lpFileName="C:\\Boot\\lv-LV\\*.*" (normalized: "c:\\boot\\lv-lv\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636470 [0056.678] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.678] FindNextFileA (in: hFindFile=0x636470, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.678] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.678] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.678] FindNextFileA (in: hFindFile=0x636470, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.678] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.678] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.678] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.678] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.678] PathFindFileNameA (pszPath="C:\\Boot\\lv-LV\\*.*") returned="*.*" [0056.678] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\lv-LV\\" | out: lpString1="C:\\Boot\\lv-LV\\") returned="C:\\Boot\\lv-LV\\" [0056.678] PathAddBackslashA (in: pszPath="C:\\Boot\\lv-LV\\" | out: pszPath="C:\\Boot\\lv-LV\\") returned="" [0056.678] lstrcatA (in: lpString1="C:\\Boot\\lv-LV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\lv-LV\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\lv-LV\\HOW TO DECRYPT FILES.txt" [0056.678] GetFileAttributesA (lpFileName="C:\\Boot\\lv-LV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\lv-lv\\how to decrypt files.txt")) returned 0xffffffff [0056.679] CreateFileA (lpFileName="C:\\Boot\\lv-LV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\lv-lv\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.679] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.679] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.683] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.683] CloseHandle (hObject=0x1c4) returned 1 [0056.683] lstrcatA (in: lpString1="C:\\Boot\\lv-LV\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned="C:\\Boot\\lv-LV\\bootmgr.exe.mui" [0056.683] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.683] lstrlenA (lpString="*.zip") returned 5 [0056.683] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.683] lstrlenA (lpString="*.rar") returned 5 [0056.683] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.683] lstrlenA (lpString="*.7z") returned 4 [0056.683] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.683] lstrlenA (lpString="*.tar") returned 5 [0056.683] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.683] lstrlenA (lpString="*.gzip") returned 6 [0056.684] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.684] lstrlenA (lpString="*.jpg") returned 5 [0056.684] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.684] lstrlenA (lpString="*.jpeg") returned 6 [0056.684] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.684] lstrlenA (lpString="*.psd") returned 5 [0056.684] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.684] lstrlenA (lpString="*.cdr") returned 5 [0056.684] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.684] lstrlenA (lpString="*.dwg") returned 5 [0056.684] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.684] lstrlenA (lpString="*.max") returned 5 [0056.684] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.684] lstrlenA (lpString="*.bmp") returned 5 [0056.684] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.684] lstrlenA (lpString="*.gif") returned 5 [0056.684] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.684] lstrlenA (lpString="*.png") returned 5 [0056.684] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.684] lstrlenA (lpString="*.doc") returned 5 [0056.684] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.684] lstrlenA (lpString="*.docx") returned 6 [0056.684] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.684] lstrlenA (lpString="*.xls") returned 5 [0056.684] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.684] lstrlenA (lpString="*.xlsx") returned 6 [0056.684] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.684] lstrlenA (lpString="*.ppt") returned 5 [0056.684] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.684] lstrlenA (lpString="*.pptx") returned 6 [0056.684] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.684] lstrlenA (lpString="*.txt") returned 5 [0056.684] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.684] lstrlenA (lpString="*.pdf") returned 5 [0056.685] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.685] lstrlenA (lpString="*.djvu") returned 6 [0056.685] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.685] lstrlenA (lpString="*.htm") returned 5 [0056.685] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.685] lstrlenA (lpString="*.html") returned 6 [0056.685] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.685] lstrlenA (lpString="*.mdb") returned 5 [0056.685] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.685] lstrlenA (lpString="*.cer") returned 5 [0056.685] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.685] lstrlenA (lpString="*.p12") returned 5 [0056.685] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.685] lstrlenA (lpString="*.pfx") returned 5 [0056.685] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.685] lstrlenA (lpString="*.kwm") returned 5 [0056.685] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.685] lstrlenA (lpString="*.pwm") returned 5 [0056.685] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.685] lstrlenA (lpString="*.1cd") returned 5 [0056.685] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.685] lstrlenA (lpString="*.md") returned 4 [0056.685] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.685] lstrlenA (lpString="*.mdf") returned 5 [0056.685] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.685] lstrlenA (lpString="*.dbf") returned 5 [0056.685] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.685] lstrlenA (lpString="*.odt") returned 5 [0056.685] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.685] lstrlenA (lpString="*.vob") returned 5 [0056.685] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.685] lstrlenA (lpString="*.ifo") returned 5 [0056.685] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.686] lstrlenA (lpString="*.lnk") returned 5 [0056.686] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.686] lstrlenA (lpString="*.torrent") returned 9 [0056.686] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.686] lstrlenA (lpString="*.mov") returned 5 [0056.686] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.686] lstrlenA (lpString="*.m2v") returned 5 [0056.686] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.686] lstrlenA (lpString="*.3gp") returned 5 [0056.686] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.686] lstrlenA (lpString="*.mpeg") returned 6 [0056.686] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.686] lstrlenA (lpString="*.mpg") returned 5 [0056.686] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.686] lstrlenA (lpString="*.flv") returned 5 [0056.686] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.686] lstrlenA (lpString="*.avi") returned 5 [0056.686] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.686] lstrlenA (lpString="*.mp4") returned 5 [0056.686] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.686] lstrlenA (lpString="*.wmv") returned 5 [0056.686] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.686] lstrlenA (lpString="*.divx") returned 6 [0056.686] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.686] lstrlenA (lpString="*.mkv") returned 5 [0056.686] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.686] lstrlenA (lpString="*.mp3") returned 5 [0056.686] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.686] lstrlenA (lpString="*.wav") returned 5 [0056.686] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.686] lstrlenA (lpString="*.flac") returned 6 [0056.686] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.686] lstrlenA (lpString="*.ape") returned 5 [0056.687] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.687] lstrlenA (lpString="*.wma") returned 5 [0056.687] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.687] lstrlenA (lpString="*.ac3") returned 5 [0056.687] FindNextFileA (in: hFindFile=0x636470, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0056.687] FindClose (in: hFindFile=0x636470 | out: hFindFile=0x636470) returned 1 [0056.687] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc2960, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0056.687] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0056.687] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe") returned -1 [0056.687] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe") returned -1 [0056.687] lstrcmpiA (lpString1="", lpString2="memtest.exe") returned -1 [0056.687] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.687] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0056.687] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned="" [0056.687] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt" [0056.687] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20 [0056.687] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="memtest.exe" | out: lpString1="C:\\Boot\\memtest.exe") returned="C:\\Boot\\memtest.exe" [0056.687] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.zip") returned 0 [0056.687] lstrlenA (lpString="*.zip") returned 5 [0056.687] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.rar") returned 0 [0056.687] lstrlenA (lpString="*.rar") returned 5 [0056.687] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.7z") returned 0 [0056.687] lstrlenA (lpString="*.7z") returned 4 [0056.687] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.tar") returned 0 [0056.687] lstrlenA (lpString="*.tar") returned 5 [0056.687] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.gzip") returned 0 [0056.687] lstrlenA (lpString="*.gzip") returned 6 [0056.688] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.jpg") returned 0 [0056.688] lstrlenA (lpString="*.jpg") returned 5 [0056.688] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.jpeg") returned 0 [0056.688] lstrlenA (lpString="*.jpeg") returned 6 [0056.688] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.psd") returned 0 [0056.688] lstrlenA (lpString="*.psd") returned 5 [0056.688] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.cdr") returned 0 [0056.688] lstrlenA (lpString="*.cdr") returned 5 [0056.688] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.dwg") returned 0 [0056.688] lstrlenA (lpString="*.dwg") returned 5 [0056.688] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.max") returned 0 [0056.688] lstrlenA (lpString="*.max") returned 5 [0056.688] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.bmp") returned 0 [0056.688] lstrlenA (lpString="*.bmp") returned 5 [0056.688] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.gif") returned 0 [0056.688] lstrlenA (lpString="*.gif") returned 5 [0056.688] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.png") returned 0 [0056.688] lstrlenA (lpString="*.png") returned 5 [0056.688] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.doc") returned 0 [0056.688] lstrlenA (lpString="*.doc") returned 5 [0056.688] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.docx") returned 0 [0056.688] lstrlenA (lpString="*.docx") returned 6 [0056.688] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.xls") returned 0 [0056.688] lstrlenA (lpString="*.xls") returned 5 [0056.688] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.xlsx") returned 0 [0056.688] lstrlenA (lpString="*.xlsx") returned 6 [0056.688] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.ppt") returned 0 [0056.688] lstrlenA (lpString="*.ppt") returned 5 [0056.688] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.pptx") returned 0 [0056.688] lstrlenA (lpString="*.pptx") returned 6 [0056.688] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.txt") returned 0 [0056.688] lstrlenA (lpString="*.txt") returned 5 [0056.688] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.pdf") returned 0 [0056.688] lstrlenA (lpString="*.pdf") returned 5 [0056.689] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.djvu") returned 0 [0056.689] lstrlenA (lpString="*.djvu") returned 6 [0056.689] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.htm") returned 0 [0056.689] lstrlenA (lpString="*.htm") returned 5 [0056.689] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.html") returned 0 [0056.689] lstrlenA (lpString="*.html") returned 6 [0056.689] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mdb") returned 0 [0056.689] lstrlenA (lpString="*.mdb") returned 5 [0056.689] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.cer") returned 0 [0056.689] lstrlenA (lpString="*.cer") returned 5 [0056.689] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.p12") returned 0 [0056.689] lstrlenA (lpString="*.p12") returned 5 [0056.689] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.pfx") returned 0 [0056.689] lstrlenA (lpString="*.pfx") returned 5 [0056.689] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.kwm") returned 0 [0056.689] lstrlenA (lpString="*.kwm") returned 5 [0056.689] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.pwm") returned 0 [0056.689] lstrlenA (lpString="*.pwm") returned 5 [0056.689] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.1cd") returned 0 [0056.689] lstrlenA (lpString="*.1cd") returned 5 [0056.689] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.md") returned 0 [0056.689] lstrlenA (lpString="*.md") returned 4 [0056.689] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mdf") returned 0 [0056.689] lstrlenA (lpString="*.mdf") returned 5 [0056.689] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.dbf") returned 0 [0056.689] lstrlenA (lpString="*.dbf") returned 5 [0056.689] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.odt") returned 0 [0056.689] lstrlenA (lpString="*.odt") returned 5 [0056.689] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.vob") returned 0 [0056.689] lstrlenA (lpString="*.vob") returned 5 [0056.689] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.ifo") returned 0 [0056.689] lstrlenA (lpString="*.ifo") returned 5 [0056.689] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.lnk") returned 0 [0056.689] lstrlenA (lpString="*.lnk") returned 5 [0056.689] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.torrent") returned 0 [0056.690] lstrlenA (lpString="*.torrent") returned 9 [0056.690] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mov") returned 0 [0056.690] lstrlenA (lpString="*.mov") returned 5 [0056.690] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.m2v") returned 0 [0056.690] lstrlenA (lpString="*.m2v") returned 5 [0056.690] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.3gp") returned 0 [0056.690] lstrlenA (lpString="*.3gp") returned 5 [0056.690] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mpeg") returned 0 [0056.690] lstrlenA (lpString="*.mpeg") returned 6 [0056.690] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mpg") returned 0 [0056.690] lstrlenA (lpString="*.mpg") returned 5 [0056.690] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.flv") returned 0 [0056.690] lstrlenA (lpString="*.flv") returned 5 [0056.690] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.avi") returned 0 [0056.690] lstrlenA (lpString="*.avi") returned 5 [0056.690] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mp4") returned 0 [0056.690] lstrlenA (lpString="*.mp4") returned 5 [0056.690] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.wmv") returned 0 [0056.690] lstrlenA (lpString="*.wmv") returned 5 [0056.690] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.divx") returned 0 [0056.690] lstrlenA (lpString="*.divx") returned 6 [0056.690] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mkv") returned 0 [0056.690] lstrlenA (lpString="*.mkv") returned 5 [0056.690] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mp3") returned 0 [0056.690] lstrlenA (lpString="*.mp3") returned 5 [0056.690] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.wav") returned 0 [0056.690] lstrlenA (lpString="*.wav") returned 5 [0056.690] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.flac") returned 0 [0056.690] lstrlenA (lpString="*.flac") returned 6 [0056.690] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.ape") returned 0 [0056.690] lstrlenA (lpString="*.ape") returned 5 [0056.690] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.wma") returned 0 [0056.690] lstrlenA (lpString="*.wma") returned 5 [0056.690] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.ac3") returned 0 [0056.690] lstrlenA (lpString="*.ac3") returned 5 [0056.691] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0056.691] lstrcmpA (lpString1=".", lpString2="nb-NO") returned -1 [0056.691] lstrcmpA (lpString1="..", lpString2="nb-NO") returned -1 [0056.691] PathFindFileNameA (pszPath="C:\\Boot\\memtest.exe") returned="memtest.exe" [0056.691] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="nb-NO" | out: lpString1="C:\\Boot\\nb-NO") returned="C:\\Boot\\nb-NO" [0056.691] lstrlenA (lpString="C:\\Boot\\nb-NO") returned 13 [0056.691] FindFirstFileA (in: lpFileName="C:\\Boot\\nb-NO\\*.*" (normalized: "c:\\boot\\nb-no\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0x4a, cFileName=".", cAlternateFileName="")) returned 0x636b70 [0056.702] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.702] FindNextFileA (in: hFindFile=0x636b70, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0x4a, cFileName="..", cAlternateFileName="")) returned 1 [0056.702] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.702] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.702] FindNextFileA (in: hFindFile=0x636b70, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x77792cf0, dwReserved1=0x4a, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.702] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.702] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.702] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.702] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.703] PathFindFileNameA (pszPath="C:\\Boot\\nb-NO\\*.*") returned="*.*" [0056.703] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\nb-NO\\" | out: lpString1="C:\\Boot\\nb-NO\\") returned="C:\\Boot\\nb-NO\\" [0056.703] PathAddBackslashA (in: pszPath="C:\\Boot\\nb-NO\\" | out: pszPath="C:\\Boot\\nb-NO\\") returned="" [0056.703] lstrcatA (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\nb-NO\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\nb-NO\\HOW TO DECRYPT FILES.txt" [0056.703] GetFileAttributesA (lpFileName="C:\\Boot\\nb-NO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\nb-no\\how to decrypt files.txt")) returned 0xffffffff [0056.709] CreateFileA (lpFileName="C:\\Boot\\nb-NO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\nb-no\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.713] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.713] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.726] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.726] CloseHandle (hObject=0x1c4) returned 1 [0056.726] lstrcatA (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned="C:\\Boot\\nb-NO\\bootmgr.exe.mui" [0056.727] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.727] lstrlenA (lpString="*.zip") returned 5 [0056.727] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.727] lstrlenA (lpString="*.rar") returned 5 [0056.727] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.727] lstrlenA (lpString="*.7z") returned 4 [0056.727] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.727] lstrlenA (lpString="*.tar") returned 5 [0056.727] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.727] lstrlenA (lpString="*.gzip") returned 6 [0056.727] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.727] lstrlenA (lpString="*.jpg") returned 5 [0056.727] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.727] lstrlenA (lpString="*.jpeg") returned 6 [0056.727] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.727] lstrlenA (lpString="*.psd") returned 5 [0056.727] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.727] lstrlenA (lpString="*.cdr") returned 5 [0056.727] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.727] lstrlenA (lpString="*.dwg") returned 5 [0056.727] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.727] lstrlenA (lpString="*.max") returned 5 [0056.727] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.727] lstrlenA (lpString="*.bmp") returned 5 [0056.727] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.727] lstrlenA (lpString="*.gif") returned 5 [0056.727] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.727] lstrlenA (lpString="*.png") returned 5 [0056.728] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.728] lstrlenA (lpString="*.doc") returned 5 [0056.728] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.728] lstrlenA (lpString="*.docx") returned 6 [0056.728] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.728] lstrlenA (lpString="*.xls") returned 5 [0056.728] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.728] lstrlenA (lpString="*.xlsx") returned 6 [0056.728] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.728] lstrlenA (lpString="*.ppt") returned 5 [0056.728] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.728] lstrlenA (lpString="*.pptx") returned 6 [0056.728] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.728] lstrlenA (lpString="*.txt") returned 5 [0056.728] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.728] lstrlenA (lpString="*.pdf") returned 5 [0056.728] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.728] lstrlenA (lpString="*.djvu") returned 6 [0056.728] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.728] lstrlenA (lpString="*.htm") returned 5 [0056.728] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.728] lstrlenA (lpString="*.html") returned 6 [0056.728] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.728] lstrlenA (lpString="*.mdb") returned 5 [0056.728] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.728] lstrlenA (lpString="*.cer") returned 5 [0056.728] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.728] lstrlenA (lpString="*.p12") returned 5 [0056.728] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.728] lstrlenA (lpString="*.pfx") returned 5 [0056.729] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.729] lstrlenA (lpString="*.kwm") returned 5 [0056.729] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.729] lstrlenA (lpString="*.pwm") returned 5 [0056.729] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.729] lstrlenA (lpString="*.1cd") returned 5 [0056.729] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.729] lstrlenA (lpString="*.md") returned 4 [0056.729] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.729] lstrlenA (lpString="*.mdf") returned 5 [0056.729] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.729] lstrlenA (lpString="*.dbf") returned 5 [0056.729] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.729] lstrlenA (lpString="*.odt") returned 5 [0056.729] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.729] lstrlenA (lpString="*.vob") returned 5 [0056.729] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.729] lstrlenA (lpString="*.ifo") returned 5 [0056.729] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.729] lstrlenA (lpString="*.lnk") returned 5 [0056.729] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.729] lstrlenA (lpString="*.torrent") returned 9 [0056.729] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.729] lstrlenA (lpString="*.mov") returned 5 [0056.729] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.729] lstrlenA (lpString="*.m2v") returned 5 [0056.729] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.729] lstrlenA (lpString="*.3gp") returned 5 [0056.729] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.729] lstrlenA (lpString="*.mpeg") returned 6 [0056.730] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.730] lstrlenA (lpString="*.mpg") returned 5 [0056.730] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.730] lstrlenA (lpString="*.flv") returned 5 [0056.730] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.730] lstrlenA (lpString="*.avi") returned 5 [0056.730] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.730] lstrlenA (lpString="*.mp4") returned 5 [0056.730] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.730] lstrlenA (lpString="*.wmv") returned 5 [0056.730] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.730] lstrlenA (lpString="*.divx") returned 6 [0056.730] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.730] lstrlenA (lpString="*.mkv") returned 5 [0056.730] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.730] lstrlenA (lpString="*.mp3") returned 5 [0056.731] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.731] lstrlenA (lpString="*.wav") returned 5 [0056.731] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.731] lstrlenA (lpString="*.flac") returned 6 [0056.731] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.731] lstrlenA (lpString="*.ape") returned 5 [0056.731] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.731] lstrlenA (lpString="*.wma") returned 5 [0056.731] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.731] lstrlenA (lpString="*.ac3") returned 5 [0056.731] FindNextFileA (in: hFindFile=0x636b70, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.731] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.731] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0056.731] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0056.731] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0056.731] PathFindFileNameA (pszPath="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0056.731] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\nb-NO\\" | out: lpString1="C:\\Boot\\nb-NO\\") returned="C:\\Boot\\nb-NO\\" [0056.731] PathAddBackslashA (in: pszPath="C:\\Boot\\nb-NO\\" | out: pszPath="C:\\Boot\\nb-NO\\") returned="" [0056.731] lstrcatA (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\nb-NO\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\nb-NO\\HOW TO DECRYPT FILES.txt" [0056.731] GetFileAttributesA (lpFileName="C:\\Boot\\nb-NO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\nb-no\\how to decrypt files.txt")) returned 0x20 [0056.731] lstrcatA (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\nb-NO\\memtest.exe.mui") returned="C:\\Boot\\nb-NO\\memtest.exe.mui" [0056.731] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0056.732] lstrlenA (lpString="*.zip") returned 5 [0056.732] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0056.732] lstrlenA (lpString="*.rar") returned 5 [0056.732] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0056.732] lstrlenA (lpString="*.7z") returned 4 [0056.732] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0056.732] lstrlenA (lpString="*.tar") returned 5 [0056.732] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0056.732] lstrlenA (lpString="*.gzip") returned 6 [0056.732] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0056.732] lstrlenA (lpString="*.jpg") returned 5 [0056.732] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0056.732] lstrlenA (lpString="*.jpeg") returned 6 [0056.732] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0056.732] lstrlenA (lpString="*.psd") returned 5 [0056.732] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0056.732] lstrlenA (lpString="*.cdr") returned 5 [0056.732] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0056.732] lstrlenA (lpString="*.dwg") returned 5 [0056.732] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.max") returned 0 [0056.732] lstrlenA (lpString="*.max") returned 5 [0056.732] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0056.732] lstrlenA (lpString="*.bmp") returned 5 [0056.732] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0056.732] lstrlenA (lpString="*.gif") returned 5 [0056.732] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.png") returned 0 [0056.732] lstrlenA (lpString="*.png") returned 5 [0056.732] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0056.732] lstrlenA (lpString="*.doc") returned 5 [0056.732] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0056.732] lstrlenA (lpString="*.docx") returned 6 [0056.732] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0056.733] lstrlenA (lpString="*.xls") returned 5 [0056.733] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0056.733] lstrlenA (lpString="*.xlsx") returned 6 [0056.733] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0056.733] lstrlenA (lpString="*.ppt") returned 5 [0056.733] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0056.733] lstrlenA (lpString="*.pptx") returned 6 [0056.733] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0056.733] lstrlenA (lpString="*.txt") returned 5 [0056.733] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0056.733] lstrlenA (lpString="*.pdf") returned 5 [0056.733] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0056.733] lstrlenA (lpString="*.djvu") returned 6 [0056.733] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0056.733] lstrlenA (lpString="*.htm") returned 5 [0056.733] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.html") returned 0 [0056.733] lstrlenA (lpString="*.html") returned 6 [0056.733] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0056.733] lstrlenA (lpString="*.mdb") returned 5 [0056.733] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0056.733] lstrlenA (lpString="*.cer") returned 5 [0056.733] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0056.733] lstrlenA (lpString="*.p12") returned 5 [0056.733] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0056.733] lstrlenA (lpString="*.pfx") returned 5 [0056.733] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0056.733] lstrlenA (lpString="*.kwm") returned 5 [0056.734] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0056.734] lstrlenA (lpString="*.pwm") returned 5 [0056.734] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0056.734] lstrlenA (lpString="*.1cd") returned 5 [0056.734] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.md") returned 0 [0056.734] lstrlenA (lpString="*.md") returned 4 [0056.734] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0056.734] lstrlenA (lpString="*.mdf") returned 5 [0056.734] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0056.734] lstrlenA (lpString="*.dbf") returned 5 [0056.734] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0056.734] lstrlenA (lpString="*.odt") returned 5 [0056.734] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0056.734] lstrlenA (lpString="*.vob") returned 5 [0056.734] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0056.734] lstrlenA (lpString="*.ifo") returned 5 [0056.734] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0056.734] lstrlenA (lpString="*.lnk") returned 5 [0056.734] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0056.734] lstrlenA (lpString="*.torrent") returned 9 [0056.734] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0056.734] lstrlenA (lpString="*.mov") returned 5 [0056.734] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0056.734] lstrlenA (lpString="*.m2v") returned 5 [0056.734] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0056.734] lstrlenA (lpString="*.3gp") returned 5 [0056.734] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0056.734] lstrlenA (lpString="*.mpeg") returned 6 [0056.734] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0056.734] lstrlenA (lpString="*.mpg") returned 5 [0056.734] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0056.735] lstrlenA (lpString="*.flv") returned 5 [0056.735] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0056.735] lstrlenA (lpString="*.avi") returned 5 [0056.735] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0056.735] lstrlenA (lpString="*.mp4") returned 5 [0056.735] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0056.735] lstrlenA (lpString="*.wmv") returned 5 [0056.735] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0056.735] lstrlenA (lpString="*.divx") returned 6 [0056.735] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0056.735] lstrlenA (lpString="*.mkv") returned 5 [0056.735] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0056.735] lstrlenA (lpString="*.mp3") returned 5 [0056.735] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0056.735] lstrlenA (lpString="*.wav") returned 5 [0056.735] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0056.735] lstrlenA (lpString="*.flac") returned 6 [0056.735] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0056.735] lstrlenA (lpString="*.ape") returned 5 [0056.735] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0056.735] lstrlenA (lpString="*.wma") returned 5 [0056.735] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0056.735] lstrlenA (lpString="*.ac3") returned 5 [0056.735] FindNextFileA (in: hFindFile=0x636b70, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0056.735] FindClose (in: hFindFile=0x636b70 | out: hFindFile=0x636b70) returned 1 [0056.736] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0056.736] lstrcmpA (lpString1=".", lpString2="nl-NL") returned -1 [0056.736] lstrcmpA (lpString1="..", lpString2="nl-NL") returned -1 [0056.736] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.736] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="nl-NL" | out: lpString1="C:\\Boot\\nl-NL") returned="C:\\Boot\\nl-NL" [0056.736] lstrlenA (lpString="C:\\Boot\\nl-NL") returned 13 [0056.736] FindFirstFileA (in: lpFileName="C:\\Boot\\nl-NL\\*.*" (normalized: "c:\\boot\\nl-nl\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6364f0 [0056.737] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.737] FindNextFileA (in: hFindFile=0x6364f0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.737] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.737] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.737] FindNextFileA (in: hFindFile=0x6364f0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.737] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.737] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.737] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.737] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.737] PathFindFileNameA (pszPath="C:\\Boot\\nl-NL\\*.*") returned="*.*" [0056.737] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\nl-NL\\" | out: lpString1="C:\\Boot\\nl-NL\\") returned="C:\\Boot\\nl-NL\\" [0056.737] PathAddBackslashA (in: pszPath="C:\\Boot\\nl-NL\\" | out: pszPath="C:\\Boot\\nl-NL\\") returned="" [0056.737] lstrcatA (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\nl-NL\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\nl-NL\\HOW TO DECRYPT FILES.txt" [0056.737] GetFileAttributesA (lpFileName="C:\\Boot\\nl-NL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\nl-nl\\how to decrypt files.txt")) returned 0xffffffff [0056.738] CreateFileA (lpFileName="C:\\Boot\\nl-NL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\nl-nl\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.739] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.739] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.740] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.740] CloseHandle (hObject=0x1c4) returned 1 [0056.740] lstrcatA (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned="C:\\Boot\\nl-NL\\bootmgr.exe.mui" [0056.740] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.740] lstrlenA (lpString="*.zip") returned 5 [0056.741] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.741] lstrlenA (lpString="*.rar") returned 5 [0056.741] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.741] lstrlenA (lpString="*.7z") returned 4 [0056.741] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.741] lstrlenA (lpString="*.tar") returned 5 [0056.741] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.741] lstrlenA (lpString="*.gzip") returned 6 [0056.741] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.741] lstrlenA (lpString="*.jpg") returned 5 [0056.741] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.741] lstrlenA (lpString="*.jpeg") returned 6 [0056.741] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.741] lstrlenA (lpString="*.psd") returned 5 [0056.741] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.741] lstrlenA (lpString="*.cdr") returned 5 [0056.741] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.741] lstrlenA (lpString="*.dwg") returned 5 [0056.741] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.741] lstrlenA (lpString="*.max") returned 5 [0056.741] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.741] lstrlenA (lpString="*.bmp") returned 5 [0056.741] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.741] lstrlenA (lpString="*.gif") returned 5 [0056.741] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.741] lstrlenA (lpString="*.png") returned 5 [0056.741] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.741] lstrlenA (lpString="*.doc") returned 5 [0056.741] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.741] lstrlenA (lpString="*.docx") returned 6 [0056.741] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.742] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.742] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.742] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.742] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.742] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.742] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.742] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.742] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.742] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.742] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.742] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.742] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.742] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.742] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.742] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.742] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.742] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.742] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.742] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.742] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.742] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.742] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.742] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.742] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.743] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.743] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.743] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.743] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.743] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.743] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.743] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.743] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.743] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.743] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.743] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.743] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.743] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.743] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.743] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.743] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.743] FindNextFileA (in: hFindFile=0x6364f0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb158, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.743] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.743] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0056.743] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0056.743] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0056.743] PathFindFileNameA (pszPath="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0056.743] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\nl-NL\\" | out: lpString1="C:\\Boot\\nl-NL\\") returned="C:\\Boot\\nl-NL\\" [0056.743] PathAddBackslashA (in: pszPath="C:\\Boot\\nl-NL\\" | out: pszPath="C:\\Boot\\nl-NL\\") returned="" [0056.743] lstrcatA (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\nl-NL\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\nl-NL\\HOW TO DECRYPT FILES.txt" [0056.743] GetFileAttributesA (lpFileName="C:\\Boot\\nl-NL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\nl-nl\\how to decrypt files.txt")) returned 0x20 [0056.744] lstrcatA (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\nl-NL\\memtest.exe.mui") returned="C:\\Boot\\nl-NL\\memtest.exe.mui" [0056.744] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0056.744] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0056.744] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0056.744] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0056.744] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0056.744] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0056.744] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0056.744] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0056.744] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0056.744] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0056.744] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.max") returned 0 [0056.744] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0056.744] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0056.744] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.png") returned 0 [0056.744] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0056.744] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0056.744] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0056.744] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0056.744] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0056.744] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0056.744] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0056.744] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0056.745] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0056.745] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0056.745] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.html") returned 0 [0056.745] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0056.745] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0056.745] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0056.745] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0056.745] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0056.745] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0056.745] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0056.745] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.md") returned 0 [0056.745] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0056.745] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0056.745] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0056.745] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0056.745] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0056.745] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0056.745] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0056.745] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0056.745] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0056.745] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0056.745] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0056.745] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0056.745] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0056.746] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0056.746] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0056.746] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0056.746] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0056.746] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0056.746] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0056.746] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0056.746] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0056.746] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0056.746] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0056.746] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0056.746] FindNextFileA (in: hFindFile=0x6364f0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb158, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0056.746] FindClose (in: hFindFile=0x6364f0 | out: hFindFile=0x6364f0) returned 1 [0056.746] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0056.746] lstrcmpA (lpString1=".", lpString2="pl-PL") returned -1 [0056.746] lstrcmpA (lpString1="..", lpString2="pl-PL") returned -1 [0056.746] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.746] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="pl-PL" | out: lpString1="C:\\Boot\\pl-PL") returned="C:\\Boot\\pl-PL" [0056.746] FindFirstFileA (in: lpFileName="C:\\Boot\\pl-PL\\*.*" (normalized: "c:\\boot\\pl-pl\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636930 [0056.747] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.747] FindNextFileA (in: hFindFile=0x636930, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.747] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.747] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.747] FindNextFileA (in: hFindFile=0x636930, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.747] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.747] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.747] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.747] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.747] PathFindFileNameA (pszPath="C:\\Boot\\pl-PL\\*.*") returned="*.*" [0056.747] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\pl-PL\\" | out: lpString1="C:\\Boot\\pl-PL\\") returned="C:\\Boot\\pl-PL\\" [0056.747] PathAddBackslashA (in: pszPath="C:\\Boot\\pl-PL\\" | out: pszPath="C:\\Boot\\pl-PL\\") returned="" [0056.748] lstrcatA (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\pl-PL\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\pl-PL\\HOW TO DECRYPT FILES.txt" [0056.748] GetFileAttributesA (lpFileName="C:\\Boot\\pl-PL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pl-pl\\how to decrypt files.txt")) returned 0xffffffff [0056.748] CreateFileA (lpFileName="C:\\Boot\\pl-PL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pl-pl\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.750] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.751] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.751] CloseHandle (hObject=0x1c4) returned 1 [0056.751] lstrcatA (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned="C:\\Boot\\pl-PL\\bootmgr.exe.mui" [0056.751] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.751] lstrlenA (lpString="*.zip") returned 5 [0056.751] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.751] lstrlenA (lpString="*.rar") returned 5 [0056.751] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.751] lstrlenA (lpString="*.7z") returned 4 [0056.751] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.751] lstrlenA (lpString="*.tar") returned 5 [0056.751] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.751] lstrlenA (lpString="*.gzip") returned 6 [0056.751] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.751] lstrlenA (lpString="*.jpg") returned 5 [0056.751] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.751] lstrlenA (lpString="*.jpeg") returned 6 [0056.751] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.751] lstrlenA (lpString="*.psd") returned 5 [0056.751] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.751] lstrlenA (lpString="*.cdr") returned 5 [0056.751] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.751] lstrlenA (lpString="*.dwg") returned 5 [0056.752] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.752] lstrlenA (lpString="*.max") returned 5 [0056.752] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.752] lstrlenA (lpString="*.bmp") returned 5 [0056.752] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.752] lstrlenA (lpString="*.gif") returned 5 [0056.752] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.752] lstrlenA (lpString="*.png") returned 5 [0056.752] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.752] lstrlenA (lpString="*.doc") returned 5 [0056.752] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.752] lstrlenA (lpString="*.docx") returned 6 [0056.752] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.752] lstrlenA (lpString="*.xls") returned 5 [0056.752] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.752] lstrlenA (lpString="*.xlsx") returned 6 [0056.752] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.752] lstrlenA (lpString="*.ppt") returned 5 [0056.752] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.752] lstrlenA (lpString="*.pptx") returned 6 [0056.752] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.752] lstrlenA (lpString="*.txt") returned 5 [0056.752] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.753] lstrlenA (lpString="*.pdf") returned 5 [0056.753] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.753] lstrlenA (lpString="*.djvu") returned 6 [0056.753] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.753] lstrlenA (lpString="*.htm") returned 5 [0056.753] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.753] lstrlenA (lpString="*.html") returned 6 [0056.753] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.753] lstrlenA (lpString="*.mdb") returned 5 [0056.753] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.753] lstrlenA (lpString="*.cer") returned 5 [0056.753] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.753] lstrlenA (lpString="*.p12") returned 5 [0056.753] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.753] lstrlenA (lpString="*.pfx") returned 5 [0056.753] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.753] lstrlenA (lpString="*.kwm") returned 5 [0056.753] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.753] lstrlenA (lpString="*.pwm") returned 5 [0056.753] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.753] lstrlenA (lpString="*.1cd") returned 5 [0056.753] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.753] lstrlenA (lpString="*.md") returned 4 [0056.753] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.753] lstrlenA (lpString="*.mdf") returned 5 [0056.753] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.753] lstrlenA (lpString="*.dbf") returned 5 [0056.753] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.753] lstrlenA (lpString="*.odt") returned 5 [0056.753] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.753] lstrlenA (lpString="*.vob") returned 5 [0056.753] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.753] lstrlenA (lpString="*.ifo") returned 5 [0056.753] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.753] lstrlenA (lpString="*.lnk") returned 5 [0056.753] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.754] lstrlenA (lpString="*.torrent") returned 9 [0056.754] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.754] lstrlenA (lpString="*.mov") returned 5 [0056.754] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.754] lstrlenA (lpString="*.m2v") returned 5 [0056.754] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.754] lstrlenA (lpString="*.3gp") returned 5 [0056.754] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.754] lstrlenA (lpString="*.mpeg") returned 6 [0056.754] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.754] lstrlenA (lpString="*.mpg") returned 5 [0056.754] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.754] lstrlenA (lpString="*.flv") returned 5 [0056.754] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.754] lstrlenA (lpString="*.avi") returned 5 [0056.754] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.754] lstrlenA (lpString="*.mp4") returned 5 [0056.754] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.754] lstrlenA (lpString="*.wmv") returned 5 [0056.754] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.754] lstrlenA (lpString="*.divx") returned 6 [0056.754] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.754] lstrlenA (lpString="*.mkv") returned 5 [0056.754] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.754] lstrlenA (lpString="*.mp3") returned 5 [0056.754] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.754] lstrlenA (lpString="*.wav") returned 5 [0056.754] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.754] lstrlenA (lpString="*.flac") returned 6 [0056.754] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.754] lstrlenA (lpString="*.ape") returned 5 [0056.754] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.754] lstrlenA (lpString="*.wma") returned 5 [0056.754] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.754] lstrlenA (lpString="*.ac3") returned 5 [0056.755] FindNextFileA (in: hFindFile=0x636930, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.755] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.755] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0056.755] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0056.755] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0056.755] PathFindFileNameA (pszPath="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0056.755] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\pl-PL\\" | out: lpString1="C:\\Boot\\pl-PL\\") returned="C:\\Boot\\pl-PL\\" [0056.755] PathAddBackslashA (in: pszPath="C:\\Boot\\pl-PL\\" | out: pszPath="C:\\Boot\\pl-PL\\") returned="" [0056.755] lstrcatA (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\pl-PL\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\pl-PL\\HOW TO DECRYPT FILES.txt" [0056.755] GetFileAttributesA (lpFileName="C:\\Boot\\pl-PL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pl-pl\\how to decrypt files.txt")) returned 0x20 [0056.755] lstrcatA (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\pl-PL\\memtest.exe.mui") returned="C:\\Boot\\pl-PL\\memtest.exe.mui" [0056.755] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0056.755] lstrlenA (lpString="*.zip") returned 5 [0056.755] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0056.755] lstrlenA (lpString="*.rar") returned 5 [0056.755] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0056.755] lstrlenA (lpString="*.7z") returned 4 [0056.755] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0056.755] lstrlenA (lpString="*.tar") returned 5 [0056.755] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0056.755] lstrlenA (lpString="*.gzip") returned 6 [0056.755] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0056.755] lstrlenA (lpString="*.jpg") returned 5 [0056.755] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0056.755] lstrlenA (lpString="*.jpeg") returned 6 [0056.755] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0056.755] lstrlenA (lpString="*.psd") returned 5 [0056.755] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0056.755] lstrlenA (lpString="*.cdr") returned 5 [0056.755] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0056.756] lstrlenA (lpString="*.dwg") returned 5 [0056.756] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.max") returned 0 [0056.756] lstrlenA (lpString="*.max") returned 5 [0056.756] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0056.756] lstrlenA (lpString="*.bmp") returned 5 [0056.756] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0056.756] lstrlenA (lpString="*.gif") returned 5 [0056.756] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.png") returned 0 [0056.756] lstrlenA (lpString="*.png") returned 5 [0056.756] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0056.756] lstrlenA (lpString="*.doc") returned 5 [0056.756] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0056.756] lstrlenA (lpString="*.docx") returned 6 [0056.756] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0056.756] lstrlenA (lpString="*.xls") returned 5 [0056.756] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0056.756] lstrlenA (lpString="*.xlsx") returned 6 [0056.756] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0056.756] lstrlenA (lpString="*.ppt") returned 5 [0056.756] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0056.756] lstrlenA (lpString="*.pptx") returned 6 [0056.756] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0056.756] lstrlenA (lpString="*.txt") returned 5 [0056.756] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0056.756] lstrlenA (lpString="*.pdf") returned 5 [0056.756] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0056.756] lstrlenA (lpString="*.djvu") returned 6 [0056.756] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0056.756] lstrlenA (lpString="*.htm") returned 5 [0056.756] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.html") returned 0 [0056.757] lstrlenA (lpString="*.html") returned 6 [0056.757] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0056.757] lstrlenA (lpString="*.mdb") returned 5 [0056.757] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0056.757] lstrlenA (lpString="*.cer") returned 5 [0056.757] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0056.757] lstrlenA (lpString="*.p12") returned 5 [0056.757] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0056.757] lstrlenA (lpString="*.pfx") returned 5 [0056.757] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0056.757] lstrlenA (lpString="*.kwm") returned 5 [0056.757] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0056.757] lstrlenA (lpString="*.pwm") returned 5 [0056.757] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0056.757] lstrlenA (lpString="*.1cd") returned 5 [0056.757] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.md") returned 0 [0056.757] lstrlenA (lpString="*.md") returned 4 [0056.757] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0056.757] lstrlenA (lpString="*.mdf") returned 5 [0056.757] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0056.757] lstrlenA (lpString="*.dbf") returned 5 [0056.757] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0056.757] lstrlenA (lpString="*.odt") returned 5 [0056.757] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0056.757] lstrlenA (lpString="*.vob") returned 5 [0056.757] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0056.757] lstrlenA (lpString="*.ifo") returned 5 [0056.757] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0056.758] lstrlenA (lpString="*.lnk") returned 5 [0056.758] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0056.758] lstrlenA (lpString="*.torrent") returned 9 [0056.758] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0056.758] lstrlenA (lpString="*.mov") returned 5 [0056.758] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0056.758] lstrlenA (lpString="*.m2v") returned 5 [0056.758] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0056.758] lstrlenA (lpString="*.3gp") returned 5 [0056.758] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0056.758] lstrlenA (lpString="*.mpeg") returned 6 [0056.758] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0056.758] lstrlenA (lpString="*.mpg") returned 5 [0056.758] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0056.758] lstrlenA (lpString="*.flv") returned 5 [0056.758] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0056.758] lstrlenA (lpString="*.avi") returned 5 [0056.758] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0056.758] lstrlenA (lpString="*.mp4") returned 5 [0056.758] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0056.758] lstrlenA (lpString="*.wmv") returned 5 [0056.758] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0056.758] lstrlenA (lpString="*.divx") returned 6 [0056.758] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0056.758] lstrlenA (lpString="*.mkv") returned 5 [0056.758] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0056.758] lstrlenA (lpString="*.mp3") returned 5 [0056.758] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0056.758] lstrlenA (lpString="*.wav") returned 5 [0056.758] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0056.758] lstrlenA (lpString="*.flac") returned 6 [0056.758] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0056.758] lstrlenA (lpString="*.ape") returned 5 [0056.758] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0056.759] lstrlenA (lpString="*.wma") returned 5 [0056.759] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0056.759] lstrlenA (lpString="*.ac3") returned 5 [0056.759] FindNextFileA (in: hFindFile=0x636930, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0056.759] FindClose (in: hFindFile=0x636930 | out: hFindFile=0x636930) returned 1 [0056.759] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0056.759] lstrcmpA (lpString1=".", lpString2="pt-BR") returned -1 [0056.759] lstrcmpA (lpString1="..", lpString2="pt-BR") returned -1 [0056.759] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.759] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="pt-BR" | out: lpString1="C:\\Boot\\pt-BR") returned="C:\\Boot\\pt-BR" [0056.759] lstrlenA (lpString="C:\\Boot\\pt-BR") returned 13 [0056.759] FindFirstFileA (in: lpFileName="C:\\Boot\\pt-BR\\*.*" (normalized: "c:\\boot\\pt-br\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6365b0 [0056.759] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.759] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.759] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.759] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.759] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.759] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.759] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.759] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.760] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.760] PathFindFileNameA (pszPath="C:\\Boot\\pt-BR\\*.*") returned="*.*" [0056.760] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\pt-BR\\" | out: lpString1="C:\\Boot\\pt-BR\\") returned="C:\\Boot\\pt-BR\\" [0056.760] PathAddBackslashA (in: pszPath="C:\\Boot\\pt-BR\\" | out: pszPath="C:\\Boot\\pt-BR\\") returned="" [0056.760] lstrcatA (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\pt-BR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\pt-BR\\HOW TO DECRYPT FILES.txt" [0056.760] GetFileAttributesA (lpFileName="C:\\Boot\\pt-BR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pt-br\\how to decrypt files.txt")) returned 0xffffffff [0056.760] CreateFileA (lpFileName="C:\\Boot\\pt-BR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pt-br\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.764] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.764] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.765] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.765] CloseHandle (hObject=0x1c4) returned 1 [0056.765] lstrcatA (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned="C:\\Boot\\pt-BR\\bootmgr.exe.mui" [0056.765] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.765] lstrlenA (lpString="*.zip") returned 5 [0056.765] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.765] lstrlenA (lpString="*.rar") returned 5 [0056.766] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.766] lstrlenA (lpString="*.7z") returned 4 [0056.766] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.766] lstrlenA (lpString="*.tar") returned 5 [0056.766] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.766] lstrlenA (lpString="*.gzip") returned 6 [0056.766] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.766] lstrlenA (lpString="*.jpg") returned 5 [0056.766] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.766] lstrlenA (lpString="*.jpeg") returned 6 [0056.766] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.766] lstrlenA (lpString="*.psd") returned 5 [0056.766] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.766] lstrlenA (lpString="*.cdr") returned 5 [0056.766] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.766] lstrlenA (lpString="*.dwg") returned 5 [0056.766] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.766] lstrlenA (lpString="*.max") returned 5 [0056.766] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.766] lstrlenA (lpString="*.bmp") returned 5 [0056.766] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.766] lstrlenA (lpString="*.gif") returned 5 [0056.766] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.766] lstrlenA (lpString="*.png") returned 5 [0056.766] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.766] lstrlenA (lpString="*.doc") returned 5 [0056.766] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.766] lstrlenA (lpString="*.docx") returned 6 [0056.767] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.767] lstrlenA (lpString="*.xls") returned 5 [0056.767] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.767] lstrlenA (lpString="*.xlsx") returned 6 [0056.767] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.767] lstrlenA (lpString="*.ppt") returned 5 [0056.767] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.767] lstrlenA (lpString="*.pptx") returned 6 [0056.767] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.767] lstrlenA (lpString="*.txt") returned 5 [0056.767] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.767] lstrlenA (lpString="*.pdf") returned 5 [0056.767] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.767] lstrlenA (lpString="*.djvu") returned 6 [0056.767] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.767] lstrlenA (lpString="*.htm") returned 5 [0056.767] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.767] lstrlenA (lpString="*.html") returned 6 [0056.767] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.767] lstrlenA (lpString="*.mdb") returned 5 [0056.767] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.767] lstrlenA (lpString="*.cer") returned 5 [0056.767] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.768] lstrlenA (lpString="*.p12") returned 5 [0056.768] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.768] lstrlenA (lpString="*.pfx") returned 5 [0056.768] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.768] lstrlenA (lpString="*.kwm") returned 5 [0056.768] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.768] lstrlenA (lpString="*.pwm") returned 5 [0056.768] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.768] lstrlenA (lpString="*.1cd") returned 5 [0056.768] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.768] lstrlenA (lpString="*.md") returned 4 [0056.768] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.768] lstrlenA (lpString="*.mdf") returned 5 [0056.768] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.768] lstrlenA (lpString="*.dbf") returned 5 [0056.768] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.768] lstrlenA (lpString="*.odt") returned 5 [0056.768] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.768] lstrlenA (lpString="*.vob") returned 5 [0056.768] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.768] lstrlenA (lpString="*.ifo") returned 5 [0056.768] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.768] lstrlenA (lpString="*.lnk") returned 5 [0056.768] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.768] lstrlenA (lpString="*.torrent") returned 9 [0056.768] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.768] lstrlenA (lpString="*.mov") returned 5 [0056.768] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.768] lstrlenA (lpString="*.m2v") returned 5 [0056.768] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.768] lstrlenA (lpString="*.3gp") returned 5 [0056.768] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.768] lstrlenA (lpString="*.mpeg") returned 6 [0056.768] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.768] lstrlenA (lpString="*.mpg") returned 5 [0056.769] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.769] lstrlenA (lpString="*.flv") returned 5 [0056.769] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.769] lstrlenA (lpString="*.avi") returned 5 [0056.769] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.769] lstrlenA (lpString="*.mp4") returned 5 [0056.769] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.769] lstrlenA (lpString="*.wmv") returned 5 [0056.769] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.769] lstrlenA (lpString="*.divx") returned 6 [0056.769] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.769] lstrlenA (lpString="*.mkv") returned 5 [0056.769] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.769] lstrlenA (lpString="*.mp3") returned 5 [0056.769] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.769] lstrlenA (lpString="*.wav") returned 5 [0056.769] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.769] lstrlenA (lpString="*.flac") returned 6 [0056.769] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.769] lstrlenA (lpString="*.ape") returned 5 [0056.769] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.769] lstrlenA (lpString="*.wma") returned 5 [0056.769] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.769] lstrlenA (lpString="*.ac3") returned 5 [0056.769] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.769] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.769] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0056.769] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0056.769] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0056.769] PathFindFileNameA (pszPath="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0056.769] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\pt-BR\\" | out: lpString1="C:\\Boot\\pt-BR\\") returned="C:\\Boot\\pt-BR\\" [0056.769] PathAddBackslashA (in: pszPath="C:\\Boot\\pt-BR\\" | out: pszPath="C:\\Boot\\pt-BR\\") returned="" [0056.769] lstrcatA (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\pt-BR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\pt-BR\\HOW TO DECRYPT FILES.txt" [0056.770] GetFileAttributesA (lpFileName="C:\\Boot\\pt-BR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pt-br\\how to decrypt files.txt")) returned 0x20 [0056.770] lstrcatA (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\pt-BR\\memtest.exe.mui") returned="C:\\Boot\\pt-BR\\memtest.exe.mui" [0056.770] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0056.770] lstrlenA (lpString="*.zip") returned 5 [0056.770] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0056.770] lstrlenA (lpString="*.rar") returned 5 [0056.770] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0056.770] lstrlenA (lpString="*.7z") returned 4 [0056.770] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0056.770] lstrlenA (lpString="*.tar") returned 5 [0056.770] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0056.770] lstrlenA (lpString="*.gzip") returned 6 [0056.770] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0056.770] lstrlenA (lpString="*.jpg") returned 5 [0056.770] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0056.770] lstrlenA (lpString="*.jpeg") returned 6 [0056.770] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0056.770] lstrlenA (lpString="*.psd") returned 5 [0056.770] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0056.770] lstrlenA (lpString="*.cdr") returned 5 [0056.770] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0056.770] lstrlenA (lpString="*.dwg") returned 5 [0056.770] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.max") returned 0 [0056.770] lstrlenA (lpString="*.max") returned 5 [0056.770] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0056.770] lstrlenA (lpString="*.bmp") returned 5 [0056.770] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0056.770] lstrlenA (lpString="*.gif") returned 5 [0056.770] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.png") returned 0 [0056.770] lstrlenA (lpString="*.png") returned 5 [0056.770] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0056.771] lstrlenA (lpString="*.doc") returned 5 [0056.771] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0056.771] lstrlenA (lpString="*.docx") returned 6 [0056.771] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0056.771] lstrlenA (lpString="*.xls") returned 5 [0056.771] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0056.771] lstrlenA (lpString="*.xlsx") returned 6 [0056.771] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0056.771] lstrlenA (lpString="*.ppt") returned 5 [0056.771] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0056.771] lstrlenA (lpString="*.pptx") returned 6 [0056.771] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0056.771] lstrlenA (lpString="*.txt") returned 5 [0056.771] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0056.771] lstrlenA (lpString="*.pdf") returned 5 [0056.771] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0056.771] lstrlenA (lpString="*.djvu") returned 6 [0056.771] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0056.771] lstrlenA (lpString="*.htm") returned 5 [0056.771] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.html") returned 0 [0056.771] lstrlenA (lpString="*.html") returned 6 [0056.771] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0056.771] lstrlenA (lpString="*.mdb") returned 5 [0056.771] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0056.771] lstrlenA (lpString="*.cer") returned 5 [0056.771] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0056.771] lstrlenA (lpString="*.p12") returned 5 [0056.771] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0056.771] lstrlenA (lpString="*.pfx") returned 5 [0056.771] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0056.771] lstrlenA (lpString="*.kwm") returned 5 [0056.771] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0056.771] lstrlenA (lpString="*.pwm") returned 5 [0056.771] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0056.772] lstrlenA (lpString="*.1cd") returned 5 [0056.772] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.md") returned 0 [0056.772] lstrlenA (lpString="*.md") returned 4 [0056.772] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0056.772] lstrlenA (lpString="*.mdf") returned 5 [0056.772] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0056.772] lstrlenA (lpString="*.dbf") returned 5 [0056.772] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0056.772] lstrlenA (lpString="*.odt") returned 5 [0056.772] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0056.772] lstrlenA (lpString="*.vob") returned 5 [0056.772] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0056.772] lstrlenA (lpString="*.ifo") returned 5 [0056.772] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0056.772] lstrlenA (lpString="*.lnk") returned 5 [0056.772] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0056.772] lstrlenA (lpString="*.torrent") returned 9 [0056.772] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0056.772] lstrlenA (lpString="*.mov") returned 5 [0056.772] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0056.772] lstrlenA (lpString="*.m2v") returned 5 [0056.772] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0056.772] lstrlenA (lpString="*.3gp") returned 5 [0056.772] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0056.772] lstrlenA (lpString="*.mpeg") returned 6 [0056.772] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0056.772] lstrlenA (lpString="*.mpg") returned 5 [0056.772] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0056.772] lstrlenA (lpString="*.flv") returned 5 [0056.772] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0056.772] lstrlenA (lpString="*.avi") returned 5 [0056.772] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0056.773] lstrlenA (lpString="*.mp4") returned 5 [0056.773] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0056.773] lstrlenA (lpString="*.wmv") returned 5 [0056.773] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0056.773] lstrlenA (lpString="*.divx") returned 6 [0056.773] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0056.773] lstrlenA (lpString="*.mkv") returned 5 [0056.773] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0056.773] lstrlenA (lpString="*.mp3") returned 5 [0056.773] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0056.773] lstrlenA (lpString="*.wav") returned 5 [0056.773] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0056.773] lstrlenA (lpString="*.flac") returned 6 [0056.773] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0056.773] lstrlenA (lpString="*.ape") returned 5 [0056.773] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0056.773] lstrlenA (lpString="*.wma") returned 5 [0056.773] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0056.773] lstrlenA (lpString="*.ac3") returned 5 [0056.773] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0056.773] FindClose (in: hFindFile=0x6365b0 | out: hFindFile=0x6365b0) returned 1 [0056.773] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0056.773] lstrcmpA (lpString1=".", lpString2="pt-PT") returned -1 [0056.773] lstrcmpA (lpString1="..", lpString2="pt-PT") returned -1 [0056.773] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.773] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="pt-PT" | out: lpString1="C:\\Boot\\pt-PT") returned="C:\\Boot\\pt-PT" [0056.773] lstrlenA (lpString="C:\\Boot\\pt-PT") returned 13 [0056.773] FindFirstFileA (in: lpFileName="C:\\Boot\\pt-PT\\*.*" (normalized: "c:\\boot\\pt-pt\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636870 [0056.774] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.774] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.774] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.774] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.774] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.774] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.774] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.775] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.775] PathFindFileNameA (pszPath="C:\\Boot\\pt-PT\\*.*") returned="*.*" [0056.775] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\pt-PT\\" | out: lpString1="C:\\Boot\\pt-PT\\") returned="C:\\Boot\\pt-PT\\" [0056.775] PathAddBackslashA (in: pszPath="C:\\Boot\\pt-PT\\" | out: pszPath="C:\\Boot\\pt-PT\\") returned="" [0056.775] lstrcatA (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\pt-PT\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\pt-PT\\HOW TO DECRYPT FILES.txt" [0056.775] GetFileAttributesA (lpFileName="C:\\Boot\\pt-PT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pt-pt\\how to decrypt files.txt")) returned 0xffffffff [0056.775] CreateFileA (lpFileName="C:\\Boot\\pt-PT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pt-pt\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.777] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.777] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.778] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.778] CloseHandle (hObject=0x1c4) returned 1 [0056.778] lstrcatA (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned="C:\\Boot\\pt-PT\\bootmgr.exe.mui" [0056.778] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.778] lstrlenA (lpString="*.zip") returned 5 [0056.778] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.778] lstrlenA (lpString="*.rar") returned 5 [0056.778] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.778] lstrlenA (lpString="*.7z") returned 4 [0056.778] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.778] lstrlenA (lpString="*.tar") returned 5 [0056.778] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.778] lstrlenA (lpString="*.gzip") returned 6 [0056.778] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.778] lstrlenA (lpString="*.jpg") returned 5 [0056.778] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.778] lstrlenA (lpString="*.jpeg") returned 6 [0056.778] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.778] lstrlenA (lpString="*.psd") returned 5 [0056.778] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.778] lstrlenA (lpString="*.cdr") returned 5 [0056.779] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.779] lstrlenA (lpString="*.dwg") returned 5 [0056.779] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.779] lstrlenA (lpString="*.max") returned 5 [0056.779] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.779] lstrlenA (lpString="*.bmp") returned 5 [0056.779] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.779] lstrlenA (lpString="*.gif") returned 5 [0056.779] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.779] lstrlenA (lpString="*.png") returned 5 [0056.779] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.779] lstrlenA (lpString="*.doc") returned 5 [0056.779] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.779] lstrlenA (lpString="*.docx") returned 6 [0056.779] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.779] lstrlenA (lpString="*.xls") returned 5 [0056.779] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.779] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.779] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.779] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.779] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.779] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.779] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.779] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.779] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.779] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.779] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.779] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.780] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.780] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.780] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.780] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.780] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.780] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.780] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.780] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.780] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.780] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.780] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.780] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.780] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.780] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.780] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.780] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.780] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.780] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.780] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.780] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.780] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.780] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.780] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.781] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.781] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.781] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.781] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.781] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.781] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb358, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.781] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.781] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0056.781] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0056.781] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0056.781] PathFindFileNameA (pszPath="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0056.781] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\pt-PT\\" | out: lpString1="C:\\Boot\\pt-PT\\") returned="C:\\Boot\\pt-PT\\" [0056.781] PathAddBackslashA (in: pszPath="C:\\Boot\\pt-PT\\" | out: pszPath="C:\\Boot\\pt-PT\\") returned="" [0056.781] lstrcatA (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\pt-PT\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\pt-PT\\HOW TO DECRYPT FILES.txt" [0056.781] GetFileAttributesA (lpFileName="C:\\Boot\\pt-PT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pt-pt\\how to decrypt files.txt")) returned 0x20 [0056.781] lstrcatA (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\pt-PT\\memtest.exe.mui") returned="C:\\Boot\\pt-PT\\memtest.exe.mui" [0056.781] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0056.781] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0056.781] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0056.781] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0056.781] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0056.781] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0056.781] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0056.781] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0056.782] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0056.782] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0056.782] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.max") returned 0 [0056.782] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0056.782] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0056.782] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.png") returned 0 [0056.782] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0056.782] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0056.782] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0056.782] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0056.782] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0056.782] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0056.782] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0056.782] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0056.782] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0056.782] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0056.782] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.html") returned 0 [0056.782] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0056.782] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0056.782] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0056.782] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0056.782] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0056.783] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0056.783] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0056.783] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.md") returned 0 [0056.783] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0056.783] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0056.783] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0056.783] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0056.783] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0056.783] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0056.783] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0056.783] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0056.783] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0056.783] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0056.783] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0056.783] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0056.783] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0056.783] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0056.783] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0056.783] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0056.783] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0056.783] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0056.784] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0056.784] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0056.784] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0056.784] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0056.784] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0056.784] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0056.784] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb358, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0056.784] FindClose (in: hFindFile=0x636870 | out: hFindFile=0x636870) returned 1 [0056.784] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0056.784] lstrcmpA (lpString1=".", lpString2="qps-ploc") returned -1 [0056.784] lstrcmpA (lpString1="..", lpString2="qps-ploc") returned -1 [0056.784] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.784] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="qps-ploc" | out: lpString1="C:\\Boot\\qps-ploc") returned="C:\\Boot\\qps-ploc" [0056.784] FindFirstFileA (in: lpFileName="C:\\Boot\\qps-ploc\\*.*" (normalized: "c:\\boot\\qps-ploc\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6366f0 [0056.785] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.785] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.785] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.785] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.785] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.785] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.785] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.785] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.785] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.785] PathFindFileNameA (pszPath="C:\\Boot\\qps-ploc\\*.*") returned="*.*" [0056.785] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\qps-ploc\\" | out: lpString1="C:\\Boot\\qps-ploc\\") returned="C:\\Boot\\qps-ploc\\" [0056.785] PathAddBackslashA (in: pszPath="C:\\Boot\\qps-ploc\\" | out: pszPath="C:\\Boot\\qps-ploc\\") returned="" [0056.785] lstrcatA (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\qps-ploc\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\qps-ploc\\HOW TO DECRYPT FILES.txt" [0056.785] GetFileAttributesA (lpFileName="C:\\Boot\\qps-ploc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\qps-ploc\\how to decrypt files.txt")) returned 0xffffffff [0056.785] CreateFileA (lpFileName="C:\\Boot\\qps-ploc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\qps-ploc\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.787] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.788] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.788] CloseHandle (hObject=0x1c4) returned 1 [0056.788] lstrcatA (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\qps-ploc\\bootmgr.exe.mui") returned="C:\\Boot\\qps-ploc\\bootmgr.exe.mui" [0056.788] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.788] lstrlenA (lpString="*.zip") returned 5 [0056.788] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.788] lstrlenA (lpString="*.rar") returned 5 [0056.789] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.789] lstrlenA (lpString="*.7z") returned 4 [0056.789] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.789] lstrlenA (lpString="*.tar") returned 5 [0056.789] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.789] lstrlenA (lpString="*.gzip") returned 6 [0056.789] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.789] lstrlenA (lpString="*.jpg") returned 5 [0056.789] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.789] lstrlenA (lpString="*.jpeg") returned 6 [0056.789] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.789] lstrlenA (lpString="*.psd") returned 5 [0056.789] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.789] lstrlenA (lpString="*.cdr") returned 5 [0056.789] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.789] lstrlenA (lpString="*.dwg") returned 5 [0056.789] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.789] lstrlenA (lpString="*.max") returned 5 [0056.789] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.789] lstrlenA (lpString="*.bmp") returned 5 [0056.789] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.789] lstrlenA (lpString="*.gif") returned 5 [0056.789] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.789] lstrlenA (lpString="*.png") returned 5 [0056.789] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.789] lstrlenA (lpString="*.doc") returned 5 [0056.789] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.789] lstrlenA (lpString="*.docx") returned 6 [0056.789] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.789] lstrlenA (lpString="*.xls") returned 5 [0056.789] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.789] lstrlenA (lpString="*.xlsx") returned 6 [0056.789] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.789] lstrlenA (lpString="*.ppt") returned 5 [0056.790] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.790] lstrlenA (lpString="*.pptx") returned 6 [0056.790] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.790] lstrlenA (lpString="*.txt") returned 5 [0056.790] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.790] lstrlenA (lpString="*.pdf") returned 5 [0056.790] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.790] lstrlenA (lpString="*.djvu") returned 6 [0056.790] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.790] lstrlenA (lpString="*.htm") returned 5 [0056.790] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.790] lstrlenA (lpString="*.html") returned 6 [0056.790] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.790] lstrlenA (lpString="*.mdb") returned 5 [0056.790] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.790] lstrlenA (lpString="*.cer") returned 5 [0056.790] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.790] lstrlenA (lpString="*.p12") returned 5 [0056.790] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.790] lstrlenA (lpString="*.pfx") returned 5 [0056.790] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.790] lstrlenA (lpString="*.kwm") returned 5 [0056.790] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.790] lstrlenA (lpString="*.pwm") returned 5 [0056.790] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.790] lstrlenA (lpString="*.1cd") returned 5 [0056.790] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.790] lstrlenA (lpString="*.md") returned 4 [0056.790] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.790] lstrlenA (lpString="*.mdf") returned 5 [0056.790] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.790] lstrlenA (lpString="*.dbf") returned 5 [0056.790] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.790] lstrlenA (lpString="*.odt") returned 5 [0056.791] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.791] lstrlenA (lpString="*.vob") returned 5 [0056.791] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.791] lstrlenA (lpString="*.ifo") returned 5 [0056.791] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.791] lstrlenA (lpString="*.lnk") returned 5 [0056.791] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.791] lstrlenA (lpString="*.torrent") returned 9 [0056.791] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.791] lstrlenA (lpString="*.mov") returned 5 [0056.791] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.791] lstrlenA (lpString="*.m2v") returned 5 [0056.791] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.791] lstrlenA (lpString="*.3gp") returned 5 [0056.791] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.791] lstrlenA (lpString="*.mpeg") returned 6 [0056.791] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.791] lstrlenA (lpString="*.mpg") returned 5 [0056.791] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.791] lstrlenA (lpString="*.flv") returned 5 [0056.791] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.791] lstrlenA (lpString="*.avi") returned 5 [0056.791] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.791] lstrlenA (lpString="*.mp4") returned 5 [0056.791] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.791] lstrlenA (lpString="*.wmv") returned 5 [0056.791] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.791] lstrlenA (lpString="*.divx") returned 6 [0056.791] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.791] lstrlenA (lpString="*.mkv") returned 5 [0056.791] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.791] lstrlenA (lpString="*.mp3") returned 5 [0056.791] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.791] lstrlenA (lpString="*.wav") returned 5 [0056.791] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.792] lstrlenA (lpString="*.flac") returned 6 [0056.792] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.792] lstrlenA (lpString="*.ape") returned 5 [0056.792] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.792] lstrlenA (lpString="*.wma") returned 5 [0056.792] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.792] lstrlenA (lpString="*.ac3") returned 5 [0056.792] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf60, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.792] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.792] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0056.792] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0056.792] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0056.792] PathFindFileNameA (pszPath="C:\\Boot\\qps-ploc\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0056.792] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\qps-ploc\\" | out: lpString1="C:\\Boot\\qps-ploc\\") returned="C:\\Boot\\qps-ploc\\" [0056.792] PathAddBackslashA (in: pszPath="C:\\Boot\\qps-ploc\\" | out: pszPath="C:\\Boot\\qps-ploc\\") returned="" [0056.792] lstrcatA (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\qps-ploc\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\qps-ploc\\HOW TO DECRYPT FILES.txt" [0056.792] GetFileAttributesA (lpFileName="C:\\Boot\\qps-ploc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\qps-ploc\\how to decrypt files.txt")) returned 0x20 [0056.792] lstrcatA (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\qps-ploc\\memtest.exe.mui") returned="C:\\Boot\\qps-ploc\\memtest.exe.mui" [0056.792] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0056.792] lstrlenA (lpString="*.zip") returned 5 [0056.792] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0056.792] lstrlenA (lpString="*.rar") returned 5 [0056.792] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0056.792] lstrlenA (lpString="*.7z") returned 4 [0056.792] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0056.792] lstrlenA (lpString="*.tar") returned 5 [0056.792] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0056.792] lstrlenA (lpString="*.gzip") returned 6 [0056.792] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0056.793] lstrlenA (lpString="*.jpg") returned 5 [0056.793] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0056.793] lstrlenA (lpString="*.jpeg") returned 6 [0056.793] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0056.793] lstrlenA (lpString="*.psd") returned 5 [0056.793] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0056.793] lstrlenA (lpString="*.cdr") returned 5 [0056.793] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0056.793] lstrlenA (lpString="*.dwg") returned 5 [0056.793] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.max") returned 0 [0056.793] lstrlenA (lpString="*.max") returned 5 [0056.793] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0056.793] lstrlenA (lpString="*.bmp") returned 5 [0056.793] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0056.793] lstrlenA (lpString="*.gif") returned 5 [0056.793] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.png") returned 0 [0056.793] lstrlenA (lpString="*.png") returned 5 [0056.793] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0056.793] lstrlenA (lpString="*.doc") returned 5 [0056.793] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0056.793] lstrlenA (lpString="*.docx") returned 6 [0056.793] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0056.793] lstrlenA (lpString="*.xls") returned 5 [0056.793] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0056.793] lstrlenA (lpString="*.xlsx") returned 6 [0056.793] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0056.793] lstrlenA (lpString="*.ppt") returned 5 [0056.793] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0056.793] lstrlenA (lpString="*.pptx") returned 6 [0056.793] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0056.793] lstrlenA (lpString="*.txt") returned 5 [0056.793] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0056.793] lstrlenA (lpString="*.pdf") returned 5 [0056.793] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0056.793] lstrlenA (lpString="*.djvu") returned 6 [0056.794] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0056.794] lstrlenA (lpString="*.htm") returned 5 [0056.794] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.html") returned 0 [0056.794] lstrlenA (lpString="*.html") returned 6 [0056.794] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0056.794] lstrlenA (lpString="*.mdb") returned 5 [0056.794] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0056.794] lstrlenA (lpString="*.cer") returned 5 [0056.794] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0056.794] lstrlenA (lpString="*.p12") returned 5 [0056.794] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0056.794] lstrlenA (lpString="*.pfx") returned 5 [0056.794] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0056.794] lstrlenA (lpString="*.kwm") returned 5 [0056.794] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0056.794] lstrlenA (lpString="*.pwm") returned 5 [0056.794] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0056.794] lstrlenA (lpString="*.1cd") returned 5 [0056.794] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.md") returned 0 [0056.794] lstrlenA (lpString="*.md") returned 4 [0056.794] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0056.794] lstrlenA (lpString="*.mdf") returned 5 [0056.794] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0056.794] lstrlenA (lpString="*.dbf") returned 5 [0056.794] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0056.794] lstrlenA (lpString="*.odt") returned 5 [0056.794] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0056.794] lstrlenA (lpString="*.vob") returned 5 [0056.794] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0056.794] lstrlenA (lpString="*.ifo") returned 5 [0056.794] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0056.794] lstrlenA (lpString="*.lnk") returned 5 [0056.794] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0056.794] lstrlenA (lpString="*.torrent") returned 9 [0056.794] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0056.794] lstrlenA (lpString="*.mov") returned 5 [0056.795] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0056.795] lstrlenA (lpString="*.m2v") returned 5 [0056.795] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0056.795] lstrlenA (lpString="*.3gp") returned 5 [0056.795] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0056.795] lstrlenA (lpString="*.mpeg") returned 6 [0056.795] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0056.795] lstrlenA (lpString="*.mpg") returned 5 [0056.795] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0056.795] lstrlenA (lpString="*.flv") returned 5 [0056.795] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0056.795] lstrlenA (lpString="*.avi") returned 5 [0056.795] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0056.795] lstrlenA (lpString="*.mp4") returned 5 [0056.795] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0056.795] lstrlenA (lpString="*.wmv") returned 5 [0056.795] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0056.795] lstrlenA (lpString="*.divx") returned 6 [0056.795] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0056.795] lstrlenA (lpString="*.mkv") returned 5 [0056.795] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0056.795] lstrlenA (lpString="*.mp3") returned 5 [0056.795] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0056.795] lstrlenA (lpString="*.wav") returned 5 [0056.795] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0056.795] lstrlenA (lpString="*.flac") returned 6 [0056.795] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0056.795] lstrlenA (lpString="*.ape") returned 5 [0056.795] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0056.795] lstrlenA (lpString="*.wma") returned 5 [0056.795] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0056.795] lstrlenA (lpString="*.ac3") returned 5 [0056.795] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf60, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0056.795] FindClose (in: hFindFile=0x6366f0 | out: hFindFile=0x6366f0) returned 1 [0056.796] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0056.796] lstrcmpA (lpString1=".", lpString2="Resources") returned -1 [0056.796] lstrcmpA (lpString1="..", lpString2="Resources") returned -1 [0056.796] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.796] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="Resources" | out: lpString1="C:\\Boot\\Resources") returned="C:\\Boot\\Resources" [0056.796] lstrlenA (lpString="C:\\Boot\\Resources") returned 17 [0056.796] FindFirstFileA (in: lpFileName="C:\\Boot\\Resources\\*.*" (normalized: "c:\\boot\\resources\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636870 [0056.810] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.810] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.810] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.810] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.810] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll", cAlternateFileName="")) returned 1 [0056.811] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.811] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootres.dll") returned 1 [0056.811] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootres.dll") returned 1 [0056.811] lstrcmpiA (lpString1="", lpString2="bootres.dll") returned -1 [0056.811] PathFindFileNameA (pszPath="C:\\Boot\\Resources\\*.*") returned="*.*" [0056.811] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Resources\\" | out: lpString1="C:\\Boot\\Resources\\") returned="C:\\Boot\\Resources\\" [0056.811] PathAddBackslashA (in: pszPath="C:\\Boot\\Resources\\" | out: pszPath="C:\\Boot\\Resources\\") returned="" [0056.811] lstrcatA (in: lpString1="C:\\Boot\\Resources\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Resources\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Resources\\HOW TO DECRYPT FILES.txt" [0056.811] GetFileAttributesA (lpFileName="C:\\Boot\\Resources\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\resources\\how to decrypt files.txt")) returned 0xffffffff [0056.811] CreateFileA (lpFileName="C:\\Boot\\Resources\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\resources\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.811] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.811] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.813] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.813] CloseHandle (hObject=0x1c4) returned 1 [0056.813] lstrcatA (in: lpString1="C:\\Boot\\Resources\\", lpString2="bootres.dll" | out: lpString1="C:\\Boot\\Resources\\bootres.dll") returned="C:\\Boot\\Resources\\bootres.dll" [0056.813] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.zip") returned 0 [0056.813] lstrlenA (lpString="*.zip") returned 5 [0056.813] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.rar") returned 0 [0056.813] lstrlenA (lpString="*.rar") returned 5 [0056.813] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.7z") returned 0 [0056.813] lstrlenA (lpString="*.7z") returned 4 [0056.813] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.tar") returned 0 [0056.813] lstrlenA (lpString="*.tar") returned 5 [0056.813] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.gzip") returned 0 [0056.813] lstrlenA (lpString="*.gzip") returned 6 [0056.813] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.jpg") returned 0 [0056.813] lstrlenA (lpString="*.jpg") returned 5 [0056.813] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.jpeg") returned 0 [0056.813] lstrlenA (lpString="*.jpeg") returned 6 [0056.813] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.psd") returned 0 [0056.813] lstrlenA (lpString="*.psd") returned 5 [0056.813] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.cdr") returned 0 [0056.813] lstrlenA (lpString="*.cdr") returned 5 [0056.813] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.dwg") returned 0 [0056.814] lstrlenA (lpString="*.dwg") returned 5 [0056.814] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.max") returned 0 [0056.814] lstrlenA (lpString="*.max") returned 5 [0056.814] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.bmp") returned 0 [0056.814] lstrlenA (lpString="*.bmp") returned 5 [0056.814] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.gif") returned 0 [0056.814] lstrlenA (lpString="*.gif") returned 5 [0056.814] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.png") returned 0 [0056.814] lstrlenA (lpString="*.png") returned 5 [0056.814] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.doc") returned 0 [0056.814] lstrlenA (lpString="*.doc") returned 5 [0056.814] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.docx") returned 0 [0056.814] lstrlenA (lpString="*.docx") returned 6 [0056.814] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.xls") returned 0 [0056.814] lstrlenA (lpString="*.xls") returned 5 [0056.814] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.xlsx") returned 0 [0056.814] lstrlenA (lpString="*.xlsx") returned 6 [0056.814] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.ppt") returned 0 [0056.814] lstrlenA (lpString="*.ppt") returned 5 [0056.814] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.pptx") returned 0 [0056.814] lstrlenA (lpString="*.pptx") returned 6 [0056.814] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.txt") returned 0 [0056.814] lstrlenA (lpString="*.txt") returned 5 [0056.814] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.pdf") returned 0 [0056.814] lstrlenA (lpString="*.pdf") returned 5 [0056.814] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.djvu") returned 0 [0056.814] lstrlenA (lpString="*.djvu") returned 6 [0056.814] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.htm") returned 0 [0056.814] lstrlenA (lpString="*.htm") returned 5 [0056.814] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.html") returned 0 [0056.814] lstrlenA (lpString="*.html") returned 6 [0056.815] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.mdb") returned 0 [0056.815] lstrlenA (lpString="*.mdb") returned 5 [0056.815] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.cer") returned 0 [0056.815] lstrlenA (lpString="*.cer") returned 5 [0056.815] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.p12") returned 0 [0056.815] lstrlenA (lpString="*.p12") returned 5 [0056.815] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.pfx") returned 0 [0056.815] lstrlenA (lpString="*.pfx") returned 5 [0056.815] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.kwm") returned 0 [0056.815] lstrlenA (lpString="*.kwm") returned 5 [0056.815] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.pwm") returned 0 [0056.815] lstrlenA (lpString="*.pwm") returned 5 [0056.815] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.1cd") returned 0 [0056.815] lstrlenA (lpString="*.1cd") returned 5 [0056.815] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.md") returned 0 [0056.815] lstrlenA (lpString="*.md") returned 4 [0056.815] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.mdf") returned 0 [0056.815] lstrlenA (lpString="*.mdf") returned 5 [0056.815] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.dbf") returned 0 [0056.815] lstrlenA (lpString="*.dbf") returned 5 [0056.815] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.odt") returned 0 [0056.815] lstrlenA (lpString="*.odt") returned 5 [0056.815] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.vob") returned 0 [0056.815] lstrlenA (lpString="*.vob") returned 5 [0056.815] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.ifo") returned 0 [0056.815] lstrlenA (lpString="*.ifo") returned 5 [0056.815] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.lnk") returned 0 [0056.815] lstrlenA (lpString="*.lnk") returned 5 [0056.815] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.torrent") returned 0 [0056.815] lstrlenA (lpString="*.torrent") returned 9 [0056.815] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.mov") returned 0 [0056.815] lstrlenA (lpString="*.mov") returned 5 [0056.815] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.m2v") returned 0 [0056.816] lstrlenA (lpString="*.m2v") returned 5 [0056.816] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.3gp") returned 0 [0056.816] lstrlenA (lpString="*.3gp") returned 5 [0056.816] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.mpeg") returned 0 [0056.816] lstrlenA (lpString="*.mpeg") returned 6 [0056.816] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.mpg") returned 0 [0056.816] lstrlenA (lpString="*.mpg") returned 5 [0056.816] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.flv") returned 0 [0056.816] lstrlenA (lpString="*.flv") returned 5 [0056.816] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.avi") returned 0 [0056.816] lstrlenA (lpString="*.avi") returned 5 [0056.816] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.mp4") returned 0 [0056.816] lstrlenA (lpString="*.mp4") returned 5 [0056.816] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.wmv") returned 0 [0056.816] lstrlenA (lpString="*.wmv") returned 5 [0056.816] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.divx") returned 0 [0056.816] lstrlenA (lpString="*.divx") returned 6 [0056.816] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.mkv") returned 0 [0056.816] lstrlenA (lpString="*.mkv") returned 5 [0056.816] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.mp3") returned 0 [0056.816] lstrlenA (lpString="*.mp3") returned 5 [0056.816] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.wav") returned 0 [0056.816] lstrlenA (lpString="*.wav") returned 5 [0056.816] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.flac") returned 0 [0056.816] lstrlenA (lpString="*.flac") returned 6 [0056.816] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.ape") returned 0 [0056.816] lstrlenA (lpString="*.ape") returned 5 [0056.816] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.wma") returned 0 [0056.816] lstrlenA (lpString="*.wma") returned 5 [0056.816] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.ac3") returned 0 [0056.816] lstrlenA (lpString="*.ac3") returned 5 [0056.816] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0056.816] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0056.817] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0056.817] PathFindFileNameA (pszPath="C:\\Boot\\Resources\\bootres.dll") returned="bootres.dll" [0056.817] lstrcatA (in: lpString1="C:\\Boot\\Resources\\", lpString2="en-US" | out: lpString1="C:\\Boot\\Resources\\en-US") returned="C:\\Boot\\Resources\\en-US" [0056.817] lstrlenA (lpString="C:\\Boot\\Resources\\en-US") returned 23 [0056.817] FindFirstFileA (in: lpFileName="C:\\Boot\\Resources\\en-US\\*.*" (normalized: "c:\\boot\\resources\\en-us\\*.*"), lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19fab8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6368b0 [0056.817] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.817] FindNextFileA (in: hFindFile=0x6368b0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19fab8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.817] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.817] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.817] FindNextFileA (in: hFindFile=0x6368b0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x9ea99bcf, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x19fab8, dwReserved1=0x0, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 1 [0056.817] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0056.817] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootres.dll.mui") returned 1 [0056.817] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootres.dll.mui") returned 1 [0056.817] lstrcmpiA (lpString1="", lpString2="bootres.dll.mui") returned -1 [0056.817] PathFindFileNameA (pszPath="C:\\Boot\\Resources\\en-US\\*.*") returned="*.*" [0056.817] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Resources\\en-US\\" | out: lpString1="C:\\Boot\\Resources\\en-US\\") returned="C:\\Boot\\Resources\\en-US\\" [0056.817] PathAddBackslashA (in: pszPath="C:\\Boot\\Resources\\en-US\\" | out: pszPath="C:\\Boot\\Resources\\en-US\\") returned="" [0056.817] lstrcatA (in: lpString1="C:\\Boot\\Resources\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Resources\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Resources\\en-US\\HOW TO DECRYPT FILES.txt" [0056.817] GetFileAttributesA (lpFileName="C:\\Boot\\Resources\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\resources\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0056.818] CreateFileA (lpFileName="C:\\Boot\\Resources\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\resources\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0056.818] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.818] WriteFile (in: hFile=0x1c8, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.819] SetFileTime (hFile=0x1c8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.819] CloseHandle (hObject=0x1c8) returned 1 [0056.819] lstrcatA (in: lpString1="C:\\Boot\\Resources\\en-US\\", lpString2="bootres.dll.mui" | out: lpString1="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned="C:\\Boot\\Resources\\en-US\\bootres.dll.mui" [0056.819] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.zip") returned 0 [0056.819] lstrlenA (lpString="*.zip") returned 5 [0056.819] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.rar") returned 0 [0056.819] lstrlenA (lpString="*.rar") returned 5 [0056.819] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.7z") returned 0 [0056.819] lstrlenA (lpString="*.7z") returned 4 [0056.819] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.tar") returned 0 [0056.819] lstrlenA (lpString="*.tar") returned 5 [0056.819] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.gzip") returned 0 [0056.819] lstrlenA (lpString="*.gzip") returned 6 [0056.819] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.jpg") returned 0 [0056.819] lstrlenA (lpString="*.jpg") returned 5 [0056.820] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.jpeg") returned 0 [0056.820] lstrlenA (lpString="*.jpeg") returned 6 [0056.820] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.psd") returned 0 [0056.820] lstrlenA (lpString="*.psd") returned 5 [0056.820] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.cdr") returned 0 [0056.820] lstrlenA (lpString="*.cdr") returned 5 [0056.820] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.dwg") returned 0 [0056.820] lstrlenA (lpString="*.dwg") returned 5 [0056.820] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.max") returned 0 [0056.820] lstrlenA (lpString="*.max") returned 5 [0056.820] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.bmp") returned 0 [0056.820] lstrlenA (lpString="*.bmp") returned 5 [0056.820] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.gif") returned 0 [0056.820] lstrlenA (lpString="*.gif") returned 5 [0056.820] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.png") returned 0 [0056.820] lstrlenA (lpString="*.png") returned 5 [0056.820] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.doc") returned 0 [0056.820] lstrlenA (lpString="*.doc") returned 5 [0056.820] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.docx") returned 0 [0056.820] lstrlenA (lpString="*.docx") returned 6 [0056.820] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.xls") returned 0 [0056.820] lstrlenA (lpString="*.xls") returned 5 [0056.820] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.xlsx") returned 0 [0056.820] lstrlenA (lpString="*.xlsx") returned 6 [0056.820] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.ppt") returned 0 [0056.820] lstrlenA (lpString="*.ppt") returned 5 [0056.820] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.pptx") returned 0 [0056.820] lstrlenA (lpString="*.pptx") returned 6 [0056.820] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.txt") returned 0 [0056.820] lstrlenA (lpString="*.txt") returned 5 [0056.820] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.pdf") returned 0 [0056.820] lstrlenA (lpString="*.pdf") returned 5 [0056.820] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.djvu") returned 0 [0056.820] lstrlenA (lpString="*.djvu") returned 6 [0056.820] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.htm") returned 0 [0056.821] lstrlenA (lpString="*.htm") returned 5 [0056.821] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.html") returned 0 [0056.821] lstrlenA (lpString="*.html") returned 6 [0056.821] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.mdb") returned 0 [0056.821] lstrlenA (lpString="*.mdb") returned 5 [0056.821] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.cer") returned 0 [0056.821] lstrlenA (lpString="*.cer") returned 5 [0056.821] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.p12") returned 0 [0056.821] lstrlenA (lpString="*.p12") returned 5 [0056.821] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.pfx") returned 0 [0056.821] lstrlenA (lpString="*.pfx") returned 5 [0056.821] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.kwm") returned 0 [0056.821] lstrlenA (lpString="*.kwm") returned 5 [0056.821] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.pwm") returned 0 [0056.821] lstrlenA (lpString="*.pwm") returned 5 [0056.821] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.1cd") returned 0 [0056.821] lstrlenA (lpString="*.1cd") returned 5 [0056.821] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.md") returned 0 [0056.821] lstrlenA (lpString="*.md") returned 4 [0056.821] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.mdf") returned 0 [0056.821] lstrlenA (lpString="*.mdf") returned 5 [0056.821] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.dbf") returned 0 [0056.821] lstrlenA (lpString="*.dbf") returned 5 [0056.821] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.odt") returned 0 [0056.821] lstrlenA (lpString="*.odt") returned 5 [0056.821] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.vob") returned 0 [0056.821] lstrlenA (lpString="*.vob") returned 5 [0056.821] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.ifo") returned 0 [0056.821] lstrlenA (lpString="*.ifo") returned 5 [0056.821] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.lnk") returned 0 [0056.821] lstrlenA (lpString="*.lnk") returned 5 [0056.821] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.torrent") returned 0 [0056.821] lstrlenA (lpString="*.torrent") returned 9 [0056.821] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.mov") returned 0 [0056.822] lstrlenA (lpString="*.mov") returned 5 [0056.822] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.m2v") returned 0 [0056.822] lstrlenA (lpString="*.m2v") returned 5 [0056.822] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.3gp") returned 0 [0056.822] lstrlenA (lpString="*.3gp") returned 5 [0056.822] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.mpeg") returned 0 [0056.822] lstrlenA (lpString="*.mpeg") returned 6 [0056.822] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.mpg") returned 0 [0056.822] lstrlenA (lpString="*.mpg") returned 5 [0056.822] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.flv") returned 0 [0056.822] lstrlenA (lpString="*.flv") returned 5 [0056.822] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.avi") returned 0 [0056.822] lstrlenA (lpString="*.avi") returned 5 [0056.822] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.mp4") returned 0 [0056.822] lstrlenA (lpString="*.mp4") returned 5 [0056.822] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.wmv") returned 0 [0056.822] lstrlenA (lpString="*.wmv") returned 5 [0056.822] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.divx") returned 0 [0056.822] lstrlenA (lpString="*.divx") returned 6 [0056.822] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.mkv") returned 0 [0056.822] lstrlenA (lpString="*.mkv") returned 5 [0056.822] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.mp3") returned 0 [0056.822] lstrlenA (lpString="*.mp3") returned 5 [0056.822] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.wav") returned 0 [0056.822] lstrlenA (lpString="*.wav") returned 5 [0056.822] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.flac") returned 0 [0056.822] lstrlenA (lpString="*.flac") returned 6 [0056.822] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.ape") returned 0 [0056.822] lstrlenA (lpString="*.ape") returned 5 [0056.822] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.wma") returned 0 [0056.822] lstrlenA (lpString="*.wma") returned 5 [0056.823] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.ac3") returned 0 [0056.823] lstrlenA (lpString="*.ac3") returned 5 [0056.823] FindNextFileA (in: hFindFile=0x6368b0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x9ea99bcf, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x19fab8, dwReserved1=0x0, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 0 [0056.823] FindClose (in: hFindFile=0x6368b0 | out: hFindFile=0x6368b0) returned 1 [0056.823] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0056.823] FindClose (in: hFindFile=0x636870 | out: hFindFile=0x636870) returned 1 [0056.823] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0056.823] lstrcmpA (lpString1=".", lpString2="ro-RO") returned -1 [0056.823] lstrcmpA (lpString1="..", lpString2="ro-RO") returned -1 [0056.823] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.823] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="ro-RO" | out: lpString1="C:\\Boot\\ro-RO") returned="C:\\Boot\\ro-RO" [0056.823] lstrlenA (lpString="C:\\Boot\\ro-RO") returned 13 [0056.823] FindFirstFileA (in: lpFileName="C:\\Boot\\ro-RO\\*.*" (normalized: "c:\\boot\\ro-ro\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName=".", cAlternateFileName="")) returned 0x636ab0 [0056.824] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.824] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="..", cAlternateFileName="")) returned 1 [0056.824] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.824] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.824] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.824] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.824] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.824] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.824] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.824] PathFindFileNameA (pszPath="C:\\Boot\\ro-RO\\*.*") returned="*.*" [0056.824] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ro-RO\\" | out: lpString1="C:\\Boot\\ro-RO\\") returned="C:\\Boot\\ro-RO\\" [0056.824] PathAddBackslashA (in: pszPath="C:\\Boot\\ro-RO\\" | out: pszPath="C:\\Boot\\ro-RO\\") returned="" [0056.824] lstrcatA (in: lpString1="C:\\Boot\\ro-RO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\ro-RO\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\ro-RO\\HOW TO DECRYPT FILES.txt" [0056.824] GetFileAttributesA (lpFileName="C:\\Boot\\ro-RO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ro-ro\\how to decrypt files.txt")) returned 0xffffffff [0056.824] CreateFileA (lpFileName="C:\\Boot\\ro-RO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ro-ro\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.825] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.825] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.826] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.826] CloseHandle (hObject=0x1c4) returned 1 [0056.826] lstrcatA (in: lpString1="C:\\Boot\\ro-RO\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned="C:\\Boot\\ro-RO\\bootmgr.exe.mui" [0056.826] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.826] lstrlenA (lpString="*.zip") returned 5 [0056.826] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.826] lstrlenA (lpString="*.rar") returned 5 [0056.826] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.826] lstrlenA (lpString="*.7z") returned 4 [0056.826] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.826] lstrlenA (lpString="*.tar") returned 5 [0056.826] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.826] lstrlenA (lpString="*.gzip") returned 6 [0056.826] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.826] lstrlenA (lpString="*.jpg") returned 5 [0056.826] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.826] lstrlenA (lpString="*.jpeg") returned 6 [0056.827] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.827] lstrlenA (lpString="*.psd") returned 5 [0056.827] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.827] lstrlenA (lpString="*.cdr") returned 5 [0056.827] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.827] lstrlenA (lpString="*.dwg") returned 5 [0056.827] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.827] lstrlenA (lpString="*.max") returned 5 [0056.827] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.827] lstrlenA (lpString="*.bmp") returned 5 [0056.827] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.827] lstrlenA (lpString="*.gif") returned 5 [0056.827] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.827] lstrlenA (lpString="*.png") returned 5 [0056.827] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.827] lstrlenA (lpString="*.doc") returned 5 [0056.827] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.827] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.827] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.827] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.827] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.827] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.827] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.827] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.827] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.827] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.828] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.828] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.828] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.828] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.828] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.828] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.828] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.828] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.828] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.828] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.828] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.828] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.828] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.828] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.828] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.828] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.828] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.828] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.828] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.828] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.828] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.828] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.829] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.829] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.829] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.829] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.829] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.829] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.829] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.829] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.829] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.829] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.829] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0056.829] FindClose (in: hFindFile=0x636ab0 | out: hFindFile=0x636ab0) returned 1 [0056.829] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0056.829] lstrcmpA (lpString1=".", lpString2="ru-RU") returned -1 [0056.829] lstrcmpA (lpString1="..", lpString2="ru-RU") returned -1 [0056.829] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.829] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="ru-RU" | out: lpString1="C:\\Boot\\ru-RU") returned="C:\\Boot\\ru-RU" [0056.829] FindFirstFileA (in: lpFileName="C:\\Boot\\ru-RU\\*.*" (normalized: "c:\\boot\\ru-ru\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636430 [0056.830] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.830] FindNextFileA (in: hFindFile=0x636430, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.830] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.830] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.830] FindNextFileA (in: hFindFile=0x636430, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.830] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.830] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.830] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.830] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.830] PathFindFileNameA (pszPath="C:\\Boot\\ru-RU\\*.*") returned="*.*" [0056.830] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ru-RU\\" | out: lpString1="C:\\Boot\\ru-RU\\") returned="C:\\Boot\\ru-RU\\" [0056.830] PathAddBackslashA (in: pszPath="C:\\Boot\\ru-RU\\" | out: pszPath="C:\\Boot\\ru-RU\\") returned="" [0056.830] lstrcatA (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\ru-RU\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\ru-RU\\HOW TO DECRYPT FILES.txt" [0056.830] GetFileAttributesA (lpFileName="C:\\Boot\\ru-RU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ru-ru\\how to decrypt files.txt")) returned 0xffffffff [0056.830] CreateFileA (lpFileName="C:\\Boot\\ru-RU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ru-ru\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.833] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.834] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.834] CloseHandle (hObject=0x1c4) returned 1 [0056.834] lstrcatA (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned="C:\\Boot\\ru-RU\\bootmgr.exe.mui" [0056.834] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.834] lstrlenA (lpString="*.zip") returned 5 [0056.834] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.834] lstrlenA (lpString="*.rar") returned 5 [0056.834] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.834] lstrlenA (lpString="*.7z") returned 4 [0056.834] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.834] lstrlenA (lpString="*.tar") returned 5 [0056.834] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.834] lstrlenA (lpString="*.gzip") returned 6 [0056.834] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.834] lstrlenA (lpString="*.jpg") returned 5 [0056.834] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.834] lstrlenA (lpString="*.jpeg") returned 6 [0056.834] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.835] lstrlenA (lpString="*.psd") returned 5 [0056.835] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.835] lstrlenA (lpString="*.cdr") returned 5 [0056.835] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.835] lstrlenA (lpString="*.dwg") returned 5 [0056.835] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.835] lstrlenA (lpString="*.max") returned 5 [0056.835] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.835] lstrlenA (lpString="*.bmp") returned 5 [0056.835] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.835] lstrlenA (lpString="*.gif") returned 5 [0056.835] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.835] lstrlenA (lpString="*.png") returned 5 [0056.835] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.835] lstrlenA (lpString="*.doc") returned 5 [0056.835] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.835] lstrlenA (lpString="*.docx") returned 6 [0056.835] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.835] lstrlenA (lpString="*.xls") returned 5 [0056.835] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.835] lstrlenA (lpString="*.xlsx") returned 6 [0056.835] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.835] lstrlenA (lpString="*.ppt") returned 5 [0056.835] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.835] lstrlenA (lpString="*.pptx") returned 6 [0056.835] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.835] lstrlenA (lpString="*.txt") returned 5 [0056.835] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.835] lstrlenA (lpString="*.pdf") returned 5 [0056.835] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.835] lstrlenA (lpString="*.djvu") returned 6 [0056.835] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.836] lstrlenA (lpString="*.htm") returned 5 [0056.836] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.836] lstrlenA (lpString="*.html") returned 6 [0056.836] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.836] lstrlenA (lpString="*.mdb") returned 5 [0056.836] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.836] lstrlenA (lpString="*.cer") returned 5 [0056.836] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.836] lstrlenA (lpString="*.p12") returned 5 [0056.836] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.836] lstrlenA (lpString="*.pfx") returned 5 [0056.836] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.836] lstrlenA (lpString="*.kwm") returned 5 [0056.836] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.836] lstrlenA (lpString="*.pwm") returned 5 [0056.836] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.836] lstrlenA (lpString="*.1cd") returned 5 [0056.836] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.836] lstrlenA (lpString="*.md") returned 4 [0056.836] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.836] lstrlenA (lpString="*.mdf") returned 5 [0056.836] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.836] lstrlenA (lpString="*.dbf") returned 5 [0056.836] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.836] lstrlenA (lpString="*.odt") returned 5 [0056.836] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.836] lstrlenA (lpString="*.vob") returned 5 [0056.836] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.836] lstrlenA (lpString="*.ifo") returned 5 [0056.836] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.836] lstrlenA (lpString="*.lnk") returned 5 [0056.836] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.836] lstrlenA (lpString="*.torrent") returned 9 [0056.837] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.837] lstrlenA (lpString="*.mov") returned 5 [0056.837] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.837] lstrlenA (lpString="*.m2v") returned 5 [0056.837] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.837] lstrlenA (lpString="*.3gp") returned 5 [0056.837] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.837] lstrlenA (lpString="*.mpeg") returned 6 [0056.837] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.837] lstrlenA (lpString="*.mpg") returned 5 [0056.837] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.837] lstrlenA (lpString="*.flv") returned 5 [0056.837] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.837] lstrlenA (lpString="*.avi") returned 5 [0056.837] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.837] lstrlenA (lpString="*.mp4") returned 5 [0056.837] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.837] lstrlenA (lpString="*.wmv") returned 5 [0056.837] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.837] lstrlenA (lpString="*.divx") returned 6 [0056.837] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.837] lstrlenA (lpString="*.mkv") returned 5 [0056.837] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.837] lstrlenA (lpString="*.mp3") returned 5 [0056.837] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.837] lstrlenA (lpString="*.wav") returned 5 [0056.837] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.837] lstrlenA (lpString="*.flac") returned 6 [0056.837] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.838] lstrlenA (lpString="*.ape") returned 5 [0056.838] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.838] lstrlenA (lpString="*.wma") returned 5 [0056.838] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.838] lstrlenA (lpString="*.ac3") returned 5 [0056.838] FindNextFileA (in: hFindFile=0x636430, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211a0897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf60, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.838] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.838] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0056.838] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0056.838] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0056.838] PathFindFileNameA (pszPath="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0056.838] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ru-RU\\" | out: lpString1="C:\\Boot\\ru-RU\\") returned="C:\\Boot\\ru-RU\\" [0056.838] PathAddBackslashA (in: pszPath="C:\\Boot\\ru-RU\\" | out: pszPath="C:\\Boot\\ru-RU\\") returned="" [0056.838] lstrcatA (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\ru-RU\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\ru-RU\\HOW TO DECRYPT FILES.txt" [0056.838] GetFileAttributesA (lpFileName="C:\\Boot\\ru-RU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ru-ru\\how to decrypt files.txt")) returned 0x20 [0056.838] lstrcatA (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\ru-RU\\memtest.exe.mui") returned="C:\\Boot\\ru-RU\\memtest.exe.mui" [0056.838] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0056.838] lstrlenA (lpString="*.zip") returned 5 [0056.838] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0056.838] lstrlenA (lpString="*.rar") returned 5 [0056.838] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0056.838] lstrlenA (lpString="*.7z") returned 4 [0056.838] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0056.838] lstrlenA (lpString="*.tar") returned 5 [0056.838] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0056.838] lstrlenA (lpString="*.gzip") returned 6 [0056.838] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0056.838] lstrlenA (lpString="*.jpg") returned 5 [0056.839] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0056.839] lstrlenA (lpString="*.jpeg") returned 6 [0056.839] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0056.839] lstrlenA (lpString="*.psd") returned 5 [0056.839] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0056.839] lstrlenA (lpString="*.cdr") returned 5 [0056.839] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0056.839] lstrlenA (lpString="*.dwg") returned 5 [0056.839] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.max") returned 0 [0056.839] lstrlenA (lpString="*.max") returned 5 [0056.839] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0056.839] lstrlenA (lpString="*.bmp") returned 5 [0056.839] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0056.839] lstrlenA (lpString="*.gif") returned 5 [0056.839] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.png") returned 0 [0056.839] lstrlenA (lpString="*.png") returned 5 [0056.839] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0056.839] lstrlenA (lpString="*.doc") returned 5 [0056.839] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0056.839] lstrlenA (lpString="*.docx") returned 6 [0056.839] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0056.839] lstrlenA (lpString="*.xls") returned 5 [0056.839] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0056.839] lstrlenA (lpString="*.xlsx") returned 6 [0056.839] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0056.839] lstrlenA (lpString="*.ppt") returned 5 [0056.839] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0056.839] lstrlenA (lpString="*.pptx") returned 6 [0056.839] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0056.839] lstrlenA (lpString="*.txt") returned 5 [0056.839] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0056.839] lstrlenA (lpString="*.pdf") returned 5 [0056.839] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0056.839] lstrlenA (lpString="*.djvu") returned 6 [0056.840] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0056.840] lstrlenA (lpString="*.htm") returned 5 [0056.840] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.html") returned 0 [0056.840] lstrlenA (lpString="*.html") returned 6 [0056.840] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0056.840] lstrlenA (lpString="*.mdb") returned 5 [0056.840] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0056.840] lstrlenA (lpString="*.cer") returned 5 [0056.840] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0056.840] lstrlenA (lpString="*.p12") returned 5 [0056.840] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0056.840] lstrlenA (lpString="*.pfx") returned 5 [0056.840] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0056.840] lstrlenA (lpString="*.kwm") returned 5 [0056.840] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0056.840] lstrlenA (lpString="*.pwm") returned 5 [0056.840] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0056.840] lstrlenA (lpString="*.1cd") returned 5 [0056.840] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.md") returned 0 [0056.840] lstrlenA (lpString="*.md") returned 4 [0056.840] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0056.840] lstrlenA (lpString="*.mdf") returned 5 [0056.840] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0056.840] lstrlenA (lpString="*.dbf") returned 5 [0056.840] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0056.840] lstrlenA (lpString="*.odt") returned 5 [0056.840] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0056.840] lstrlenA (lpString="*.vob") returned 5 [0056.840] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0056.840] lstrlenA (lpString="*.ifo") returned 5 [0056.840] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0056.840] lstrlenA (lpString="*.lnk") returned 5 [0056.840] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0056.840] lstrlenA (lpString="*.torrent") returned 9 [0056.841] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0056.841] lstrlenA (lpString="*.mov") returned 5 [0056.841] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0056.841] lstrlenA (lpString="*.m2v") returned 5 [0056.841] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0056.841] lstrlenA (lpString="*.3gp") returned 5 [0056.841] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0056.841] lstrlenA (lpString="*.mpeg") returned 6 [0056.841] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0056.841] lstrlenA (lpString="*.mpg") returned 5 [0056.841] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0056.841] lstrlenA (lpString="*.flv") returned 5 [0056.841] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0056.841] lstrlenA (lpString="*.avi") returned 5 [0056.841] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0056.841] lstrlenA (lpString="*.mp4") returned 5 [0056.841] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0056.841] lstrlenA (lpString="*.wmv") returned 5 [0056.841] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0056.841] lstrlenA (lpString="*.divx") returned 6 [0056.841] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0056.841] lstrlenA (lpString="*.mkv") returned 5 [0056.841] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0056.841] lstrlenA (lpString="*.mp3") returned 5 [0056.841] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0056.841] lstrlenA (lpString="*.wav") returned 5 [0056.841] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0056.841] lstrlenA (lpString="*.flac") returned 6 [0056.841] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0056.841] lstrlenA (lpString="*.ape") returned 5 [0056.841] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0056.841] lstrlenA (lpString="*.wma") returned 5 [0056.842] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0056.842] lstrlenA (lpString="*.ac3") returned 5 [0056.842] FindNextFileA (in: hFindFile=0x636430, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211a0897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf60, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0056.842] FindClose (in: hFindFile=0x636430 | out: hFindFile=0x636430) returned 1 [0056.842] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0056.842] lstrcmpA (lpString1=".", lpString2="sk-SK") returned -1 [0056.842] lstrcmpA (lpString1="..", lpString2="sk-SK") returned -1 [0056.842] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.842] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="sk-SK" | out: lpString1="C:\\Boot\\sk-SK") returned="C:\\Boot\\sk-SK" [0056.842] lstrlenA (lpString="C:\\Boot\\sk-SK") returned 13 [0056.842] FindFirstFileA (in: lpFileName="C:\\Boot\\sk-SK\\*.*" (normalized: "c:\\boot\\sk-sk\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636630 [0056.843] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.843] FindNextFileA (in: hFindFile=0x636630, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.843] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.843] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.843] FindNextFileA (in: hFindFile=0x636630, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.843] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.843] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.843] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.843] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.843] PathFindFileNameA (pszPath="C:\\Boot\\sk-SK\\*.*") returned="*.*" [0056.843] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\sk-SK\\" | out: lpString1="C:\\Boot\\sk-SK\\") returned="C:\\Boot\\sk-SK\\" [0056.843] PathAddBackslashA (in: pszPath="C:\\Boot\\sk-SK\\" | out: pszPath="C:\\Boot\\sk-SK\\") returned="" [0056.843] lstrcatA (in: lpString1="C:\\Boot\\sk-SK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\sk-SK\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\sk-SK\\HOW TO DECRYPT FILES.txt" [0056.843] GetFileAttributesA (lpFileName="C:\\Boot\\sk-SK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sk-sk\\how to decrypt files.txt")) returned 0xffffffff [0056.843] CreateFileA (lpFileName="C:\\Boot\\sk-SK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sk-sk\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.844] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.844] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.849] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.850] CloseHandle (hObject=0x1c4) returned 1 [0056.850] lstrcatA (in: lpString1="C:\\Boot\\sk-SK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned="C:\\Boot\\sk-SK\\bootmgr.exe.mui" [0056.850] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.850] lstrlenA (lpString="*.zip") returned 5 [0056.850] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.850] lstrlenA (lpString="*.rar") returned 5 [0056.850] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.850] lstrlenA (lpString="*.7z") returned 4 [0056.850] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.850] lstrlenA (lpString="*.tar") returned 5 [0056.850] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.850] lstrlenA (lpString="*.gzip") returned 6 [0056.850] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.850] lstrlenA (lpString="*.jpg") returned 5 [0056.850] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.850] lstrlenA (lpString="*.jpeg") returned 6 [0056.850] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.850] lstrlenA (lpString="*.psd") returned 5 [0056.850] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.850] lstrlenA (lpString="*.cdr") returned 5 [0056.850] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.850] lstrlenA (lpString="*.dwg") returned 5 [0056.850] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.850] lstrlenA (lpString="*.max") returned 5 [0056.850] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.851] lstrlenA (lpString="*.bmp") returned 5 [0056.851] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.851] lstrlenA (lpString="*.gif") returned 5 [0056.851] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.851] lstrlenA (lpString="*.png") returned 5 [0056.851] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.851] lstrlenA (lpString="*.doc") returned 5 [0056.851] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.851] lstrlenA (lpString="*.docx") returned 6 [0056.851] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.851] lstrlenA (lpString="*.xls") returned 5 [0056.851] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.851] lstrlenA (lpString="*.xlsx") returned 6 [0056.851] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.851] lstrlenA (lpString="*.ppt") returned 5 [0056.851] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.851] lstrlenA (lpString="*.pptx") returned 6 [0056.851] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.851] lstrlenA (lpString="*.txt") returned 5 [0056.851] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.851] lstrlenA (lpString="*.pdf") returned 5 [0056.851] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.851] lstrlenA (lpString="*.djvu") returned 6 [0056.851] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.851] lstrlenA (lpString="*.htm") returned 5 [0056.851] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.851] lstrlenA (lpString="*.html") returned 6 [0056.851] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.851] lstrlenA (lpString="*.mdb") returned 5 [0056.851] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.851] lstrlenA (lpString="*.cer") returned 5 [0056.851] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.851] lstrlenA (lpString="*.p12") returned 5 [0056.851] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.852] lstrlenA (lpString="*.pfx") returned 5 [0056.852] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.852] lstrlenA (lpString="*.kwm") returned 5 [0056.852] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.852] lstrlenA (lpString="*.pwm") returned 5 [0056.852] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.852] lstrlenA (lpString="*.1cd") returned 5 [0056.852] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.852] lstrlenA (lpString="*.md") returned 4 [0056.852] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.852] lstrlenA (lpString="*.mdf") returned 5 [0056.852] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.852] lstrlenA (lpString="*.dbf") returned 5 [0056.852] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.852] lstrlenA (lpString="*.odt") returned 5 [0056.852] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.852] lstrlenA (lpString="*.vob") returned 5 [0056.852] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.852] lstrlenA (lpString="*.ifo") returned 5 [0056.852] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.852] lstrlenA (lpString="*.lnk") returned 5 [0056.852] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.852] lstrlenA (lpString="*.torrent") returned 9 [0056.852] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.852] lstrlenA (lpString="*.mov") returned 5 [0056.852] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.852] lstrlenA (lpString="*.m2v") returned 5 [0056.852] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.852] lstrlenA (lpString="*.3gp") returned 5 [0056.852] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.852] lstrlenA (lpString="*.mpeg") returned 6 [0056.852] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.853] lstrlenA (lpString="*.mpg") returned 5 [0056.853] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.853] lstrlenA (lpString="*.flv") returned 5 [0056.853] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.853] lstrlenA (lpString="*.avi") returned 5 [0056.853] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.853] lstrlenA (lpString="*.mp4") returned 5 [0056.853] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.853] lstrlenA (lpString="*.wmv") returned 5 [0056.853] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.853] lstrlenA (lpString="*.divx") returned 6 [0056.853] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.853] lstrlenA (lpString="*.mkv") returned 5 [0056.853] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.853] lstrlenA (lpString="*.mp3") returned 5 [0056.853] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.853] lstrlenA (lpString="*.wav") returned 5 [0056.853] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.853] lstrlenA (lpString="*.flac") returned 6 [0056.853] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.853] lstrlenA (lpString="*.ape") returned 5 [0056.853] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.853] lstrlenA (lpString="*.wma") returned 5 [0056.853] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.853] lstrlenA (lpString="*.ac3") returned 5 [0056.853] FindNextFileA (in: hFindFile=0x636630, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0056.853] FindClose (in: hFindFile=0x636630 | out: hFindFile=0x636630) returned 1 [0056.853] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0056.854] lstrcmpA (lpString1=".", lpString2="sl-SI") returned -1 [0056.854] lstrcmpA (lpString1="..", lpString2="sl-SI") returned -1 [0056.854] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.854] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="sl-SI" | out: lpString1="C:\\Boot\\sl-SI") returned="C:\\Boot\\sl-SI" [0056.854] lstrlenA (lpString="C:\\Boot\\sl-SI") returned 13 [0056.854] FindFirstFileA (in: lpFileName="C:\\Boot\\sl-SI\\*.*" (normalized: "c:\\boot\\sl-si\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636ab0 [0056.854] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.854] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.854] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.854] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.854] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.854] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.854] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.854] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.854] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.854] PathFindFileNameA (pszPath="C:\\Boot\\sl-SI\\*.*") returned="*.*" [0056.854] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\sl-SI\\" | out: lpString1="C:\\Boot\\sl-SI\\") returned="C:\\Boot\\sl-SI\\" [0056.854] PathAddBackslashA (in: pszPath="C:\\Boot\\sl-SI\\" | out: pszPath="C:\\Boot\\sl-SI\\") returned="" [0056.854] lstrcatA (in: lpString1="C:\\Boot\\sl-SI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\sl-SI\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\sl-SI\\HOW TO DECRYPT FILES.txt" [0056.854] GetFileAttributesA (lpFileName="C:\\Boot\\sl-SI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sl-si\\how to decrypt files.txt")) returned 0xffffffff [0056.854] CreateFileA (lpFileName="C:\\Boot\\sl-SI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sl-si\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.855] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.855] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.856] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.856] CloseHandle (hObject=0x1c4) returned 1 [0056.856] lstrcatA (in: lpString1="C:\\Boot\\sl-SI\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned="C:\\Boot\\sl-SI\\bootmgr.exe.mui" [0056.856] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.856] lstrlenA (lpString="*.zip") returned 5 [0056.856] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.856] lstrlenA (lpString="*.rar") returned 5 [0056.856] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.856] lstrlenA (lpString="*.7z") returned 4 [0056.856] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.856] lstrlenA (lpString="*.tar") returned 5 [0056.856] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.856] lstrlenA (lpString="*.gzip") returned 6 [0056.856] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.856] lstrlenA (lpString="*.jpg") returned 5 [0056.856] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.856] lstrlenA (lpString="*.jpeg") returned 6 [0056.856] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.857] lstrlenA (lpString="*.psd") returned 5 [0056.857] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.857] lstrlenA (lpString="*.cdr") returned 5 [0056.857] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.857] lstrlenA (lpString="*.dwg") returned 5 [0056.857] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.857] lstrlenA (lpString="*.max") returned 5 [0056.857] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.857] lstrlenA (lpString="*.bmp") returned 5 [0056.857] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.857] lstrlenA (lpString="*.gif") returned 5 [0056.857] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.857] lstrlenA (lpString="*.png") returned 5 [0056.857] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.857] lstrlenA (lpString="*.doc") returned 5 [0056.857] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.857] lstrlenA (lpString="*.docx") returned 6 [0056.857] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.857] lstrlenA (lpString="*.xls") returned 5 [0056.857] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.857] lstrlenA (lpString="*.xlsx") returned 6 [0056.857] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.857] lstrlenA (lpString="*.ppt") returned 5 [0056.857] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.857] lstrlenA (lpString="*.pptx") returned 6 [0056.857] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.857] lstrlenA (lpString="*.txt") returned 5 [0056.857] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.857] lstrlenA (lpString="*.pdf") returned 5 [0056.857] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.857] lstrlenA (lpString="*.djvu") returned 6 [0056.857] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.857] lstrlenA (lpString="*.htm") returned 5 [0056.858] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.858] lstrlenA (lpString="*.html") returned 6 [0056.858] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.858] lstrlenA (lpString="*.mdb") returned 5 [0056.858] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.858] lstrlenA (lpString="*.cer") returned 5 [0056.858] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.858] lstrlenA (lpString="*.p12") returned 5 [0056.858] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.858] lstrlenA (lpString="*.pfx") returned 5 [0056.858] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.858] lstrlenA (lpString="*.kwm") returned 5 [0056.858] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.858] lstrlenA (lpString="*.pwm") returned 5 [0056.858] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.858] lstrlenA (lpString="*.1cd") returned 5 [0056.858] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.858] lstrlenA (lpString="*.md") returned 4 [0056.858] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.858] lstrlenA (lpString="*.mdf") returned 5 [0056.858] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.858] lstrlenA (lpString="*.dbf") returned 5 [0056.858] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.858] lstrlenA (lpString="*.odt") returned 5 [0056.858] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.858] lstrlenA (lpString="*.vob") returned 5 [0056.858] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.858] lstrlenA (lpString="*.ifo") returned 5 [0056.858] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.858] lstrlenA (lpString="*.lnk") returned 5 [0056.858] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.859] lstrlenA (lpString="*.torrent") returned 9 [0056.859] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.859] lstrlenA (lpString="*.mov") returned 5 [0056.859] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.859] lstrlenA (lpString="*.m2v") returned 5 [0056.859] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.859] lstrlenA (lpString="*.3gp") returned 5 [0056.859] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.859] lstrlenA (lpString="*.mpeg") returned 6 [0056.859] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.859] lstrlenA (lpString="*.mpg") returned 5 [0056.859] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.859] lstrlenA (lpString="*.flv") returned 5 [0056.859] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.859] lstrlenA (lpString="*.avi") returned 5 [0056.859] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.859] lstrlenA (lpString="*.mp4") returned 5 [0056.859] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.859] lstrlenA (lpString="*.wmv") returned 5 [0056.859] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.859] lstrlenA (lpString="*.divx") returned 6 [0056.859] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.859] lstrlenA (lpString="*.mkv") returned 5 [0056.859] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.859] lstrlenA (lpString="*.mp3") returned 5 [0056.859] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.859] lstrlenA (lpString="*.wav") returned 5 [0056.859] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.859] lstrlenA (lpString="*.flac") returned 6 [0056.859] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.859] lstrlenA (lpString="*.ape") returned 5 [0056.859] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.859] lstrlenA (lpString="*.wma") returned 5 [0056.860] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.860] lstrlenA (lpString="*.ac3") returned 5 [0056.860] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0056.860] FindClose (in: hFindFile=0x636ab0 | out: hFindFile=0x636ab0) returned 1 [0056.860] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0056.860] lstrcmpA (lpString1=".", lpString2="sr-Latn-CS") returned -1 [0056.860] lstrcmpA (lpString1="..", lpString2="sr-Latn-CS") returned -1 [0056.860] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.860] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="sr-Latn-CS" | out: lpString1="C:\\Boot\\sr-Latn-CS") returned="C:\\Boot\\sr-Latn-CS" [0056.860] lstrlenA (lpString="C:\\Boot\\sr-Latn-CS") returned 18 [0056.860] FindFirstFileA (in: lpFileName="C:\\Boot\\sr-Latn-CS\\*.*" (normalized: "c:\\boot\\sr-latn-cs\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6365b0 [0056.863] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.863] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.863] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.863] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.863] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.863] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.863] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.863] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.863] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.863] PathFindFileNameA (pszPath="C:\\Boot\\sr-Latn-CS\\*.*") returned="*.*" [0056.863] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\sr-Latn-CS\\" | out: lpString1="C:\\Boot\\sr-Latn-CS\\") returned="C:\\Boot\\sr-Latn-CS\\" [0056.863] PathAddBackslashA (in: pszPath="C:\\Boot\\sr-Latn-CS\\" | out: pszPath="C:\\Boot\\sr-Latn-CS\\") returned="" [0056.863] lstrcatA (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\sr-Latn-CS\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\sr-Latn-CS\\HOW TO DECRYPT FILES.txt" [0056.863] GetFileAttributesA (lpFileName="C:\\Boot\\sr-Latn-CS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sr-latn-cs\\how to decrypt files.txt")) returned 0xffffffff [0056.863] CreateFileA (lpFileName="C:\\Boot\\sr-Latn-CS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sr-latn-cs\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.865] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.865] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.867] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.867] CloseHandle (hObject=0x1c4) returned 1 [0056.867] lstrcatA (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" [0056.867] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.867] lstrlenA (lpString="*.zip") returned 5 [0056.867] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.867] lstrlenA (lpString="*.rar") returned 5 [0056.867] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.867] lstrlenA (lpString="*.7z") returned 4 [0056.867] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.867] lstrlenA (lpString="*.tar") returned 5 [0056.867] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.867] lstrlenA (lpString="*.gzip") returned 6 [0056.867] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.867] lstrlenA (lpString="*.jpg") returned 5 [0056.867] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.867] lstrlenA (lpString="*.jpeg") returned 6 [0056.867] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.867] lstrlenA (lpString="*.psd") returned 5 [0056.867] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.867] lstrlenA (lpString="*.cdr") returned 5 [0056.867] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.867] lstrlenA (lpString="*.dwg") returned 5 [0056.867] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.867] lstrlenA (lpString="*.max") returned 5 [0056.868] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.868] lstrlenA (lpString="*.bmp") returned 5 [0056.868] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.868] lstrlenA (lpString="*.gif") returned 5 [0056.868] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.868] lstrlenA (lpString="*.png") returned 5 [0056.868] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.868] lstrlenA (lpString="*.doc") returned 5 [0056.868] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.868] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.868] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.868] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.868] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.868] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.868] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.868] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.868] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.868] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.868] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.868] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.868] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.868] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.868] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.868] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.869] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.869] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.869] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.869] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.869] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.869] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.869] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.869] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.869] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.869] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.869] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.869] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.869] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.869] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.869] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.869] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.869] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.869] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.869] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.869] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.870] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.870] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.870] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.870] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.870] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.870] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.870] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.870] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.870] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0056.870] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0056.870] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0056.870] PathFindFileNameA (pszPath="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0056.870] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\sr-Latn-CS\\" | out: lpString1="C:\\Boot\\sr-Latn-CS\\") returned="C:\\Boot\\sr-Latn-CS\\" [0056.870] PathAddBackslashA (in: pszPath="C:\\Boot\\sr-Latn-CS\\" | out: pszPath="C:\\Boot\\sr-Latn-CS\\") returned="" [0056.870] lstrcatA (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\sr-Latn-CS\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\sr-Latn-CS\\HOW TO DECRYPT FILES.txt" [0056.870] GetFileAttributesA (lpFileName="C:\\Boot\\sr-Latn-CS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sr-latn-cs\\how to decrypt files.txt")) returned 0x20 [0056.870] lstrcatA (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" [0056.870] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0056.871] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0056.871] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0056.871] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0056.871] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0056.871] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0056.871] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0056.871] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0056.871] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0056.871] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0056.871] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.max") returned 0 [0056.871] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0056.871] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0056.871] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.png") returned 0 [0056.871] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0056.871] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0056.871] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0056.871] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0056.871] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0056.872] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0056.872] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0056.872] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0056.872] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0056.872] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0056.872] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.html") returned 0 [0056.872] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0056.872] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0056.872] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0056.872] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0056.872] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0056.872] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0056.872] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0056.873] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.md") returned 0 [0056.873] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0056.873] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0056.873] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0056.873] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0056.873] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0056.873] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0056.873] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0056.873] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0056.873] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0056.873] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0056.873] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0056.874] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0056.874] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0056.874] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0056.874] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0056.874] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0056.874] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0056.874] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0056.874] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0056.874] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0056.874] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0056.874] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0056.874] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0056.874] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0056.874] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0056.875] FindClose (in: hFindFile=0x6365b0 | out: hFindFile=0x6365b0) returned 1 [0056.875] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0056.875] lstrcmpA (lpString1=".", lpString2="sr-Latn-RS") returned -1 [0056.875] lstrcmpA (lpString1="..", lpString2="sr-Latn-RS") returned -1 [0056.875] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.875] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="sr-Latn-RS" | out: lpString1="C:\\Boot\\sr-Latn-RS") returned="C:\\Boot\\sr-Latn-RS" [0056.875] FindFirstFileA (in: lpFileName="C:\\Boot\\sr-Latn-RS\\*.*" (normalized: "c:\\boot\\sr-latn-rs\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636870 [0056.876] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.876] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.876] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.876] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.876] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.876] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.876] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.876] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.877] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.877] PathFindFileNameA (pszPath="C:\\Boot\\sr-Latn-RS\\*.*") returned="*.*" [0056.877] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\sr-Latn-RS\\" | out: lpString1="C:\\Boot\\sr-Latn-RS\\") returned="C:\\Boot\\sr-Latn-RS\\" [0056.877] PathAddBackslashA (in: pszPath="C:\\Boot\\sr-Latn-RS\\" | out: pszPath="C:\\Boot\\sr-Latn-RS\\") returned="" [0056.877] lstrcatA (in: lpString1="C:\\Boot\\sr-Latn-RS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\sr-Latn-RS\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\sr-Latn-RS\\HOW TO DECRYPT FILES.txt" [0056.877] GetFileAttributesA (lpFileName="C:\\Boot\\sr-Latn-RS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sr-latn-rs\\how to decrypt files.txt")) returned 0xffffffff [0056.877] CreateFileA (lpFileName="C:\\Boot\\sr-Latn-RS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sr-latn-rs\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.877] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.878] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.879] CloseHandle (hObject=0x1c4) returned 1 [0056.879] lstrcatA (in: lpString1="C:\\Boot\\sr-Latn-RS\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" [0056.879] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.879] lstrlenA (lpString="*.zip") returned 5 [0056.879] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.879] lstrlenA (lpString="*.rar") returned 5 [0056.879] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.879] lstrlenA (lpString="*.7z") returned 4 [0056.879] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.879] lstrlenA (lpString="*.tar") returned 5 [0056.879] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.879] lstrlenA (lpString="*.gzip") returned 6 [0056.879] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.879] lstrlenA (lpString="*.jpg") returned 5 [0056.879] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.879] lstrlenA (lpString="*.jpeg") returned 6 [0056.879] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.879] lstrlenA (lpString="*.psd") returned 5 [0056.879] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.879] lstrlenA (lpString="*.cdr") returned 5 [0056.879] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.879] lstrlenA (lpString="*.dwg") returned 5 [0056.879] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.879] lstrlenA (lpString="*.max") returned 5 [0056.879] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.879] lstrlenA (lpString="*.bmp") returned 5 [0056.879] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.879] lstrlenA (lpString="*.gif") returned 5 [0056.880] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.880] lstrlenA (lpString="*.png") returned 5 [0056.880] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.880] lstrlenA (lpString="*.doc") returned 5 [0056.880] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.880] lstrlenA (lpString="*.docx") returned 6 [0056.880] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.880] lstrlenA (lpString="*.xls") returned 5 [0056.880] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.880] lstrlenA (lpString="*.xlsx") returned 6 [0056.880] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.880] lstrlenA (lpString="*.ppt") returned 5 [0056.880] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.880] lstrlenA (lpString="*.pptx") returned 6 [0056.880] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.880] lstrlenA (lpString="*.txt") returned 5 [0056.880] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.880] lstrlenA (lpString="*.pdf") returned 5 [0056.880] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.880] lstrlenA (lpString="*.djvu") returned 6 [0056.880] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.880] lstrlenA (lpString="*.htm") returned 5 [0056.880] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.880] lstrlenA (lpString="*.html") returned 6 [0056.880] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.880] lstrlenA (lpString="*.mdb") returned 5 [0056.880] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.880] lstrlenA (lpString="*.cer") returned 5 [0056.880] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.880] lstrlenA (lpString="*.p12") returned 5 [0056.880] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.880] lstrlenA (lpString="*.pfx") returned 5 [0056.880] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.880] lstrlenA (lpString="*.kwm") returned 5 [0056.881] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.881] lstrlenA (lpString="*.pwm") returned 5 [0056.881] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.881] lstrlenA (lpString="*.1cd") returned 5 [0056.881] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.881] lstrlenA (lpString="*.md") returned 4 [0056.881] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.881] lstrlenA (lpString="*.mdf") returned 5 [0056.881] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.881] lstrlenA (lpString="*.dbf") returned 5 [0056.881] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.881] lstrlenA (lpString="*.odt") returned 5 [0056.881] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.881] lstrlenA (lpString="*.vob") returned 5 [0056.881] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.881] lstrlenA (lpString="*.ifo") returned 5 [0056.881] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.881] lstrlenA (lpString="*.lnk") returned 5 [0056.881] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.881] lstrlenA (lpString="*.torrent") returned 9 [0056.881] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.881] lstrlenA (lpString="*.mov") returned 5 [0056.881] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.881] lstrlenA (lpString="*.m2v") returned 5 [0056.881] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.881] lstrlenA (lpString="*.3gp") returned 5 [0056.881] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.881] lstrlenA (lpString="*.mpeg") returned 6 [0056.881] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.881] lstrlenA (lpString="*.mpg") returned 5 [0056.881] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.881] lstrlenA (lpString="*.flv") returned 5 [0056.881] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.881] lstrlenA (lpString="*.avi") returned 5 [0056.881] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.882] lstrlenA (lpString="*.mp4") returned 5 [0056.882] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.882] lstrlenA (lpString="*.wmv") returned 5 [0056.882] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.882] lstrlenA (lpString="*.divx") returned 6 [0056.882] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.882] lstrlenA (lpString="*.mkv") returned 5 [0056.882] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.882] lstrlenA (lpString="*.mp3") returned 5 [0056.882] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.882] lstrlenA (lpString="*.wav") returned 5 [0056.882] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.882] lstrlenA (lpString="*.flac") returned 6 [0056.882] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.882] lstrlenA (lpString="*.ape") returned 5 [0056.882] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.882] lstrlenA (lpString="*.wma") returned 5 [0056.882] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.882] lstrlenA (lpString="*.ac3") returned 5 [0056.882] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0056.882] FindClose (in: hFindFile=0x636870 | out: hFindFile=0x636870) returned 1 [0056.882] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0056.882] lstrcmpA (lpString1=".", lpString2="sv-SE") returned -1 [0056.882] lstrcmpA (lpString1="..", lpString2="sv-SE") returned -1 [0056.882] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.882] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="sv-SE" | out: lpString1="C:\\Boot\\sv-SE") returned="C:\\Boot\\sv-SE" [0056.882] lstrlenA (lpString="C:\\Boot\\sv-SE") returned 13 [0056.882] FindFirstFileA (in: lpFileName="C:\\Boot\\sv-SE\\*.*" (normalized: "c:\\boot\\sv-se\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6365b0 [0056.883] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.883] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.883] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.883] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.883] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.883] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.883] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.883] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.883] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.883] PathFindFileNameA (pszPath="C:\\Boot\\sv-SE\\*.*") returned="*.*" [0056.883] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\sv-SE\\" | out: lpString1="C:\\Boot\\sv-SE\\") returned="C:\\Boot\\sv-SE\\" [0056.883] PathAddBackslashA (in: pszPath="C:\\Boot\\sv-SE\\" | out: pszPath="C:\\Boot\\sv-SE\\") returned="" [0056.883] lstrcatA (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\sv-SE\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\sv-SE\\HOW TO DECRYPT FILES.txt" [0056.883] GetFileAttributesA (lpFileName="C:\\Boot\\sv-SE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sv-se\\how to decrypt files.txt")) returned 0xffffffff [0056.883] CreateFileA (lpFileName="C:\\Boot\\sv-SE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sv-se\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.888] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.889] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.890] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.890] CloseHandle (hObject=0x1c4) returned 1 [0056.890] lstrcatA (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned="C:\\Boot\\sv-SE\\bootmgr.exe.mui" [0056.890] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.890] lstrlenA (lpString="*.zip") returned 5 [0056.890] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.890] lstrlenA (lpString="*.rar") returned 5 [0056.890] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.890] lstrlenA (lpString="*.7z") returned 4 [0056.890] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.890] lstrlenA (lpString="*.tar") returned 5 [0056.890] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.890] lstrlenA (lpString="*.gzip") returned 6 [0056.890] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.890] lstrlenA (lpString="*.jpg") returned 5 [0056.890] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.890] lstrlenA (lpString="*.jpeg") returned 6 [0056.890] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.890] lstrlenA (lpString="*.psd") returned 5 [0056.890] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.890] lstrlenA (lpString="*.cdr") returned 5 [0056.890] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.890] lstrlenA (lpString="*.dwg") returned 5 [0056.890] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.891] lstrlenA (lpString="*.max") returned 5 [0056.891] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.891] lstrlenA (lpString="*.bmp") returned 5 [0056.891] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.891] lstrlenA (lpString="*.gif") returned 5 [0056.891] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.891] lstrlenA (lpString="*.png") returned 5 [0056.891] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.891] lstrlenA (lpString="*.doc") returned 5 [0056.891] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.891] lstrlenA (lpString="*.docx") returned 6 [0056.891] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.891] lstrlenA (lpString="*.xls") returned 5 [0056.891] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.891] lstrlenA (lpString="*.xlsx") returned 6 [0056.891] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.891] lstrlenA (lpString="*.ppt") returned 5 [0056.891] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.891] lstrlenA (lpString="*.pptx") returned 6 [0056.891] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.891] lstrlenA (lpString="*.txt") returned 5 [0056.891] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.891] lstrlenA (lpString="*.pdf") returned 5 [0056.891] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.891] lstrlenA (lpString="*.djvu") returned 6 [0056.891] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.891] lstrlenA (lpString="*.htm") returned 5 [0056.891] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.891] lstrlenA (lpString="*.html") returned 6 [0056.891] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.891] lstrlenA (lpString="*.mdb") returned 5 [0056.891] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.892] lstrlenA (lpString="*.cer") returned 5 [0056.892] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.892] lstrlenA (lpString="*.p12") returned 5 [0056.892] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.892] lstrlenA (lpString="*.pfx") returned 5 [0056.892] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.892] lstrlenA (lpString="*.kwm") returned 5 [0056.892] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.892] lstrlenA (lpString="*.pwm") returned 5 [0056.892] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.892] lstrlenA (lpString="*.1cd") returned 5 [0056.892] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.892] lstrlenA (lpString="*.md") returned 4 [0056.892] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.892] lstrlenA (lpString="*.mdf") returned 5 [0056.892] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.892] lstrlenA (lpString="*.dbf") returned 5 [0056.892] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.892] lstrlenA (lpString="*.odt") returned 5 [0056.892] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.892] lstrlenA (lpString="*.vob") returned 5 [0056.892] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.892] lstrlenA (lpString="*.ifo") returned 5 [0056.893] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.893] lstrlenA (lpString="*.lnk") returned 5 [0056.893] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.893] lstrlenA (lpString="*.torrent") returned 9 [0056.893] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.893] lstrlenA (lpString="*.mov") returned 5 [0056.893] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.893] lstrlenA (lpString="*.m2v") returned 5 [0056.893] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.893] lstrlenA (lpString="*.3gp") returned 5 [0056.893] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.893] lstrlenA (lpString="*.mpeg") returned 6 [0056.893] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.893] lstrlenA (lpString="*.mpg") returned 5 [0056.893] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.893] lstrlenA (lpString="*.flv") returned 5 [0056.893] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.893] lstrlenA (lpString="*.avi") returned 5 [0056.893] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.893] lstrlenA (lpString="*.mp4") returned 5 [0056.893] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.893] lstrlenA (lpString="*.wmv") returned 5 [0056.893] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.893] lstrlenA (lpString="*.divx") returned 6 [0056.893] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.893] lstrlenA (lpString="*.mkv") returned 5 [0056.894] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.894] lstrlenA (lpString="*.mp3") returned 5 [0056.894] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.894] lstrlenA (lpString="*.wav") returned 5 [0056.894] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.894] lstrlenA (lpString="*.flac") returned 6 [0056.894] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.894] lstrlenA (lpString="*.ape") returned 5 [0056.894] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.894] lstrlenA (lpString="*.wma") returned 5 [0056.894] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.894] lstrlenA (lpString="*.ac3") returned 5 [0056.894] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.894] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.894] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0056.894] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0056.894] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0056.894] PathFindFileNameA (pszPath="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0056.894] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\sv-SE\\" | out: lpString1="C:\\Boot\\sv-SE\\") returned="C:\\Boot\\sv-SE\\" [0056.894] PathAddBackslashA (in: pszPath="C:\\Boot\\sv-SE\\" | out: pszPath="C:\\Boot\\sv-SE\\") returned="" [0056.894] lstrcatA (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\sv-SE\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\sv-SE\\HOW TO DECRYPT FILES.txt" [0056.894] GetFileAttributesA (lpFileName="C:\\Boot\\sv-SE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sv-se\\how to decrypt files.txt")) returned 0x20 [0056.894] lstrcatA (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\sv-SE\\memtest.exe.mui") returned="C:\\Boot\\sv-SE\\memtest.exe.mui" [0056.894] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0056.894] lstrlenA (lpString="*.zip") returned 5 [0056.894] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0056.894] lstrlenA (lpString="*.rar") returned 5 [0056.894] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0056.894] lstrlenA (lpString="*.7z") returned 4 [0056.895] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0056.895] lstrlenA (lpString="*.tar") returned 5 [0056.895] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0056.895] lstrlenA (lpString="*.gzip") returned 6 [0056.895] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0056.895] lstrlenA (lpString="*.jpg") returned 5 [0056.895] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0056.895] lstrlenA (lpString="*.jpeg") returned 6 [0056.895] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0056.895] lstrlenA (lpString="*.psd") returned 5 [0056.895] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0056.895] lstrlenA (lpString="*.cdr") returned 5 [0056.895] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0056.895] lstrlenA (lpString="*.dwg") returned 5 [0056.895] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.max") returned 0 [0056.895] lstrlenA (lpString="*.max") returned 5 [0056.895] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0056.895] lstrlenA (lpString="*.bmp") returned 5 [0056.895] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0056.895] lstrlenA (lpString="*.gif") returned 5 [0056.895] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.png") returned 0 [0056.895] lstrlenA (lpString="*.png") returned 5 [0056.895] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0056.895] lstrlenA (lpString="*.doc") returned 5 [0056.895] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0056.895] lstrlenA (lpString="*.docx") returned 6 [0056.895] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0056.895] lstrlenA (lpString="*.xls") returned 5 [0056.895] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0056.895] lstrlenA (lpString="*.xlsx") returned 6 [0056.895] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0056.895] lstrlenA (lpString="*.ppt") returned 5 [0056.895] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0056.896] lstrlenA (lpString="*.pptx") returned 6 [0056.896] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0056.896] lstrlenA (lpString="*.txt") returned 5 [0056.896] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0056.896] lstrlenA (lpString="*.pdf") returned 5 [0056.896] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0056.896] lstrlenA (lpString="*.djvu") returned 6 [0056.896] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0056.896] lstrlenA (lpString="*.htm") returned 5 [0056.896] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.html") returned 0 [0056.896] lstrlenA (lpString="*.html") returned 6 [0056.896] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0056.896] lstrlenA (lpString="*.mdb") returned 5 [0056.896] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0056.896] lstrlenA (lpString="*.cer") returned 5 [0056.896] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0056.896] lstrlenA (lpString="*.p12") returned 5 [0056.896] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0056.896] lstrlenA (lpString="*.pfx") returned 5 [0056.896] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0056.896] lstrlenA (lpString="*.kwm") returned 5 [0056.896] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0056.896] lstrlenA (lpString="*.pwm") returned 5 [0056.896] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0056.896] lstrlenA (lpString="*.1cd") returned 5 [0056.896] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.md") returned 0 [0056.896] lstrlenA (lpString="*.md") returned 4 [0056.896] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0056.896] lstrlenA (lpString="*.mdf") returned 5 [0056.896] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0056.896] lstrlenA (lpString="*.dbf") returned 5 [0056.896] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0056.896] lstrlenA (lpString="*.odt") returned 5 [0056.896] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0056.897] lstrlenA (lpString="*.vob") returned 5 [0056.897] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0056.897] lstrlenA (lpString="*.ifo") returned 5 [0056.897] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0056.897] lstrlenA (lpString="*.lnk") returned 5 [0056.897] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0056.897] lstrlenA (lpString="*.torrent") returned 9 [0056.897] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0056.897] lstrlenA (lpString="*.mov") returned 5 [0056.897] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0056.897] lstrlenA (lpString="*.m2v") returned 5 [0056.897] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0056.897] lstrlenA (lpString="*.3gp") returned 5 [0056.897] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0056.897] lstrlenA (lpString="*.mpeg") returned 6 [0056.897] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0056.897] lstrlenA (lpString="*.mpg") returned 5 [0056.897] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0056.897] lstrlenA (lpString="*.flv") returned 5 [0056.897] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0056.897] lstrlenA (lpString="*.avi") returned 5 [0056.897] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0056.897] lstrlenA (lpString="*.mp4") returned 5 [0056.897] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0056.897] lstrlenA (lpString="*.wmv") returned 5 [0056.897] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0056.897] lstrlenA (lpString="*.divx") returned 6 [0056.897] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0056.897] lstrlenA (lpString="*.mkv") returned 5 [0056.897] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0056.897] lstrlenA (lpString="*.mp3") returned 5 [0056.898] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0056.898] lstrlenA (lpString="*.wav") returned 5 [0056.898] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0056.898] lstrlenA (lpString="*.flac") returned 6 [0056.898] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0056.898] lstrlenA (lpString="*.ape") returned 5 [0056.898] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0056.898] lstrlenA (lpString="*.wma") returned 5 [0056.898] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0056.898] lstrlenA (lpString="*.ac3") returned 5 [0056.898] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0056.898] FindClose (in: hFindFile=0x6365b0 | out: hFindFile=0x6365b0) returned 1 [0056.898] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0056.898] lstrcmpA (lpString1=".", lpString2="tr-TR") returned -1 [0056.898] lstrcmpA (lpString1="..", lpString2="tr-TR") returned -1 [0056.898] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.898] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="tr-TR" | out: lpString1="C:\\Boot\\tr-TR") returned="C:\\Boot\\tr-TR" [0056.898] lstrlenA (lpString="C:\\Boot\\tr-TR") returned 13 [0056.898] FindFirstFileA (in: lpFileName="C:\\Boot\\tr-TR\\*.*" (normalized: "c:\\boot\\tr-tr\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636630 [0056.899] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.899] FindNextFileA (in: hFindFile=0x636630, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.899] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.899] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.899] FindNextFileA (in: hFindFile=0x636630, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.899] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.899] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.899] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.899] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.899] PathFindFileNameA (pszPath="C:\\Boot\\tr-TR\\*.*") returned="*.*" [0056.899] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\tr-TR\\" | out: lpString1="C:\\Boot\\tr-TR\\") returned="C:\\Boot\\tr-TR\\" [0056.899] PathAddBackslashA (in: pszPath="C:\\Boot\\tr-TR\\" | out: pszPath="C:\\Boot\\tr-TR\\") returned="" [0056.899] lstrcatA (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\tr-TR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\tr-TR\\HOW TO DECRYPT FILES.txt" [0056.899] GetFileAttributesA (lpFileName="C:\\Boot\\tr-TR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\tr-tr\\how to decrypt files.txt")) returned 0xffffffff [0056.900] CreateFileA (lpFileName="C:\\Boot\\tr-TR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\tr-tr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.901] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.901] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.902] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.902] CloseHandle (hObject=0x1c4) returned 1 [0056.903] lstrcatA (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned="C:\\Boot\\tr-TR\\bootmgr.exe.mui" [0056.903] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.903] lstrlenA (lpString="*.zip") returned 5 [0056.903] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.903] lstrlenA (lpString="*.rar") returned 5 [0056.903] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.903] lstrlenA (lpString="*.7z") returned 4 [0056.903] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.903] lstrlenA (lpString="*.tar") returned 5 [0056.903] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.903] lstrlenA (lpString="*.gzip") returned 6 [0056.903] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.903] lstrlenA (lpString="*.jpg") returned 5 [0056.903] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.903] lstrlenA (lpString="*.jpeg") returned 6 [0056.903] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.903] lstrlenA (lpString="*.psd") returned 5 [0056.903] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.903] lstrlenA (lpString="*.cdr") returned 5 [0056.903] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.903] lstrlenA (lpString="*.dwg") returned 5 [0056.903] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.903] lstrlenA (lpString="*.max") returned 5 [0056.903] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.903] lstrlenA (lpString="*.bmp") returned 5 [0056.903] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.903] lstrlenA (lpString="*.gif") returned 5 [0056.904] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.904] lstrlenA (lpString="*.png") returned 5 [0056.904] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.904] lstrlenA (lpString="*.doc") returned 5 [0056.904] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.904] lstrlenA (lpString="*.docx") returned 6 [0056.904] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.904] lstrlenA (lpString="*.xls") returned 5 [0056.904] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.904] lstrlenA (lpString="*.xlsx") returned 6 [0056.904] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.904] lstrlenA (lpString="*.ppt") returned 5 [0056.904] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.904] lstrlenA (lpString="*.pptx") returned 6 [0056.904] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.904] lstrlenA (lpString="*.txt") returned 5 [0056.904] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.904] lstrlenA (lpString="*.pdf") returned 5 [0056.904] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.904] lstrlenA (lpString="*.djvu") returned 6 [0056.904] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.904] lstrlenA (lpString="*.htm") returned 5 [0056.904] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.904] lstrlenA (lpString="*.html") returned 6 [0056.904] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.904] lstrlenA (lpString="*.mdb") returned 5 [0056.904] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.904] lstrlenA (lpString="*.cer") returned 5 [0056.904] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.904] lstrlenA (lpString="*.p12") returned 5 [0056.904] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.904] lstrlenA (lpString="*.pfx") returned 5 [0056.904] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.904] lstrlenA (lpString="*.kwm") returned 5 [0056.905] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.905] lstrlenA (lpString="*.pwm") returned 5 [0056.905] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.905] lstrlenA (lpString="*.1cd") returned 5 [0056.905] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.905] lstrlenA (lpString="*.md") returned 4 [0056.905] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.905] lstrlenA (lpString="*.mdf") returned 5 [0056.905] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.905] lstrlenA (lpString="*.dbf") returned 5 [0056.905] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.905] lstrlenA (lpString="*.odt") returned 5 [0056.905] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.905] lstrlenA (lpString="*.vob") returned 5 [0056.905] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.905] lstrlenA (lpString="*.ifo") returned 5 [0056.905] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.905] lstrlenA (lpString="*.lnk") returned 5 [0056.905] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.905] lstrlenA (lpString="*.torrent") returned 9 [0056.905] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.905] lstrlenA (lpString="*.mov") returned 5 [0056.905] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.905] lstrlenA (lpString="*.m2v") returned 5 [0056.905] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.905] lstrlenA (lpString="*.3gp") returned 5 [0056.905] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.905] lstrlenA (lpString="*.mpeg") returned 6 [0056.905] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.905] lstrlenA (lpString="*.mpg") returned 5 [0056.905] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.905] lstrlenA (lpString="*.flv") returned 5 [0056.905] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.906] lstrlenA (lpString="*.avi") returned 5 [0056.906] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.906] lstrlenA (lpString="*.mp4") returned 5 [0056.906] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.906] lstrlenA (lpString="*.wmv") returned 5 [0056.906] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.906] lstrlenA (lpString="*.divx") returned 6 [0056.906] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.906] lstrlenA (lpString="*.mkv") returned 5 [0056.906] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.906] lstrlenA (lpString="*.mp3") returned 5 [0056.906] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.906] lstrlenA (lpString="*.wav") returned 5 [0056.906] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.906] lstrlenA (lpString="*.flac") returned 6 [0056.906] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.906] lstrlenA (lpString="*.ape") returned 5 [0056.906] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.906] lstrlenA (lpString="*.wma") returned 5 [0056.906] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.906] lstrlenA (lpString="*.ac3") returned 5 [0056.906] FindNextFileA (in: hFindFile=0x636630, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.906] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.906] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0056.906] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0056.906] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0056.906] PathFindFileNameA (pszPath="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0056.906] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\tr-TR\\" | out: lpString1="C:\\Boot\\tr-TR\\") returned="C:\\Boot\\tr-TR\\" [0056.906] PathAddBackslashA (in: pszPath="C:\\Boot\\tr-TR\\" | out: pszPath="C:\\Boot\\tr-TR\\") returned="" [0056.906] lstrcatA (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\tr-TR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\tr-TR\\HOW TO DECRYPT FILES.txt" [0056.906] GetFileAttributesA (lpFileName="C:\\Boot\\tr-TR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\tr-tr\\how to decrypt files.txt")) returned 0x20 [0056.907] lstrcatA (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\tr-TR\\memtest.exe.mui") returned="C:\\Boot\\tr-TR\\memtest.exe.mui" [0056.907] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0056.907] lstrlenA (lpString="*.zip") returned 5 [0056.907] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0056.907] lstrlenA (lpString="*.rar") returned 5 [0056.907] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0056.907] lstrlenA (lpString="*.7z") returned 4 [0056.907] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0056.907] lstrlenA (lpString="*.tar") returned 5 [0056.907] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0056.907] lstrlenA (lpString="*.gzip") returned 6 [0056.907] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0056.907] lstrlenA (lpString="*.jpg") returned 5 [0056.907] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0056.907] lstrlenA (lpString="*.jpeg") returned 6 [0056.907] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0056.907] lstrlenA (lpString="*.psd") returned 5 [0056.907] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0056.907] lstrlenA (lpString="*.cdr") returned 5 [0056.907] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0056.907] lstrlenA (lpString="*.dwg") returned 5 [0056.907] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.max") returned 0 [0056.907] lstrlenA (lpString="*.max") returned 5 [0056.907] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0056.907] lstrlenA (lpString="*.bmp") returned 5 [0056.907] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0056.907] lstrlenA (lpString="*.gif") returned 5 [0056.907] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.png") returned 0 [0056.907] lstrlenA (lpString="*.png") returned 5 [0056.907] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0056.907] lstrlenA (lpString="*.doc") returned 5 [0056.907] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0056.907] lstrlenA (lpString="*.docx") returned 6 [0056.908] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0056.908] lstrlenA (lpString="*.xls") returned 5 [0056.908] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0056.908] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0056.908] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0056.908] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0056.908] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0056.910] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0056.910] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0056.910] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.html") returned 0 [0056.910] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0056.910] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0056.910] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0056.910] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0056.910] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0056.910] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0056.910] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0056.910] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.md") returned 0 [0056.910] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0056.910] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0056.910] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0056.910] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0056.910] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0056.910] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0056.911] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0056.911] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0056.911] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0056.911] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0056.911] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0056.911] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0056.911] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0056.911] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0056.911] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0056.911] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0056.911] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0056.911] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0056.911] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0056.911] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0056.911] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0056.911] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0056.911] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0056.911] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0056.911] FindNextFileA (in: hFindFile=0x636630, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0056.911] FindClose (in: hFindFile=0x636630 | out: hFindFile=0x636630) returned 1 [0056.911] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0056.911] lstrcmpA (lpString1=".", lpString2="uk-UA") returned -1 [0056.912] lstrcmpA (lpString1="..", lpString2="uk-UA") returned -1 [0056.912] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.912] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="uk-UA" | out: lpString1="C:\\Boot\\uk-UA") returned="C:\\Boot\\uk-UA" [0056.912] FindFirstFileA (in: lpFileName="C:\\Boot\\uk-UA\\*.*" (normalized: "c:\\boot\\uk-ua\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6365b0 [0056.912] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.912] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.912] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.912] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.913] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.913] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.913] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.913] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.913] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.913] PathFindFileNameA (pszPath="C:\\Boot\\uk-UA\\*.*") returned="*.*" [0056.913] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\uk-UA\\" | out: lpString1="C:\\Boot\\uk-UA\\") returned="C:\\Boot\\uk-UA\\" [0056.913] PathAddBackslashA (in: pszPath="C:\\Boot\\uk-UA\\" | out: pszPath="C:\\Boot\\uk-UA\\") returned="" [0056.913] lstrcatA (in: lpString1="C:\\Boot\\uk-UA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\uk-UA\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\uk-UA\\HOW TO DECRYPT FILES.txt" [0056.913] GetFileAttributesA (lpFileName="C:\\Boot\\uk-UA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\uk-ua\\how to decrypt files.txt")) returned 0xffffffff [0056.913] CreateFileA (lpFileName="C:\\Boot\\uk-UA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\uk-ua\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.913] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.914] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.914] CloseHandle (hObject=0x1c4) returned 1 [0056.914] lstrcatA (in: lpString1="C:\\Boot\\uk-UA\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\uk-UA\\bootmgr.exe.mui") returned="C:\\Boot\\uk-UA\\bootmgr.exe.mui" [0056.915] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.915] lstrlenA (lpString="*.zip") returned 5 [0056.915] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.915] lstrlenA (lpString="*.rar") returned 5 [0056.915] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.915] lstrlenA (lpString="*.7z") returned 4 [0056.915] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.915] lstrlenA (lpString="*.tar") returned 5 [0056.915] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.915] lstrlenA (lpString="*.gzip") returned 6 [0056.915] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.915] lstrlenA (lpString="*.jpg") returned 5 [0056.915] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.915] lstrlenA (lpString="*.jpeg") returned 6 [0056.915] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.915] lstrlenA (lpString="*.psd") returned 5 [0056.915] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.915] lstrlenA (lpString="*.cdr") returned 5 [0056.915] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.915] lstrlenA (lpString="*.dwg") returned 5 [0056.915] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.915] lstrlenA (lpString="*.max") returned 5 [0056.915] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.915] lstrlenA (lpString="*.bmp") returned 5 [0056.915] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.915] lstrlenA (lpString="*.gif") returned 5 [0056.915] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.915] lstrlenA (lpString="*.png") returned 5 [0056.915] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.915] lstrlenA (lpString="*.doc") returned 5 [0056.915] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.915] lstrlenA (lpString="*.docx") returned 6 [0056.915] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.916] lstrlenA (lpString="*.xls") returned 5 [0056.916] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.916] lstrlenA (lpString="*.xlsx") returned 6 [0056.916] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.916] lstrlenA (lpString="*.ppt") returned 5 [0056.916] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.916] lstrlenA (lpString="*.pptx") returned 6 [0056.916] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.916] lstrlenA (lpString="*.txt") returned 5 [0056.916] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.916] lstrlenA (lpString="*.pdf") returned 5 [0056.916] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.916] lstrlenA (lpString="*.djvu") returned 6 [0056.916] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.916] lstrlenA (lpString="*.htm") returned 5 [0056.916] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.916] lstrlenA (lpString="*.html") returned 6 [0056.916] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.916] lstrlenA (lpString="*.mdb") returned 5 [0056.916] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.916] lstrlenA (lpString="*.cer") returned 5 [0056.916] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.916] lstrlenA (lpString="*.p12") returned 5 [0056.916] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.916] lstrlenA (lpString="*.pfx") returned 5 [0056.916] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.916] lstrlenA (lpString="*.kwm") returned 5 [0056.916] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.916] lstrlenA (lpString="*.pwm") returned 5 [0056.916] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.916] lstrlenA (lpString="*.1cd") returned 5 [0056.916] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.916] lstrlenA (lpString="*.md") returned 4 [0056.916] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.916] lstrlenA (lpString="*.mdf") returned 5 [0056.917] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.917] lstrlenA (lpString="*.dbf") returned 5 [0056.917] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.917] lstrlenA (lpString="*.odt") returned 5 [0056.917] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.917] lstrlenA (lpString="*.vob") returned 5 [0056.917] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.917] lstrlenA (lpString="*.ifo") returned 5 [0056.917] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.917] lstrlenA (lpString="*.lnk") returned 5 [0056.917] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.917] lstrlenA (lpString="*.torrent") returned 9 [0056.917] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.917] lstrlenA (lpString="*.mov") returned 5 [0056.917] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.917] lstrlenA (lpString="*.m2v") returned 5 [0056.917] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.917] lstrlenA (lpString="*.3gp") returned 5 [0056.917] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.917] lstrlenA (lpString="*.mpeg") returned 6 [0056.917] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.917] lstrlenA (lpString="*.mpg") returned 5 [0056.917] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.917] lstrlenA (lpString="*.flv") returned 5 [0056.917] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.917] lstrlenA (lpString="*.avi") returned 5 [0056.917] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.917] lstrlenA (lpString="*.mp4") returned 5 [0056.917] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.917] lstrlenA (lpString="*.wmv") returned 5 [0056.917] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.917] lstrlenA (lpString="*.divx") returned 6 [0056.917] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.917] lstrlenA (lpString="*.mkv") returned 5 [0056.917] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.918] lstrlenA (lpString="*.mp3") returned 5 [0056.918] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.918] lstrlenA (lpString="*.wav") returned 5 [0056.918] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.918] lstrlenA (lpString="*.flac") returned 6 [0056.918] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.918] lstrlenA (lpString="*.ape") returned 5 [0056.918] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.918] lstrlenA (lpString="*.wma") returned 5 [0056.918] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.918] lstrlenA (lpString="*.ac3") returned 5 [0056.918] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0056.918] FindClose (in: hFindFile=0x6365b0 | out: hFindFile=0x6365b0) returned 1 [0056.918] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a8f7b9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a8f7b9, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0056.918] lstrcmpA (lpString1=".", lpString2="zh-CN") returned -1 [0056.918] lstrcmpA (lpString1="..", lpString2="zh-CN") returned -1 [0056.918] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.918] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="zh-CN" | out: lpString1="C:\\Boot\\zh-CN") returned="C:\\Boot\\zh-CN" [0056.918] lstrlenA (lpString="C:\\Boot\\zh-CN") returned 13 [0056.918] FindFirstFileA (in: lpFileName="C:\\Boot\\zh-CN\\*.*" (normalized: "c:\\boot\\zh-cn\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a8f7b9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a8f7b9, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636930 [0056.918] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.918] FindNextFileA (in: hFindFile=0x636930, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a8f7b9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a8f7b9, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.918] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.918] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.919] FindNextFileA (in: hFindFile=0x636930, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a8f7b9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a8f7b9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.919] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.919] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.919] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.919] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.919] PathFindFileNameA (pszPath="C:\\Boot\\zh-CN\\*.*") returned="*.*" [0056.919] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\zh-CN\\" | out: lpString1="C:\\Boot\\zh-CN\\") returned="C:\\Boot\\zh-CN\\" [0056.919] PathAddBackslashA (in: pszPath="C:\\Boot\\zh-CN\\" | out: pszPath="C:\\Boot\\zh-CN\\") returned="" [0056.919] lstrcatA (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\zh-CN\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\zh-CN\\HOW TO DECRYPT FILES.txt" [0056.919] GetFileAttributesA (lpFileName="C:\\Boot\\zh-CN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-cn\\how to decrypt files.txt")) returned 0xffffffff [0056.919] CreateFileA (lpFileName="C:\\Boot\\zh-CN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-cn\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.921] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.921] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.922] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.922] CloseHandle (hObject=0x1c4) returned 1 [0056.922] lstrcatA (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned="C:\\Boot\\zh-CN\\bootmgr.exe.mui" [0056.922] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.922] lstrlenA (lpString="*.zip") returned 5 [0056.922] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.922] lstrlenA (lpString="*.rar") returned 5 [0056.922] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.922] lstrlenA (lpString="*.7z") returned 4 [0056.922] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.922] lstrlenA (lpString="*.tar") returned 5 [0056.922] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.922] lstrlenA (lpString="*.gzip") returned 6 [0056.922] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.923] lstrlenA (lpString="*.jpg") returned 5 [0056.923] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.923] lstrlenA (lpString="*.jpeg") returned 6 [0056.923] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.923] lstrlenA (lpString="*.psd") returned 5 [0056.923] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.923] lstrlenA (lpString="*.cdr") returned 5 [0056.923] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.923] lstrlenA (lpString="*.dwg") returned 5 [0056.923] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.923] lstrlenA (lpString="*.max") returned 5 [0056.923] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.923] lstrlenA (lpString="*.bmp") returned 5 [0056.923] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.923] lstrlenA (lpString="*.gif") returned 5 [0056.923] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.923] lstrlenA (lpString="*.png") returned 5 [0056.923] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.923] lstrlenA (lpString="*.doc") returned 5 [0056.923] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.923] lstrlenA (lpString="*.docx") returned 6 [0056.923] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.923] lstrlenA (lpString="*.xls") returned 5 [0056.923] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.923] lstrlenA (lpString="*.xlsx") returned 6 [0056.923] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.923] lstrlenA (lpString="*.ppt") returned 5 [0056.923] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.923] lstrlenA (lpString="*.pptx") returned 6 [0056.923] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.923] lstrlenA (lpString="*.txt") returned 5 [0056.958] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.958] lstrlenA (lpString="*.pdf") returned 5 [0056.958] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.958] lstrlenA (lpString="*.djvu") returned 6 [0056.958] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.958] lstrlenA (lpString="*.htm") returned 5 [0056.958] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.958] lstrlenA (lpString="*.html") returned 6 [0056.958] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.958] lstrlenA (lpString="*.mdb") returned 5 [0056.958] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.958] lstrlenA (lpString="*.cer") returned 5 [0056.958] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.958] lstrlenA (lpString="*.p12") returned 5 [0056.958] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.958] lstrlenA (lpString="*.pfx") returned 5 [0056.958] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.958] lstrlenA (lpString="*.kwm") returned 5 [0056.958] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.958] lstrlenA (lpString="*.pwm") returned 5 [0056.958] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.958] lstrlenA (lpString="*.1cd") returned 5 [0056.958] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.958] lstrlenA (lpString="*.md") returned 4 [0056.959] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.959] lstrlenA (lpString="*.mdf") returned 5 [0056.959] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.959] lstrlenA (lpString="*.dbf") returned 5 [0056.959] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.959] lstrlenA (lpString="*.odt") returned 5 [0056.959] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.959] lstrlenA (lpString="*.vob") returned 5 [0056.959] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.959] lstrlenA (lpString="*.ifo") returned 5 [0056.959] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.959] lstrlenA (lpString="*.lnk") returned 5 [0056.959] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.959] lstrlenA (lpString="*.torrent") returned 9 [0056.959] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.959] lstrlenA (lpString="*.mov") returned 5 [0056.959] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.959] lstrlenA (lpString="*.m2v") returned 5 [0056.959] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.959] lstrlenA (lpString="*.3gp") returned 5 [0056.959] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.959] lstrlenA (lpString="*.mpeg") returned 6 [0056.959] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.959] lstrlenA (lpString="*.mpg") returned 5 [0056.959] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.959] lstrlenA (lpString="*.flv") returned 5 [0056.959] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.959] lstrlenA (lpString="*.avi") returned 5 [0056.959] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.959] lstrlenA (lpString="*.mp4") returned 5 [0056.959] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.959] lstrlenA (lpString="*.wmv") returned 5 [0056.960] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.960] lstrlenA (lpString="*.divx") returned 6 [0056.960] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.960] lstrlenA (lpString="*.mkv") returned 5 [0056.960] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.960] lstrlenA (lpString="*.mp3") returned 5 [0056.960] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.960] lstrlenA (lpString="*.wav") returned 5 [0056.960] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.960] lstrlenA (lpString="*.flac") returned 6 [0056.960] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.960] lstrlenA (lpString="*.ape") returned 5 [0056.960] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.960] lstrlenA (lpString="*.wma") returned 5 [0056.960] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.960] lstrlenA (lpString="*.ac3") returned 5 [0056.960] FindNextFileA (in: hFindFile=0x636930, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a8f7b9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a8f7b9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa560, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.960] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.961] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0056.961] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0056.961] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0056.961] PathFindFileNameA (pszPath="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0056.961] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\zh-CN\\" | out: lpString1="C:\\Boot\\zh-CN\\") returned="C:\\Boot\\zh-CN\\" [0056.961] PathAddBackslashA (in: pszPath="C:\\Boot\\zh-CN\\" | out: pszPath="C:\\Boot\\zh-CN\\") returned="" [0056.961] lstrcatA (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\zh-CN\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\zh-CN\\HOW TO DECRYPT FILES.txt" [0056.961] GetFileAttributesA (lpFileName="C:\\Boot\\zh-CN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-cn\\how to decrypt files.txt")) returned 0x20 [0056.961] lstrcatA (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\zh-CN\\memtest.exe.mui") returned="C:\\Boot\\zh-CN\\memtest.exe.mui" [0056.961] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0056.961] lstrlenA (lpString="*.zip") returned 5 [0056.961] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0056.961] lstrlenA (lpString="*.rar") returned 5 [0056.961] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0056.961] lstrlenA (lpString="*.7z") returned 4 [0056.961] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0056.961] lstrlenA (lpString="*.tar") returned 5 [0056.961] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0056.961] lstrlenA (lpString="*.gzip") returned 6 [0056.961] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0056.961] lstrlenA (lpString="*.jpg") returned 5 [0056.961] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0056.961] lstrlenA (lpString="*.jpeg") returned 6 [0056.961] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0056.962] lstrlenA (lpString="*.psd") returned 5 [0056.962] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0056.962] lstrlenA (lpString="*.cdr") returned 5 [0056.962] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0056.962] lstrlenA (lpString="*.dwg") returned 5 [0056.962] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.max") returned 0 [0056.962] lstrlenA (lpString="*.max") returned 5 [0056.962] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0056.962] lstrlenA (lpString="*.bmp") returned 5 [0056.962] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0056.962] lstrlenA (lpString="*.gif") returned 5 [0056.962] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.png") returned 0 [0056.962] lstrlenA (lpString="*.png") returned 5 [0056.962] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0056.962] lstrlenA (lpString="*.doc") returned 5 [0056.962] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0056.962] lstrlenA (lpString="*.docx") returned 6 [0056.962] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0056.962] lstrlenA (lpString="*.xls") returned 5 [0056.962] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0056.962] lstrlenA (lpString="*.xlsx") returned 6 [0056.962] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0056.962] lstrlenA (lpString="*.ppt") returned 5 [0056.962] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0056.962] lstrlenA (lpString="*.pptx") returned 6 [0056.962] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0056.962] lstrlenA (lpString="*.txt") returned 5 [0056.963] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0056.963] lstrlenA (lpString="*.pdf") returned 5 [0056.963] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0056.963] lstrlenA (lpString="*.djvu") returned 6 [0056.963] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0056.963] lstrlenA (lpString="*.htm") returned 5 [0056.963] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.html") returned 0 [0056.963] lstrlenA (lpString="*.html") returned 6 [0056.963] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0056.963] lstrlenA (lpString="*.mdb") returned 5 [0056.963] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0056.963] lstrlenA (lpString="*.cer") returned 5 [0056.963] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0056.963] lstrlenA (lpString="*.p12") returned 5 [0056.963] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0056.963] lstrlenA (lpString="*.pfx") returned 5 [0056.963] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0056.963] lstrlenA (lpString="*.kwm") returned 5 [0056.963] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0056.963] lstrlenA (lpString="*.pwm") returned 5 [0056.963] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0056.963] lstrlenA (lpString="*.1cd") returned 5 [0056.963] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.md") returned 0 [0056.963] lstrlenA (lpString="*.md") returned 4 [0056.963] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0056.963] lstrlenA (lpString="*.mdf") returned 5 [0056.963] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0056.963] lstrlenA (lpString="*.dbf") returned 5 [0056.963] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0056.964] lstrlenA (lpString="*.odt") returned 5 [0056.964] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0056.964] lstrlenA (lpString="*.vob") returned 5 [0056.964] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0056.964] lstrlenA (lpString="*.ifo") returned 5 [0056.964] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0056.964] lstrlenA (lpString="*.lnk") returned 5 [0056.964] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0056.964] lstrlenA (lpString="*.torrent") returned 9 [0056.964] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0056.964] lstrlenA (lpString="*.mov") returned 5 [0056.964] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0056.964] lstrlenA (lpString="*.m2v") returned 5 [0056.964] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0056.964] lstrlenA (lpString="*.3gp") returned 5 [0056.964] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0056.964] lstrlenA (lpString="*.mpeg") returned 6 [0056.964] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0056.964] lstrlenA (lpString="*.mpg") returned 5 [0056.964] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0056.964] lstrlenA (lpString="*.flv") returned 5 [0056.964] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0056.964] lstrlenA (lpString="*.avi") returned 5 [0056.964] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0056.964] lstrlenA (lpString="*.mp4") returned 5 [0056.964] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0056.964] lstrlenA (lpString="*.wmv") returned 5 [0056.964] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0056.964] lstrlenA (lpString="*.divx") returned 6 [0056.964] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0056.964] lstrlenA (lpString="*.mkv") returned 5 [0056.964] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0056.965] lstrlenA (lpString="*.mp3") returned 5 [0056.965] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0056.965] lstrlenA (lpString="*.wav") returned 5 [0056.965] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0056.965] lstrlenA (lpString="*.flac") returned 6 [0056.965] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0056.965] lstrlenA (lpString="*.ape") returned 5 [0056.965] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0056.965] lstrlenA (lpString="*.wma") returned 5 [0056.965] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0056.965] lstrlenA (lpString="*.ac3") returned 5 [0056.965] FindNextFileA (in: hFindFile=0x636930, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a8f7b9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a8f7b9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa560, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0056.965] FindClose (in: hFindFile=0x636930 | out: hFindFile=0x636930) returned 1 [0056.965] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a8f7b9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78ab5a49, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0056.965] lstrcmpA (lpString1=".", lpString2="zh-HK") returned -1 [0056.965] lstrcmpA (lpString1="..", lpString2="zh-HK") returned -1 [0056.965] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.965] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="zh-HK" | out: lpString1="C:\\Boot\\zh-HK") returned="C:\\Boot\\zh-HK" [0056.965] lstrlenA (lpString="C:\\Boot\\zh-HK") returned 13 [0056.965] FindFirstFileA (in: lpFileName="C:\\Boot\\zh-HK\\*.*" (normalized: "c:\\boot\\zh-hk\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a8f7b9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78ab5a49, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636870 [0056.966] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.966] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a8f7b9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78ab5a49, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.966] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.966] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.966] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a8f7b9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a8f7b9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf958, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.966] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.966] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.966] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.966] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.966] PathFindFileNameA (pszPath="C:\\Boot\\zh-HK\\*.*") returned="*.*" [0056.966] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\zh-HK\\" | out: lpString1="C:\\Boot\\zh-HK\\") returned="C:\\Boot\\zh-HK\\" [0056.966] PathAddBackslashA (in: pszPath="C:\\Boot\\zh-HK\\" | out: pszPath="C:\\Boot\\zh-HK\\") returned="" [0056.967] lstrcatA (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\zh-HK\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\zh-HK\\HOW TO DECRYPT FILES.txt" [0056.967] GetFileAttributesA (lpFileName="C:\\Boot\\zh-HK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-hk\\how to decrypt files.txt")) returned 0xffffffff [0056.967] CreateFileA (lpFileName="C:\\Boot\\zh-HK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-hk\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.969] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.969] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.971] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.971] CloseHandle (hObject=0x1c4) returned 1 [0056.971] lstrcatA (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned="C:\\Boot\\zh-HK\\bootmgr.exe.mui" [0056.971] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.971] lstrlenA (lpString="*.zip") returned 5 [0056.971] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.971] lstrlenA (lpString="*.rar") returned 5 [0056.971] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.971] lstrlenA (lpString="*.7z") returned 4 [0056.971] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.971] lstrlenA (lpString="*.tar") returned 5 [0056.971] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.971] lstrlenA (lpString="*.gzip") returned 6 [0056.971] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.971] lstrlenA (lpString="*.jpg") returned 5 [0056.971] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.971] lstrlenA (lpString="*.jpeg") returned 6 [0056.971] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.972] lstrlenA (lpString="*.psd") returned 5 [0056.972] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.972] lstrlenA (lpString="*.cdr") returned 5 [0056.972] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.972] lstrlenA (lpString="*.dwg") returned 5 [0056.972] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.972] lstrlenA (lpString="*.max") returned 5 [0056.972] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.972] lstrlenA (lpString="*.bmp") returned 5 [0056.972] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.972] lstrlenA (lpString="*.gif") returned 5 [0056.972] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.972] lstrlenA (lpString="*.png") returned 5 [0056.972] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.972] lstrlenA (lpString="*.doc") returned 5 [0056.972] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.972] lstrlenA (lpString="*.docx") returned 6 [0056.972] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.972] lstrlenA (lpString="*.xls") returned 5 [0056.972] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.972] lstrlenA (lpString="*.xlsx") returned 6 [0056.972] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.972] lstrlenA (lpString="*.ppt") returned 5 [0056.972] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.972] lstrlenA (lpString="*.pptx") returned 6 [0056.972] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.972] lstrlenA (lpString="*.txt") returned 5 [0056.972] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.972] lstrlenA (lpString="*.pdf") returned 5 [0056.972] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.972] lstrlenA (lpString="*.djvu") returned 6 [0056.972] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.972] lstrlenA (lpString="*.htm") returned 5 [0056.972] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.973] lstrlenA (lpString="*.html") returned 6 [0056.973] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.973] lstrlenA (lpString="*.mdb") returned 5 [0056.973] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.973] lstrlenA (lpString="*.cer") returned 5 [0056.973] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.973] lstrlenA (lpString="*.p12") returned 5 [0056.973] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.973] lstrlenA (lpString="*.pfx") returned 5 [0056.973] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.973] lstrlenA (lpString="*.kwm") returned 5 [0056.973] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.973] lstrlenA (lpString="*.pwm") returned 5 [0056.973] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.973] lstrlenA (lpString="*.1cd") returned 5 [0056.973] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.973] lstrlenA (lpString="*.md") returned 4 [0056.973] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.973] lstrlenA (lpString="*.mdf") returned 5 [0056.973] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.973] lstrlenA (lpString="*.dbf") returned 5 [0056.973] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.973] lstrlenA (lpString="*.odt") returned 5 [0056.973] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.973] lstrlenA (lpString="*.vob") returned 5 [0056.973] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.973] lstrlenA (lpString="*.ifo") returned 5 [0056.973] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.973] lstrlenA (lpString="*.lnk") returned 5 [0056.973] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.973] lstrlenA (lpString="*.torrent") returned 9 [0056.973] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.973] lstrlenA (lpString="*.mov") returned 5 [0056.973] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.974] lstrlenA (lpString="*.m2v") returned 5 [0056.974] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.974] lstrlenA (lpString="*.3gp") returned 5 [0056.974] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.974] lstrlenA (lpString="*.mpeg") returned 6 [0056.974] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.974] lstrlenA (lpString="*.mpg") returned 5 [0056.974] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.974] lstrlenA (lpString="*.flv") returned 5 [0056.974] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.974] lstrlenA (lpString="*.avi") returned 5 [0056.974] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.974] lstrlenA (lpString="*.mp4") returned 5 [0056.974] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.974] lstrlenA (lpString="*.wmv") returned 5 [0056.974] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.974] lstrlenA (lpString="*.divx") returned 6 [0056.974] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.974] lstrlenA (lpString="*.mkv") returned 5 [0056.974] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.974] lstrlenA (lpString="*.mp3") returned 5 [0056.974] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.974] lstrlenA (lpString="*.wav") returned 5 [0056.974] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.974] lstrlenA (lpString="*.flac") returned 6 [0056.974] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.974] lstrlenA (lpString="*.ape") returned 5 [0056.974] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.974] lstrlenA (lpString="*.wma") returned 5 [0056.974] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.975] lstrlenA (lpString="*.ac3") returned 5 [0056.975] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.975] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.975] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0056.975] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0056.975] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0056.975] PathFindFileNameA (pszPath="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0056.975] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\zh-HK\\" | out: lpString1="C:\\Boot\\zh-HK\\") returned="C:\\Boot\\zh-HK\\" [0056.975] PathAddBackslashA (in: pszPath="C:\\Boot\\zh-HK\\" | out: pszPath="C:\\Boot\\zh-HK\\") returned="" [0056.975] lstrcatA (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\zh-HK\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\zh-HK\\HOW TO DECRYPT FILES.txt" [0056.975] GetFileAttributesA (lpFileName="C:\\Boot\\zh-HK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-hk\\how to decrypt files.txt")) returned 0x20 [0056.975] lstrcatA (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\zh-HK\\memtest.exe.mui") returned="C:\\Boot\\zh-HK\\memtest.exe.mui" [0056.975] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0056.975] lstrlenA (lpString="*.zip") returned 5 [0056.975] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0056.975] lstrlenA (lpString="*.rar") returned 5 [0056.975] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0056.975] lstrlenA (lpString="*.7z") returned 4 [0056.975] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0056.975] lstrlenA (lpString="*.tar") returned 5 [0056.975] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0056.975] lstrlenA (lpString="*.gzip") returned 6 [0056.975] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0056.975] lstrlenA (lpString="*.jpg") returned 5 [0056.975] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0056.975] lstrlenA (lpString="*.jpeg") returned 6 [0056.975] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0056.975] lstrlenA (lpString="*.psd") returned 5 [0056.975] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0056.975] lstrlenA (lpString="*.cdr") returned 5 [0056.976] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0056.976] lstrlenA (lpString="*.dwg") returned 5 [0056.976] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.max") returned 0 [0056.976] lstrlenA (lpString="*.max") returned 5 [0056.976] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0056.976] lstrlenA (lpString="*.bmp") returned 5 [0056.976] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0056.976] lstrlenA (lpString="*.gif") returned 5 [0056.976] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.png") returned 0 [0056.976] lstrlenA (lpString="*.png") returned 5 [0056.976] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0056.976] lstrlenA (lpString="*.doc") returned 5 [0056.976] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0056.976] lstrlenA (lpString="*.docx") returned 6 [0056.976] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0056.976] lstrlenA (lpString="*.xls") returned 5 [0056.976] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0056.976] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0056.976] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0056.976] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0056.976] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0056.976] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0056.976] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0056.976] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.html") returned 0 [0056.976] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0056.976] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0056.976] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0056.977] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0056.977] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0056.977] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0056.977] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0056.977] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.md") returned 0 [0056.977] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0056.977] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0056.977] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0056.977] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0056.977] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0056.977] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0056.977] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0056.977] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0056.977] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0056.977] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0056.977] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0056.977] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0056.977] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0056.977] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0056.977] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0056.977] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0056.977] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0056.977] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0056.978] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0056.978] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0056.978] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0056.978] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0056.978] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0056.978] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0056.978] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0056.978] FindClose (in: hFindFile=0x636870 | out: hFindFile=0x636870) returned 1 [0056.978] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78ab5a49, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0056.978] lstrcmpA (lpString1=".", lpString2="zh-TW") returned -1 [0056.978] lstrcmpA (lpString1="..", lpString2="zh-TW") returned -1 [0056.978] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0056.978] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="zh-TW" | out: lpString1="C:\\Boot\\zh-TW") returned="C:\\Boot\\zh-TW" [0056.978] FindFirstFileA (in: lpFileName="C:\\Boot\\zh-TW\\*.*" (normalized: "c:\\boot\\zh-tw\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78ab5a49, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6364b0 [0056.980] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.980] FindNextFileA (in: hFindFile=0x6364b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78ab5a49, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.980] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.980] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.980] FindNextFileA (in: hFindFile=0x6364b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.980] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.980] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.980] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0056.980] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0056.980] PathFindFileNameA (pszPath="C:\\Boot\\zh-TW\\*.*") returned="*.*" [0056.980] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\zh-TW\\" | out: lpString1="C:\\Boot\\zh-TW\\") returned="C:\\Boot\\zh-TW\\" [0056.980] PathAddBackslashA (in: pszPath="C:\\Boot\\zh-TW\\" | out: pszPath="C:\\Boot\\zh-TW\\") returned="" [0056.980] lstrcatA (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\zh-TW\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\zh-TW\\HOW TO DECRYPT FILES.txt" [0056.980] GetFileAttributesA (lpFileName="C:\\Boot\\zh-TW\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-tw\\how to decrypt files.txt")) returned 0xffffffff [0056.980] CreateFileA (lpFileName="C:\\Boot\\zh-TW\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-tw\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.982] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0056.983] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.983] CloseHandle (hObject=0x1c4) returned 1 [0056.983] lstrcatA (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned="C:\\Boot\\zh-TW\\bootmgr.exe.mui" [0056.983] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0056.983] lstrlenA (lpString="*.zip") returned 5 [0056.983] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0056.983] lstrlenA (lpString="*.rar") returned 5 [0056.983] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0056.983] lstrlenA (lpString="*.7z") returned 4 [0056.983] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0056.983] lstrlenA (lpString="*.tar") returned 5 [0056.983] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0056.983] lstrlenA (lpString="*.gzip") returned 6 [0056.983] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0056.983] lstrlenA (lpString="*.jpg") returned 5 [0056.984] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0056.984] lstrlenA (lpString="*.jpeg") returned 6 [0056.984] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0056.984] lstrlenA (lpString="*.psd") returned 5 [0056.984] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0056.984] lstrlenA (lpString="*.cdr") returned 5 [0056.984] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0056.984] lstrlenA (lpString="*.dwg") returned 5 [0056.984] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0056.984] lstrlenA (lpString="*.max") returned 5 [0056.984] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0056.984] lstrlenA (lpString="*.bmp") returned 5 [0056.984] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0056.984] lstrlenA (lpString="*.gif") returned 5 [0056.984] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0056.984] lstrlenA (lpString="*.png") returned 5 [0056.984] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0056.984] lstrlenA (lpString="*.doc") returned 5 [0056.984] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0056.984] lstrlenA (lpString="*.docx") returned 6 [0056.984] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0056.984] lstrlenA (lpString="*.xls") returned 5 [0056.984] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0056.984] lstrlenA (lpString="*.xlsx") returned 6 [0056.984] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0056.984] lstrlenA (lpString="*.ppt") returned 5 [0056.984] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0056.984] lstrlenA (lpString="*.pptx") returned 6 [0056.984] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0056.984] lstrlenA (lpString="*.txt") returned 5 [0056.984] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0056.984] lstrlenA (lpString="*.pdf") returned 5 [0056.985] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0056.985] lstrlenA (lpString="*.djvu") returned 6 [0056.985] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0056.985] lstrlenA (lpString="*.htm") returned 5 [0056.985] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0056.985] lstrlenA (lpString="*.html") returned 6 [0056.985] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0056.985] lstrlenA (lpString="*.mdb") returned 5 [0056.985] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0056.985] lstrlenA (lpString="*.cer") returned 5 [0056.985] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0056.985] lstrlenA (lpString="*.p12") returned 5 [0056.985] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0056.985] lstrlenA (lpString="*.pfx") returned 5 [0056.985] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0056.985] lstrlenA (lpString="*.kwm") returned 5 [0056.985] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0056.985] lstrlenA (lpString="*.pwm") returned 5 [0056.985] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0056.985] lstrlenA (lpString="*.1cd") returned 5 [0056.985] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0056.985] lstrlenA (lpString="*.md") returned 4 [0056.985] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0056.985] lstrlenA (lpString="*.mdf") returned 5 [0056.985] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0056.985] lstrlenA (lpString="*.dbf") returned 5 [0056.985] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0056.985] lstrlenA (lpString="*.odt") returned 5 [0056.985] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0056.985] lstrlenA (lpString="*.vob") returned 5 [0056.985] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0056.985] lstrlenA (lpString="*.ifo") returned 5 [0056.985] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0056.985] lstrlenA (lpString="*.lnk") returned 5 [0056.986] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0056.986] lstrlenA (lpString="*.torrent") returned 9 [0056.986] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0056.986] lstrlenA (lpString="*.mov") returned 5 [0056.986] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0056.986] lstrlenA (lpString="*.m2v") returned 5 [0056.986] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0056.986] lstrlenA (lpString="*.3gp") returned 5 [0056.986] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0056.986] lstrlenA (lpString="*.mpeg") returned 6 [0056.986] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0056.986] lstrlenA (lpString="*.mpg") returned 5 [0056.986] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0056.986] lstrlenA (lpString="*.flv") returned 5 [0056.986] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0056.986] lstrlenA (lpString="*.avi") returned 5 [0056.986] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0056.986] lstrlenA (lpString="*.mp4") returned 5 [0056.986] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0056.986] lstrlenA (lpString="*.wmv") returned 5 [0056.986] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0056.986] lstrlenA (lpString="*.divx") returned 6 [0056.986] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0056.986] lstrlenA (lpString="*.mkv") returned 5 [0056.986] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0056.986] lstrlenA (lpString="*.mp3") returned 5 [0056.986] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0056.986] lstrlenA (lpString="*.wav") returned 5 [0056.987] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0056.987] lstrlenA (lpString="*.flac") returned 6 [0056.987] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0056.987] lstrlenA (lpString="*.ape") returned 5 [0056.987] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0056.987] lstrlenA (lpString="*.wma") returned 5 [0056.987] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0056.987] lstrlenA (lpString="*.ac3") returned 5 [0056.987] FindNextFileA (in: hFindFile=0x6364b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa560, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.987] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0056.987] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0056.987] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0056.987] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0056.987] PathFindFileNameA (pszPath="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0056.987] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\zh-TW\\" | out: lpString1="C:\\Boot\\zh-TW\\") returned="C:\\Boot\\zh-TW\\" [0056.987] PathAddBackslashA (in: pszPath="C:\\Boot\\zh-TW\\" | out: pszPath="C:\\Boot\\zh-TW\\") returned="" [0056.987] lstrcatA (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\zh-TW\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\zh-TW\\HOW TO DECRYPT FILES.txt" [0056.987] GetFileAttributesA (lpFileName="C:\\Boot\\zh-TW\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-tw\\how to decrypt files.txt")) returned 0x20 [0056.987] lstrcatA (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\zh-TW\\memtest.exe.mui") returned="C:\\Boot\\zh-TW\\memtest.exe.mui" [0056.987] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0056.987] lstrlenA (lpString="*.zip") returned 5 [0056.987] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0056.987] lstrlenA (lpString="*.rar") returned 5 [0056.987] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0056.987] lstrlenA (lpString="*.7z") returned 4 [0056.987] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0056.987] lstrlenA (lpString="*.tar") returned 5 [0056.987] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0056.987] lstrlenA (lpString="*.gzip") returned 6 [0056.987] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0056.988] lstrlenA (lpString="*.jpg") returned 5 [0056.988] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0056.988] lstrlenA (lpString="*.jpeg") returned 6 [0056.988] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0056.988] lstrlenA (lpString="*.psd") returned 5 [0056.988] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0056.988] lstrlenA (lpString="*.cdr") returned 5 [0056.988] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0056.988] lstrlenA (lpString="*.dwg") returned 5 [0056.988] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.max") returned 0 [0056.988] lstrlenA (lpString="*.max") returned 5 [0056.988] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0056.988] lstrlenA (lpString="*.bmp") returned 5 [0056.988] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0056.988] lstrlenA (lpString="*.gif") returned 5 [0056.988] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.png") returned 0 [0056.988] lstrlenA (lpString="*.png") returned 5 [0056.988] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0056.988] lstrlenA (lpString="*.doc") returned 5 [0056.988] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0056.988] lstrlenA (lpString="*.docx") returned 6 [0056.988] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0056.988] lstrlenA (lpString="*.xls") returned 5 [0056.988] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0056.988] lstrlenA (lpString="*.xlsx") returned 6 [0056.988] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0056.988] lstrlenA (lpString="*.ppt") returned 5 [0056.988] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0056.988] lstrlenA (lpString="*.pptx") returned 6 [0056.988] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0056.988] lstrlenA (lpString="*.txt") returned 5 [0056.988] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0056.988] lstrlenA (lpString="*.pdf") returned 5 [0056.988] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0056.989] lstrlenA (lpString="*.djvu") returned 6 [0056.989] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0056.989] lstrlenA (lpString="*.htm") returned 5 [0056.989] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.html") returned 0 [0056.989] lstrlenA (lpString="*.html") returned 6 [0056.989] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0056.989] lstrlenA (lpString="*.mdb") returned 5 [0056.989] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0056.989] lstrlenA (lpString="*.cer") returned 5 [0056.989] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0056.989] lstrlenA (lpString="*.p12") returned 5 [0056.989] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0056.989] lstrlenA (lpString="*.pfx") returned 5 [0056.989] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0056.989] lstrlenA (lpString="*.kwm") returned 5 [0056.989] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0056.989] lstrlenA (lpString="*.pwm") returned 5 [0056.989] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0056.989] lstrlenA (lpString="*.1cd") returned 5 [0056.989] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.md") returned 0 [0056.989] lstrlenA (lpString="*.md") returned 4 [0056.989] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0056.989] lstrlenA (lpString="*.mdf") returned 5 [0056.989] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0056.989] lstrlenA (lpString="*.dbf") returned 5 [0056.989] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0056.989] lstrlenA (lpString="*.odt") returned 5 [0056.989] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0056.989] lstrlenA (lpString="*.vob") returned 5 [0056.989] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0056.989] lstrlenA (lpString="*.ifo") returned 5 [0056.990] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0056.990] lstrlenA (lpString="*.lnk") returned 5 [0056.990] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0056.990] lstrlenA (lpString="*.torrent") returned 9 [0056.990] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0056.990] lstrlenA (lpString="*.mov") returned 5 [0056.990] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0056.990] lstrlenA (lpString="*.m2v") returned 5 [0056.990] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0056.990] lstrlenA (lpString="*.3gp") returned 5 [0056.990] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0056.990] lstrlenA (lpString="*.mpeg") returned 6 [0056.990] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0056.990] lstrlenA (lpString="*.mpg") returned 5 [0056.990] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0056.990] lstrlenA (lpString="*.flv") returned 5 [0056.990] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0056.990] lstrlenA (lpString="*.avi") returned 5 [0056.990] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0056.990] lstrlenA (lpString="*.mp4") returned 5 [0056.990] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0056.990] lstrlenA (lpString="*.wmv") returned 5 [0056.990] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0056.990] lstrlenA (lpString="*.divx") returned 6 [0056.990] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0056.990] lstrlenA (lpString="*.mkv") returned 5 [0056.990] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0056.990] lstrlenA (lpString="*.mp3") returned 5 [0056.990] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0056.990] lstrlenA (lpString="*.wav") returned 5 [0056.990] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0056.990] lstrlenA (lpString="*.flac") returned 6 [0056.990] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0056.990] lstrlenA (lpString="*.ape") returned 5 [0056.991] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0056.991] lstrlenA (lpString="*.wma") returned 5 [0056.991] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0056.991] lstrlenA (lpString="*.ac3") returned 5 [0056.991] FindNextFileA (in: hFindFile=0x6364b0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa560, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0056.991] FindClose (in: hFindFile=0x6364b0 | out: hFindFile=0x6364b0) returned 1 [0056.991] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78ab5a49, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0056.991] FindClose (in: hFindFile=0x636b30 | out: hFindFile=0x636b30) returned 1 [0056.991] FindNextFileA (in: hFindFile=0x636670, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x61b64, dwReserved0=0x0, dwReserved1=0x62a910, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0056.991] PeekMessageA (in: lpMsg=0x19fe0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fe0c) returned 0 [0056.991] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr") returned 1 [0056.991] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr") returned 1 [0056.991] lstrcmpiA (lpString1="", lpString2="bootmgr") returned -1 [0056.991] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0056.991] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0056.991] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0056.991] lstrcatA (in: lpString1="C:\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\HOW TO DECRYPT FILES.txt") returned="C:\\HOW TO DECRYPT FILES.txt" [0056.991] GetFileAttributesA (lpFileName="C:\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\how to decrypt files.txt")) returned 0xffffffff [0056.991] CreateFileA (lpFileName="C:\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0056.992] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0056.992] WriteFile (in: hFile=0x178, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.045] SetFileTime (hFile=0x178, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.045] CloseHandle (hObject=0x178) returned 1 [0057.045] lstrcatA (in: lpString1="C:\\", lpString2="bootmgr" | out: lpString1="C:\\bootmgr") returned="C:\\bootmgr" [0057.045] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.zip") returned 0 [0057.045] lstrlenA (lpString="*.zip") returned 5 [0057.045] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.rar") returned 0 [0057.045] lstrlenA (lpString="*.rar") returned 5 [0057.045] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.7z") returned 0 [0057.045] lstrlenA (lpString="*.7z") returned 4 [0057.045] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.tar") returned 0 [0057.045] lstrlenA (lpString="*.tar") returned 5 [0057.045] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.gzip") returned 0 [0057.045] lstrlenA (lpString="*.gzip") returned 6 [0057.045] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.jpg") returned 0 [0057.045] lstrlenA (lpString="*.jpg") returned 5 [0057.046] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.jpeg") returned 0 [0057.046] lstrlenA (lpString="*.jpeg") returned 6 [0057.046] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.psd") returned 0 [0057.046] lstrlenA (lpString="*.psd") returned 5 [0057.046] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.cdr") returned 0 [0057.046] lstrlenA (lpString="*.cdr") returned 5 [0057.046] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.dwg") returned 0 [0057.046] lstrlenA (lpString="*.dwg") returned 5 [0057.046] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.max") returned 0 [0057.046] lstrlenA (lpString="*.max") returned 5 [0057.046] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.bmp") returned 0 [0057.046] lstrlenA (lpString="*.bmp") returned 5 [0057.046] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.gif") returned 0 [0057.046] lstrlenA (lpString="*.gif") returned 5 [0057.046] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.png") returned 0 [0057.046] lstrlenA (lpString="*.png") returned 5 [0057.046] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.doc") returned 0 [0057.046] lstrlenA (lpString="*.doc") returned 5 [0057.046] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.docx") returned 0 [0057.046] lstrlenA (lpString="*.docx") returned 6 [0057.046] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.xls") returned 0 [0057.046] lstrlenA (lpString="*.xls") returned 5 [0057.046] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.xlsx") returned 0 [0057.046] lstrlenA (lpString="*.xlsx") returned 6 [0057.046] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.ppt") returned 0 [0057.046] lstrlenA (lpString="*.ppt") returned 5 [0057.046] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.pptx") returned 0 [0057.046] lstrlenA (lpString="*.pptx") returned 6 [0057.046] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.txt") returned 0 [0057.046] lstrlenA (lpString="*.txt") returned 5 [0057.047] lstrlenA (lpString="*.pdf") returned 5 [0057.047] lstrlenA (lpString="*.djvu") returned 6 [0057.047] lstrlenA (lpString="*.htm") returned 5 [0057.047] lstrlenA (lpString="*.html") returned 6 [0057.047] lstrlenA (lpString="*.mdb") returned 5 [0057.047] lstrlenA (lpString="*.cer") returned 5 [0057.047] lstrlenA (lpString="*.p12") returned 5 [0057.047] lstrlenA (lpString="*.pfx") returned 5 [0057.047] lstrlenA (lpString="*.kwm") returned 5 [0057.047] lstrlenA (lpString="*.pwm") returned 5 [0057.047] lstrlenA (lpString="*.1cd") returned 5 [0057.047] lstrlenA (lpString="*.md") returned 4 [0057.047] lstrlenA (lpString="*.mdf") returned 5 [0057.047] lstrlenA (lpString="*.dbf") returned 5 [0057.047] lstrlenA (lpString="*.odt") returned 5 [0057.047] lstrlenA (lpString="*.vob") returned 5 [0057.047] lstrlenA (lpString="*.ifo") returned 5 [0057.047] lstrlenA (lpString="*.lnk") returned 5 [0057.047] lstrlenA (lpString="*.torrent") returned 9 [0057.047] lstrlenA (lpString="*.mov") returned 5 [0057.047] lstrlenA (lpString="*.m2v") returned 5 [0057.047] lstrlenA (lpString="*.3gp") returned 5 [0057.047] lstrlenA (lpString="*.mpeg") returned 6 [0057.048] lstrlenA (lpString="*.mpg") returned 5 [0057.048] lstrlenA (lpString="*.flv") returned 5 [0057.048] lstrlenA (lpString="*.avi") returned 5 [0057.048] lstrlenA (lpString="*.mp4") returned 5 [0057.048] lstrlenA (lpString="*.wmv") returned 5 [0057.048] lstrlenA (lpString="*.divx") returned 6 [0057.048] lstrlenA (lpString="*.mkv") returned 5 [0057.048] lstrlenA (lpString="*.mp3") returned 5 [0057.048] lstrlenA (lpString="*.wav") returned 5 [0057.048] lstrlenA (lpString="*.flac") returned 6 [0057.048] lstrlenA (lpString="*.ape") returned 5 [0057.048] lstrlenA (lpString="*.wma") returned 5 [0057.048] lstrlenA (lpString="*.ac3") returned 5 [0057.048] FindNextFileA (in: hFindFile=0x636670, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0057.048] PeekMessageA (in: lpMsg=0x19fe0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fe0c) returned 0 [0057.048] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BOOTNXT") returned 1 [0057.048] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BOOTNXT") returned 1 [0057.048] lstrcmpiA (lpString1="", lpString2="BOOTNXT") returned -1 [0057.048] PathFindFileNameA (pszPath="C:\\bootmgr") returned="bootmgr" [0057.048] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0057.048] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0057.048] lstrcatA (in: lpString1="C:\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\HOW TO DECRYPT FILES.txt") returned="C:\\HOW TO DECRYPT FILES.txt" [0057.048] GetFileAttributesA (lpFileName="C:\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\how to decrypt files.txt")) returned 0x20 [0057.049] lstrcatA (in: lpString1="C:\\", lpString2="BOOTNXT" | out: lpString1="C:\\BOOTNXT") returned="C:\\BOOTNXT" [0057.049] lstrlenA (lpString="*.zip") returned 5 [0057.049] lstrlenA (lpString="*.rar") returned 5 [0057.049] lstrlenA (lpString="*.7z") returned 4 [0057.049] lstrlenA (lpString="*.tar") returned 5 [0057.049] lstrlenA (lpString="*.gzip") returned 6 [0057.049] lstrlenA (lpString="*.jpg") returned 5 [0057.049] lstrlenA (lpString="*.jpeg") returned 6 [0057.049] lstrlenA (lpString="*.psd") returned 5 [0057.049] lstrlenA (lpString="*.cdr") returned 5 [0057.049] lstrlenA (lpString="*.dwg") returned 5 [0057.049] lstrlenA (lpString="*.max") returned 5 [0057.049] lstrlenA (lpString="*.bmp") returned 5 [0057.049] lstrlenA (lpString="*.gif") returned 5 [0057.049] lstrlenA (lpString="*.png") returned 5 [0057.049] lstrlenA (lpString="*.doc") returned 5 [0057.049] lstrlenA (lpString="*.docx") returned 6 [0057.049] lstrlenA (lpString="*.xls") returned 5 [0057.049] lstrlenA (lpString="*.xlsx") returned 6 [0057.049] lstrlenA (lpString="*.ppt") returned 5 [0057.049] lstrlenA (lpString="*.pptx") returned 6 [0057.049] lstrlenA (lpString="*.txt") returned 5 [0057.049] lstrlenA (lpString="*.pdf") returned 5 [0057.049] lstrlenA (lpString="*.djvu") returned 6 [0057.050] lstrlenA (lpString="*.htm") returned 5 [0057.050] lstrlenA (lpString="*.html") returned 6 [0057.050] lstrlenA (lpString="*.mdb") returned 5 [0057.050] lstrlenA (lpString="*.cer") returned 5 [0057.050] lstrlenA (lpString="*.p12") returned 5 [0057.050] lstrlenA (lpString="*.pfx") returned 5 [0057.050] lstrlenA (lpString="*.kwm") returned 5 [0057.050] lstrlenA (lpString="*.pwm") returned 5 [0057.050] lstrlenA (lpString="*.1cd") returned 5 [0057.050] lstrlenA (lpString="*.md") returned 4 [0057.050] lstrlenA (lpString="*.mdf") returned 5 [0057.050] lstrlenA (lpString="*.dbf") returned 5 [0057.050] lstrlenA (lpString="*.odt") returned 5 [0057.050] lstrlenA (lpString="*.vob") returned 5 [0057.050] lstrlenA (lpString="*.ifo") returned 5 [0057.050] lstrlenA (lpString="*.lnk") returned 5 [0057.050] lstrlenA (lpString="*.torrent") returned 9 [0057.050] lstrlenA (lpString="*.mov") returned 5 [0057.050] lstrlenA (lpString="*.m2v") returned 5 [0057.050] lstrlenA (lpString="*.3gp") returned 5 [0057.050] lstrlenA (lpString="*.mpeg") returned 6 [0057.050] lstrlenA (lpString="*.mpg") returned 5 [0057.050] lstrlenA (lpString="*.flv") returned 5 [0057.050] lstrlenA (lpString="*.avi") returned 5 [0057.051] lstrlenA (lpString="*.mp4") returned 5 [0057.051] lstrlenA (lpString="*.wmv") returned 5 [0057.051] lstrlenA (lpString="*.divx") returned 6 [0057.051] lstrlenA (lpString="*.mkv") returned 5 [0057.051] lstrlenA (lpString="*.mp3") returned 5 [0057.051] lstrlenA (lpString="*.wav") returned 5 [0057.051] lstrlenA (lpString="*.flac") returned 6 [0057.051] lstrlenA (lpString="*.ape") returned 5 [0057.051] lstrlenA (lpString="*.wma") returned 5 [0057.051] lstrlenA (lpString="*.ac3") returned 5 [0057.051] FindNextFileA (in: hFindFile=0x636670, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x78d17e5a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78d17e5a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78d17e5a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0057.051] PeekMessageA (in: lpMsg=0x19fe0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fe0c) returned 0 [0057.051] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BOOTSECT.BAK") returned 1 [0057.051] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BOOTSECT.BAK") returned 1 [0057.051] lstrcmpiA (lpString1="", lpString2="BOOTSECT.BAK") returned -1 [0057.051] PathFindFileNameA (pszPath="C:\\BOOTNXT") returned="BOOTNXT" [0057.051] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0057.051] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0057.051] lstrcatA (in: lpString1="C:\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\HOW TO DECRYPT FILES.txt") returned="C:\\HOW TO DECRYPT FILES.txt" [0057.051] GetFileAttributesA (lpFileName="C:\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\how to decrypt files.txt")) returned 0x20 [0057.051] lstrcatA (in: lpString1="C:\\", lpString2="BOOTSECT.BAK" | out: lpString1="C:\\BOOTSECT.BAK") returned="C:\\BOOTSECT.BAK" [0057.051] lstrlenA (lpString="*.zip") returned 5 [0057.051] lstrlenA (lpString="*.rar") returned 5 [0057.052] lstrlenA (lpString="*.7z") returned 4 [0057.052] lstrlenA (lpString="*.tar") returned 5 [0057.052] lstrlenA (lpString="*.gzip") returned 6 [0057.052] lstrlenA (lpString="*.jpg") returned 5 [0057.052] lstrlenA (lpString="*.jpeg") returned 6 [0057.052] lstrlenA (lpString="*.psd") returned 5 [0057.052] lstrlenA (lpString="*.cdr") returned 5 [0057.052] lstrlenA (lpString="*.dwg") returned 5 [0057.052] lstrlenA (lpString="*.max") returned 5 [0057.052] lstrlenA (lpString="*.bmp") returned 5 [0057.052] lstrlenA (lpString="*.gif") returned 5 [0057.052] lstrlenA (lpString="*.png") returned 5 [0057.052] lstrlenA (lpString="*.doc") returned 5 [0057.052] lstrlenA (lpString="*.docx") returned 6 [0057.052] lstrlenA (lpString="*.xls") returned 5 [0057.052] lstrlenA (lpString="*.xlsx") returned 6 [0057.052] lstrlenA (lpString="*.ppt") returned 5 [0057.052] lstrlenA (lpString="*.pptx") returned 6 [0057.052] FindNextFileA (in: hFindFile=0x636670, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0057.052] lstrcmpA (lpString1=".", lpString2="Documents and Settings") returned -1 [0057.052] lstrcmpA (lpString1="..", lpString2="Documents and Settings") returned -1 [0057.052] PathFindFileNameA (pszPath="C:\\BOOTSECT.BAK") returned="BOOTSECT.BAK" [0057.052] lstrcatA (in: lpString1="C:\\", lpString2="Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0057.053] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\*.*" (normalized: "c:\\documents and settings\\*.*"), lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x620000, ftCreationTime.dwHighDateTime=0x6, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x207d0, nFileSizeLow=0x20000, dwReserved0=0x10, dwReserved1=0x40445c, cFileName="\x01", cAlternateFileName="Ìÿ\x19")) returned 0xffffffff [0057.053] FindNextFileA (in: hFindFile=0x636670, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x551dbbfd, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x551dbbfd, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x60ba852, ftLastWriteTime.dwHighDateTime=0x1d8c12e, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0057.053] PeekMessageA (in: lpMsg=0x19fe0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fe0c) returned 0 [0057.053] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hiberfil.sys") returned -1 [0057.053] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hiberfil.sys") returned 1 [0057.053] lstrcmpiA (lpString1="", lpString2="hiberfil.sys") returned -1 [0057.053] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0057.053] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0057.053] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0057.053] lstrcatA (in: lpString1="C:\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\HOW TO DECRYPT FILES.txt") returned="C:\\HOW TO DECRYPT FILES.txt" [0057.053] GetFileAttributesA (lpFileName="C:\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\how to decrypt files.txt")) returned 0x20 [0057.053] lstrcatA (in: lpString1="C:\\", lpString2="hiberfil.sys" | out: lpString1="C:\\hiberfil.sys") returned="C:\\hiberfil.sys" [0057.053] FindNextFileA (in: hFindFile=0x636670, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0x198b0d8f, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x198b0d8f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x198b0d8f, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0057.053] lstrcmpA (lpString1=".", lpString2="MSOCache") returned -1 [0057.053] lstrcmpA (lpString1="..", lpString2="MSOCache") returned -1 [0057.053] PathFindFileNameA (pszPath="C:\\hiberfil.sys") returned="hiberfil.sys" [0057.054] lstrcatA (in: lpString1="C:\\", lpString2="MSOCache" | out: lpString1="C:\\MSOCache") returned="C:\\MSOCache" [0057.054] FindFirstFileA (in: lpFileName="C:\\MSOCache\\*.*" (normalized: "c:\\msocache\\*.*"), lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0x198b0d8f, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x198b0d8f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x198b0d8f, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0x40, cFileName=".", cAlternateFileName="")) returned 0x6367f0 [0057.054] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.054] FindNextFileA (in: hFindFile=0x6367f0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0x198b0d8f, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x198b0d8f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x198b0d8f, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0x40, cFileName="..", cAlternateFileName="")) returned 1 [0057.054] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.054] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.054] FindNextFileA (in: hFindFile=0x6367f0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x198b0d8f, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c7ea9fb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c7ea9fb, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0x40, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0057.054] lstrcmpA (lpString1=".", lpString2="All Users") returned -1 [0057.054] lstrcmpA (lpString1="..", lpString2="All Users") returned -1 [0057.054] PathFindFileNameA (pszPath="C:\\MSOCache\\*.*") returned="*.*" [0057.054] lstrcatA (in: lpString1="C:\\MSOCache\\", lpString2="All Users" | out: lpString1="C:\\MSOCache\\All Users") returned="C:\\MSOCache\\All Users" [0057.054] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\*.*" (normalized: "c:\\msocache\\all users\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x198b0d8f, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c7ea9fb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c7ea9fb, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63d850, dwReserved1=0x63d848, cFileName=".", cAlternateFileName="")) returned 0x636470 [0057.057] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.057] FindNextFileA (in: hFindFile=0x636470, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x198b0d8f, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c7ea9fb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c7ea9fb, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63d850, dwReserved1=0x63d848, cFileName="..", cAlternateFileName="")) returned 1 [0057.058] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.058] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.058] FindNextFileA (in: hFindFile=0x636470, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x19a337b7, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3785d7ae, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3785d7ae, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63d850, dwReserved1=0x63d848, cFileName="{90160000-0011-0000-0000-0000000FF1CE}-C", cAlternateFileName="{90160~2")) returned 1 [0057.058] lstrcmpA (lpString1=".", lpString2="{90160000-0011-0000-0000-0000000FF1CE}-C") returned -1 [0057.058] lstrcmpA (lpString1="..", lpString2="{90160000-0011-0000-0000-0000000FF1CE}-C") returned -1 [0057.058] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.058] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90160000-0011-0000-0000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C" [0057.058] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\*.*" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\*.*"), lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x19a337b7, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3785d7ae, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3785d7ae, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63f868, dwReserved1=0x63f860, cFileName=".", cAlternateFileName="")) returned 0x636530 [0057.060] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.060] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x19a337b7, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3785d7ae, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3785d7ae, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63f868, dwReserved1=0x63f860, cFileName="..", cAlternateFileName="")) returned 1 [0057.060] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.060] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.060] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6ce70000, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x6ce70000, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x19ac57c0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x3c3000, dwReserved0=0x63f868, dwReserved1=0x63f860, cFileName="Office64WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0057.060] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.060] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Office64WW.msi") returned -1 [0057.060] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office64WW.msi") returned -1 [0057.060] lstrcmpiA (lpString1="", lpString2="Office64WW.msi") returned -1 [0057.060] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.060] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" [0057.060] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\") returned="" [0057.060] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.060] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.061] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0057.061] WriteFile (in: hFile=0x1c8, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.062] SetFileTime (hFile=0x1c8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.062] CloseHandle (hObject=0x1c8) returned 1 [0057.062] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\", lpString2="Office64WW.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.msi") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.msi" [0057.062] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x12e83a80, ftCreationTime.dwHighDateTime=0x1d0cbb6, ftLastAccessTime.dwLowDateTime=0x12e83a80, ftLastAccessTime.dwHighDateTime=0x1d0cbb6, ftLastWriteTime.dwLowDateTime=0x19a33000, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x1380, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="Office64WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0057.062] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.062] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Office64WW.xml") returned -1 [0057.063] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office64WW.xml") returned -1 [0057.063] lstrcmpiA (lpString1="", lpString2="Office64WW.xml") returned -1 [0057.063] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.msi") returned="Office64WW.msi" [0057.063] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" [0057.063] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\") returned="" [0057.063] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.063] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.063] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\", lpString2="Office64WW.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.xml") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.xml" [0057.063] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf770f620, ftCreationTime.dwHighDateTime=0x1d0cb97, ftLastAccessTime.dwLowDateTime=0xf770f620, ftLastAccessTime.dwHighDateTime=0x1d0cb97, ftLastWriteTime.dwLowDateTime=0x37850760, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x318b0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0057.063] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.063] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ose.exe") returned -1 [0057.063] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ose.exe") returned -1 [0057.063] lstrcmpiA (lpString1="", lpString2="ose.exe") returned -1 [0057.063] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.xml") returned="Office64WW.xml" [0057.063] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" [0057.063] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\") returned="" [0057.063] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.063] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.063] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\", lpString2="ose.exe" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ose.exe") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ose.exe" [0057.063] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d3bac20, ftCreationTime.dwHighDateTime=0x1d0cb96, ftLastAccessTime.dwLowDateTime=0x7d3bac20, ftLastAccessTime.dwHighDateTime=0x1d0cb96, ftLastWriteTime.dwLowDateTime=0x36bd98b0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x960aa8, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0057.063] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.063] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="osetup.dll") returned -1 [0057.063] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="osetup.dll") returned -1 [0057.063] lstrcmpiA (lpString1="", lpString2="osetup.dll") returned -1 [0057.063] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ose.exe") returned="ose.exe" [0057.064] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" [0057.064] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\") returned="" [0057.064] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.064] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.064] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\", lpString2="osetup.dll" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\osetup.dll") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\osetup.dll" [0057.064] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a23d2d0, ftCreationTime.dwHighDateTime=0x1d0cbc0, ftLastAccessTime.dwLowDateTime=0x3a23d2d0, ftLastAccessTime.dwHighDateTime=0x1d0cbc0, ftLastWriteTime.dwLowDateTime=0x19bd95d0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x1d2ccbc, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="OWOW64WW.cab", cAlternateFileName="")) returned 1 [0057.064] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.064] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OWOW64WW.cab") returned -1 [0057.064] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OWOW64WW.cab") returned -1 [0057.064] lstrcmpiA (lpString1="", lpString2="OWOW64WW.cab") returned -1 [0057.064] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\osetup.dll") returned="osetup.dll" [0057.064] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" [0057.064] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\") returned="" [0057.064] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.064] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.064] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\", lpString2="OWOW64WW.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\OWOW64WW.cab") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\OWOW64WW.cab" [0057.065] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x870a50a0, ftCreationTime.dwHighDateTime=0x1d0ca7c, ftLastAccessTime.dwLowDateTime=0x870a50a0, ftLastAccessTime.dwHighDateTime=0x1d0ca7c, ftLastWriteTime.dwLowDateTime=0x3785cab0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x137258, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0057.065] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.065] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PidGenX.dll") returned -1 [0057.065] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PidGenX.dll") returned -1 [0057.065] lstrcmpiA (lpString1="", lpString2="PidGenX.dll") returned -1 [0057.065] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\OWOW64WW.cab") returned="OWOW64WW.cab" [0057.065] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" [0057.065] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\") returned="" [0057.065] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.065] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.065] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\", lpString2="PidGenX.dll" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\PidGenX.dll") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\PidGenX.dll" [0057.065] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16fad80, ftCreationTime.dwHighDateTime=0x1d0ca8d, ftLastAccessTime.dwLowDateTime=0x16fad80, ftLastAccessTime.dwHighDateTime=0x1d0ca8d, ftLastWriteTime.dwLowDateTime=0x3785cab0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x902bb, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0057.065] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.065] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pkeyconfig-office.xrm-ms") returned -1 [0057.065] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pkeyconfig-office.xrm-ms") returned -1 [0057.065] lstrcmpiA (lpString1="", lpString2="pkeyconfig-office.xrm-ms") returned -1 [0057.065] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\PidGenX.dll") returned="PidGenX.dll" [0057.065] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" [0057.065] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\") returned="" [0057.065] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.065] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.065] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\", lpString2="pkeyconfig-office.xrm-ms" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" [0057.066] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19453d90, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x19453d90, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x1b2f0020, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x1ba4000, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="ProPlusWW.msi", cAlternateFileName="PROPLU~1.MSI")) returned 1 [0057.066] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.066] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProPlusWW.msi") returned -1 [0057.066] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProPlusWW.msi") returned -1 [0057.066] lstrcmpiA (lpString1="", lpString2="ProPlusWW.msi") returned -1 [0057.066] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned="pkeyconfig-office.xrm-ms" [0057.066] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" [0057.066] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\") returned="" [0057.066] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.066] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.066] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\", lpString2="ProPlusWW.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPlusWW.msi") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPlusWW.msi" [0057.066] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x20df7960, ftCreationTime.dwHighDateTime=0x1d0cbb5, ftLastAccessTime.dwLowDateTime=0x20df7960, ftLastAccessTime.dwHighDateTime=0x1d0cbb5, ftLastWriteTime.dwLowDateTime=0x1b2aba60, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x42d4, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="ProPlusWW.xml", cAlternateFileName="PROPLU~1.XML")) returned 1 [0057.066] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.066] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProPlusWW.xml") returned -1 [0057.066] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProPlusWW.xml") returned -1 [0057.066] lstrcmpiA (lpString1="", lpString2="ProPlusWW.xml") returned -1 [0057.066] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPlusWW.msi") returned="ProPlusWW.msi" [0057.066] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" [0057.066] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\") returned="" [0057.066] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.066] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.066] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\", lpString2="ProPlusWW.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPlusWW.xml") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPlusWW.xml" [0057.066] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9bd76f0, ftCreationTime.dwHighDateTime=0x1d0cbc0, ftLastAccessTime.dwLowDateTime=0xa9bd76f0, ftLastAccessTime.dwHighDateTime=0x1d0cbc0, ftLastWriteTime.dwLowDateTime=0x1c985420, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x13496c5e, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="ProPsWW.cab", cAlternateFileName="")) returned 1 [0057.067] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.067] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProPsWW.cab") returned -1 [0057.067] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProPsWW.cab") returned -1 [0057.067] lstrcmpiA (lpString1="", lpString2="ProPsWW.cab") returned -1 [0057.067] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPlusWW.xml") returned="ProPlusWW.xml" [0057.067] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" [0057.067] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\") returned="" [0057.067] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.067] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.067] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\", lpString2="ProPsWW.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPsWW.cab") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPsWW.cab" [0057.067] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9ecd5a60, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x9ecd5a60, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x2c7c5260, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0xed9cec7, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="ProPsWW2.cab", cAlternateFileName="")) returned 1 [0057.067] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.067] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProPsWW2.cab") returned -1 [0057.067] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProPsWW2.cab") returned -1 [0057.067] lstrcmpiA (lpString1="", lpString2="ProPsWW2.cab") returned -1 [0057.067] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPsWW.cab") returned="ProPsWW.cab" [0057.067] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" [0057.067] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\") returned="" [0057.067] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.067] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.067] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\", lpString2="ProPsWW2.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPsWW2.cab") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPsWW2.cab" [0057.067] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e3d3da0, ftCreationTime.dwHighDateTime=0x1d0cb96, ftLastAccessTime.dwLowDateTime=0x7e3d3da0, ftLastAccessTime.dwHighDateTime=0x1d0cb96, ftLastWriteTime.dwLowDateTime=0x36bb75d0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x946c0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="setup.dll", cAlternateFileName="")) returned 1 [0057.067] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.067] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="setup.dll") returned -1 [0057.067] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="setup.dll") returned -1 [0057.067] lstrcmpiA (lpString1="", lpString2="setup.dll") returned -1 [0057.068] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPsWW2.cab") returned="ProPsWW2.cab" [0057.068] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" [0057.068] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\") returned="" [0057.068] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.068] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.068] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\", lpString2="setup.dll" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\setup.dll") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\setup.dll" [0057.068] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f377c20, ftCreationTime.dwHighDateTime=0x1d0cb96, ftLastAccessTime.dwLowDateTime=0x7f377c20, ftLastAccessTime.dwHighDateTime=0x1d0cb96, ftLastWriteTime.dwLowDateTime=0x36b9a110, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x39cc0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0057.068] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.068] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="setup.exe") returned -1 [0057.068] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="setup.exe") returned -1 [0057.068] lstrcmpiA (lpString1="", lpString2="setup.exe") returned -1 [0057.068] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\setup.dll") returned="setup.dll" [0057.068] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" [0057.068] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\") returned="" [0057.068] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.068] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.068] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\", lpString2="setup.exe" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\setup.exe") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\setup.exe" [0057.068] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x417c4f10, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x417c4f10, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3785cab0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x6c86, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.068] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.068] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.068] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.068] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.068] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\setup.exe") returned="setup.exe" [0057.068] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" [0057.068] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\") returned="" [0057.068] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.069] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.069] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Setup.xml" [0057.069] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x417c4f10, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x417c4f10, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3785cab0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x6c86, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.069] FindClose (in: hFindFile=0x636530 | out: hFindFile=0x636530) returned 1 [0057.069] FindNextFileA (in: hFindFile=0x636470, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3abfab95, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3b39d0ce, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3b39d0ce, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="{90160000-0016-0409-0000-0000000FF1CE}-C", cAlternateFileName="{974F5~1")) returned 1 [0057.069] lstrcmpA (lpString1=".", lpString2="{90160000-0016-0409-0000-0000000FF1CE}-C") returned -1 [0057.069] lstrcmpA (lpString1="..", lpString2="{90160000-0016-0409-0000-0000000FF1CE}-C") returned -1 [0057.069] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.069] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90160000-0016-0409-0000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C" [0057.069] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\*.*" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\*.*"), lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3abfab95, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3b39d0ce, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3b39d0ce, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x6364b0 [0057.070] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.070] FindNextFileA (in: hFindFile=0x6364b0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3abfab95, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3b39d0ce, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3b39d0ce, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="..", cAlternateFileName="")) returned 1 [0057.070] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.070] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.070] FindNextFileA (in: hFindFile=0x6364b0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb87a4fc0, ftCreationTime.dwHighDateTime=0x1d0cbbf, ftLastAccessTime.dwLowDateTime=0xb87a4fc0, ftLastAccessTime.dwHighDateTime=0x1d0cbbf, ftLastWriteTime.dwLowDateTime=0x3abf98f0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x58095e, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0057.070] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.070] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ExcelLR.cab") returned -1 [0057.070] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExcelLR.cab") returned 1 [0057.070] lstrcmpiA (lpString1="", lpString2="ExcelLR.cab") returned -1 [0057.070] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.070] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\" [0057.070] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\") returned="" [0057.070] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.070] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.070] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0057.072] WriteFile (in: hFile=0x1c8, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.073] SetFileTime (hFile=0x1c8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.073] CloseHandle (hObject=0x1c8) returned 1 [0057.073] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\", lpString2="ExcelLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab") returned="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab" [0057.074] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.zip") returned 0 [0057.074] lstrlenA (lpString="*.zip") returned 5 [0057.074] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.rar") returned 0 [0057.074] lstrlenA (lpString="*.rar") returned 5 [0057.074] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.7z") returned 0 [0057.074] lstrlenA (lpString="*.7z") returned 4 [0057.074] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.tar") returned 0 [0057.074] lstrlenA (lpString="*.tar") returned 5 [0057.074] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.gzip") returned 0 [0057.074] lstrlenA (lpString="*.gzip") returned 6 [0057.074] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.jpg") returned 0 [0057.074] lstrlenA (lpString="*.jpg") returned 5 [0057.074] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.jpeg") returned 0 [0057.074] lstrlenA (lpString="*.jpeg") returned 6 [0057.074] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.psd") returned 0 [0057.074] lstrlenA (lpString="*.psd") returned 5 [0057.074] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.cdr") returned 0 [0057.074] lstrlenA (lpString="*.cdr") returned 5 [0057.074] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.dwg") returned 0 [0057.074] lstrlenA (lpString="*.dwg") returned 5 [0057.074] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.max") returned 0 [0057.074] lstrlenA (lpString="*.max") returned 5 [0057.074] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.bmp") returned 0 [0057.074] lstrlenA (lpString="*.bmp") returned 5 [0057.074] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.gif") returned 0 [0057.074] lstrlenA (lpString="*.gif") returned 5 [0057.074] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.png") returned 0 [0057.074] lstrlenA (lpString="*.png") returned 5 [0057.074] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.doc") returned 0 [0057.074] lstrlenA (lpString="*.doc") returned 5 [0057.074] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.docx") returned 0 [0057.074] lstrlenA (lpString="*.docx") returned 6 [0057.074] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.xls") returned 0 [0057.074] lstrlenA (lpString="*.xls") returned 5 [0057.074] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.xlsx") returned 0 [0057.075] lstrlenA (lpString="*.xlsx") returned 6 [0057.075] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.ppt") returned 0 [0057.075] lstrlenA (lpString="*.ppt") returned 5 [0057.075] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.pptx") returned 0 [0057.075] lstrlenA (lpString="*.pptx") returned 6 [0057.075] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.txt") returned 0 [0057.075] lstrlenA (lpString="*.txt") returned 5 [0057.075] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.pdf") returned 0 [0057.075] lstrlenA (lpString="*.pdf") returned 5 [0057.075] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.djvu") returned 0 [0057.075] lstrlenA (lpString="*.djvu") returned 6 [0057.075] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.htm") returned 0 [0057.075] lstrlenA (lpString="*.htm") returned 5 [0057.075] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.html") returned 0 [0057.075] lstrlenA (lpString="*.html") returned 6 [0057.075] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.mdb") returned 0 [0057.075] lstrlenA (lpString="*.mdb") returned 5 [0057.075] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.cer") returned 0 [0057.075] lstrlenA (lpString="*.cer") returned 5 [0057.075] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.p12") returned 0 [0057.075] lstrlenA (lpString="*.p12") returned 5 [0057.075] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.pfx") returned 0 [0057.075] lstrlenA (lpString="*.pfx") returned 5 [0057.075] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.kwm") returned 0 [0057.075] lstrlenA (lpString="*.kwm") returned 5 [0057.075] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.pwm") returned 0 [0057.075] lstrlenA (lpString="*.pwm") returned 5 [0057.075] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.1cd") returned 0 [0057.075] lstrlenA (lpString="*.1cd") returned 5 [0057.075] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.md") returned 0 [0057.075] lstrlenA (lpString="*.md") returned 4 [0057.075] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.mdf") returned 0 [0057.076] lstrlenA (lpString="*.mdf") returned 5 [0057.076] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.dbf") returned 0 [0057.076] lstrlenA (lpString="*.dbf") returned 5 [0057.076] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.odt") returned 0 [0057.076] lstrlenA (lpString="*.odt") returned 5 [0057.076] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.vob") returned 0 [0057.076] lstrlenA (lpString="*.vob") returned 5 [0057.076] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.ifo") returned 0 [0057.076] lstrlenA (lpString="*.ifo") returned 5 [0057.076] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.lnk") returned 0 [0057.076] lstrlenA (lpString="*.lnk") returned 5 [0057.076] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.torrent") returned 0 [0057.076] lstrlenA (lpString="*.torrent") returned 9 [0057.076] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.mov") returned 0 [0057.076] lstrlenA (lpString="*.mov") returned 5 [0057.076] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.m2v") returned 0 [0057.076] lstrlenA (lpString="*.m2v") returned 5 [0057.076] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.3gp") returned 0 [0057.076] lstrlenA (lpString="*.3gp") returned 5 [0057.076] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.mpeg") returned 0 [0057.076] lstrlenA (lpString="*.mpeg") returned 6 [0057.076] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.mpg") returned 0 [0057.076] lstrlenA (lpString="*.mpg") returned 5 [0057.076] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.flv") returned 0 [0057.076] lstrlenA (lpString="*.flv") returned 5 [0057.076] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.avi") returned 0 [0057.076] lstrlenA (lpString="*.avi") returned 5 [0057.076] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.mp4") returned 0 [0057.076] lstrlenA (lpString="*.mp4") returned 5 [0057.076] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.wmv") returned 0 [0057.076] lstrlenA (lpString="*.wmv") returned 5 [0057.076] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.divx") returned 0 [0057.076] lstrlenA (lpString="*.divx") returned 6 [0057.076] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.mkv") returned 0 [0057.077] lstrlenA (lpString="*.mkv") returned 5 [0057.077] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.mp3") returned 0 [0057.077] lstrlenA (lpString="*.mp3") returned 5 [0057.077] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.wav") returned 0 [0057.077] lstrlenA (lpString="*.wav") returned 5 [0057.077] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.flac") returned 0 [0057.077] lstrlenA (lpString="*.flac") returned 6 [0057.077] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.ape") returned 0 [0057.077] lstrlenA (lpString="*.ape") returned 5 [0057.077] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.wma") returned 0 [0057.077] lstrlenA (lpString="*.wma") returned 5 [0057.077] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.ac3") returned 0 [0057.077] lstrlenA (lpString="*.ac3") returned 5 [0057.077] FindNextFileA (in: hFindFile=0x6364b0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdfce780, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0xdfce780, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x3abf98f0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x247000, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0057.077] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.077] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ExcelMUI.msi") returned -1 [0057.077] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExcelMUI.msi") returned 1 [0057.077] lstrcmpiA (lpString1="", lpString2="ExcelMUI.msi") returned -1 [0057.077] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab") returned="ExcelLR.cab" [0057.077] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\" [0057.077] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\") returned="" [0057.077] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.077] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.077] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\", lpString2="ExcelMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi") returned="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi" [0057.077] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.zip") returned 0 [0057.077] lstrlenA (lpString="*.zip") returned 5 [0057.077] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.rar") returned 0 [0057.078] lstrlenA (lpString="*.rar") returned 5 [0057.078] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.7z") returned 0 [0057.078] lstrlenA (lpString="*.7z") returned 4 [0057.078] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.tar") returned 0 [0057.078] lstrlenA (lpString="*.tar") returned 5 [0057.078] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.gzip") returned 0 [0057.078] lstrlenA (lpString="*.gzip") returned 6 [0057.078] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.jpg") returned 0 [0057.078] lstrlenA (lpString="*.jpg") returned 5 [0057.078] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.jpeg") returned 0 [0057.078] lstrlenA (lpString="*.jpeg") returned 6 [0057.078] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.psd") returned 0 [0057.078] lstrlenA (lpString="*.psd") returned 5 [0057.078] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.cdr") returned 0 [0057.078] lstrlenA (lpString="*.cdr") returned 5 [0057.078] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.dwg") returned 0 [0057.078] lstrlenA (lpString="*.dwg") returned 5 [0057.078] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.max") returned 0 [0057.078] lstrlenA (lpString="*.max") returned 5 [0057.078] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.bmp") returned 0 [0057.078] lstrlenA (lpString="*.bmp") returned 5 [0057.078] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.gif") returned 0 [0057.078] lstrlenA (lpString="*.gif") returned 5 [0057.078] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.png") returned 0 [0057.078] lstrlenA (lpString="*.png") returned 5 [0057.078] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.doc") returned 0 [0057.078] lstrlenA (lpString="*.doc") returned 5 [0057.078] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.docx") returned 0 [0057.078] lstrlenA (lpString="*.docx") returned 6 [0057.079] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.xls") returned 0 [0057.079] lstrlenA (lpString="*.xls") returned 5 [0057.079] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.xlsx") returned 0 [0057.079] lstrlenA (lpString="*.xlsx") returned 6 [0057.079] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.ppt") returned 0 [0057.079] lstrlenA (lpString="*.ppt") returned 5 [0057.079] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.pptx") returned 0 [0057.079] lstrlenA (lpString="*.pptx") returned 6 [0057.079] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.txt") returned 0 [0057.079] lstrlenA (lpString="*.txt") returned 5 [0057.079] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.pdf") returned 0 [0057.079] lstrlenA (lpString="*.pdf") returned 5 [0057.079] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.djvu") returned 0 [0057.079] lstrlenA (lpString="*.djvu") returned 6 [0057.079] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.htm") returned 0 [0057.079] lstrlenA (lpString="*.htm") returned 5 [0057.079] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.html") returned 0 [0057.079] lstrlenA (lpString="*.html") returned 6 [0057.079] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.mdb") returned 0 [0057.079] lstrlenA (lpString="*.mdb") returned 5 [0057.079] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.cer") returned 0 [0057.079] lstrlenA (lpString="*.cer") returned 5 [0057.079] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.p12") returned 0 [0057.079] lstrlenA (lpString="*.p12") returned 5 [0057.079] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.pfx") returned 0 [0057.079] lstrlenA (lpString="*.pfx") returned 5 [0057.079] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.kwm") returned 0 [0057.079] lstrlenA (lpString="*.kwm") returned 5 [0057.079] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.pwm") returned 0 [0057.079] lstrlenA (lpString="*.pwm") returned 5 [0057.079] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.1cd") returned 0 [0057.079] lstrlenA (lpString="*.1cd") returned 5 [0057.079] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.md") returned 0 [0057.079] lstrlenA (lpString="*.md") returned 4 [0057.080] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.mdf") returned 0 [0057.080] lstrlenA (lpString="*.mdf") returned 5 [0057.080] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.dbf") returned 0 [0057.080] lstrlenA (lpString="*.dbf") returned 5 [0057.084] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.odt") returned 0 [0057.084] lstrlenA (lpString="*.odt") returned 5 [0057.084] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.vob") returned 0 [0057.084] lstrlenA (lpString="*.vob") returned 5 [0057.084] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.ifo") returned 0 [0057.084] lstrlenA (lpString="*.ifo") returned 5 [0057.084] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.lnk") returned 0 [0057.084] lstrlenA (lpString="*.lnk") returned 5 [0057.084] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.torrent") returned 0 [0057.084] lstrlenA (lpString="*.torrent") returned 9 [0057.084] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.mov") returned 0 [0057.085] lstrlenA (lpString="*.mov") returned 5 [0057.085] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.m2v") returned 0 [0057.085] lstrlenA (lpString="*.m2v") returned 5 [0057.085] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.3gp") returned 0 [0057.085] lstrlenA (lpString="*.3gp") returned 5 [0057.085] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.mpeg") returned 0 [0057.085] lstrlenA (lpString="*.mpeg") returned 6 [0057.085] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.mpg") returned 0 [0057.085] lstrlenA (lpString="*.mpg") returned 5 [0057.085] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.flv") returned 0 [0057.085] lstrlenA (lpString="*.flv") returned 5 [0057.085] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.avi") returned 0 [0057.085] lstrlenA (lpString="*.avi") returned 5 [0057.085] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.mp4") returned 0 [0057.085] lstrlenA (lpString="*.mp4") returned 5 [0057.085] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.wmv") returned 0 [0057.085] lstrlenA (lpString="*.wmv") returned 5 [0057.085] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.divx") returned 0 [0057.085] lstrlenA (lpString="*.divx") returned 6 [0057.085] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.mkv") returned 0 [0057.085] lstrlenA (lpString="*.mkv") returned 5 [0057.085] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.mp3") returned 0 [0057.085] lstrlenA (lpString="*.mp3") returned 5 [0057.085] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.wav") returned 0 [0057.085] lstrlenA (lpString="*.wav") returned 5 [0057.085] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.flac") returned 0 [0057.086] lstrlenA (lpString="*.flac") returned 6 [0057.086] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.ape") returned 0 [0057.086] lstrlenA (lpString="*.ape") returned 5 [0057.086] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.wma") returned 0 [0057.086] lstrlenA (lpString="*.wma") returned 5 [0057.086] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.ac3") returned 0 [0057.086] lstrlenA (lpString="*.ac3") returned 5 [0057.086] FindNextFileA (in: hFindFile=0x6364b0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf47c6f70, ftCreationTime.dwHighDateTime=0x1d0cbb1, ftLastAccessTime.dwLowDateTime=0xf47c6f70, ftLastAccessTime.dwHighDateTime=0x1d0cbb1, ftLastWriteTime.dwLowDateTime=0x3abf98f0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x6f4, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0057.086] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.086] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ExcelMUI.xml") returned -1 [0057.086] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExcelMUI.xml") returned 1 [0057.086] lstrcmpiA (lpString1="", lpString2="ExcelMUI.xml") returned -1 [0057.086] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi") returned="ExcelMUI.msi" [0057.086] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\" [0057.086] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\") returned="" [0057.086] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.086] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.086] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\", lpString2="ExcelMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml") returned="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml" [0057.086] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.zip") returned 0 [0057.086] lstrlenA (lpString="*.zip") returned 5 [0057.086] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.rar") returned 0 [0057.086] lstrlenA (lpString="*.rar") returned 5 [0057.086] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.7z") returned 0 [0057.087] lstrlenA (lpString="*.7z") returned 4 [0057.087] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.tar") returned 0 [0057.087] lstrlenA (lpString="*.tar") returned 5 [0057.087] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.gzip") returned 0 [0057.087] lstrlenA (lpString="*.gzip") returned 6 [0057.087] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.jpg") returned 0 [0057.087] lstrlenA (lpString="*.jpg") returned 5 [0057.087] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.jpeg") returned 0 [0057.087] lstrlenA (lpString="*.jpeg") returned 6 [0057.087] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.psd") returned 0 [0057.087] lstrlenA (lpString="*.psd") returned 5 [0057.087] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.cdr") returned 0 [0057.087] lstrlenA (lpString="*.cdr") returned 5 [0057.087] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.dwg") returned 0 [0057.087] lstrlenA (lpString="*.dwg") returned 5 [0057.087] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.max") returned 0 [0057.087] lstrlenA (lpString="*.max") returned 5 [0057.087] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.bmp") returned 0 [0057.087] lstrlenA (lpString="*.bmp") returned 5 [0057.087] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.gif") returned 0 [0057.087] lstrlenA (lpString="*.gif") returned 5 [0057.087] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.png") returned 0 [0057.087] lstrlenA (lpString="*.png") returned 5 [0057.087] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.doc") returned 0 [0057.087] lstrlenA (lpString="*.doc") returned 5 [0057.087] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.docx") returned 0 [0057.087] lstrlenA (lpString="*.docx") returned 6 [0057.088] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.xls") returned 0 [0057.088] lstrlenA (lpString="*.xls") returned 5 [0057.088] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.xlsx") returned 0 [0057.088] lstrlenA (lpString="*.xlsx") returned 6 [0057.088] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.ppt") returned 0 [0057.088] lstrlenA (lpString="*.ppt") returned 5 [0057.088] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.pptx") returned 0 [0057.088] lstrlenA (lpString="*.pptx") returned 6 [0057.088] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.txt") returned 0 [0057.088] lstrlenA (lpString="*.txt") returned 5 [0057.088] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.pdf") returned 0 [0057.088] lstrlenA (lpString="*.pdf") returned 5 [0057.088] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.djvu") returned 0 [0057.088] lstrlenA (lpString="*.djvu") returned 6 [0057.088] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.htm") returned 0 [0057.088] lstrlenA (lpString="*.htm") returned 5 [0057.088] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.html") returned 0 [0057.088] lstrlenA (lpString="*.html") returned 6 [0057.088] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.mdb") returned 0 [0057.088] lstrlenA (lpString="*.mdb") returned 5 [0057.088] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.cer") returned 0 [0057.088] lstrlenA (lpString="*.cer") returned 5 [0057.088] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.p12") returned 0 [0057.088] lstrlenA (lpString="*.p12") returned 5 [0057.088] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.pfx") returned 0 [0057.088] lstrlenA (lpString="*.pfx") returned 5 [0057.089] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.kwm") returned 0 [0057.089] lstrlenA (lpString="*.kwm") returned 5 [0057.089] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.pwm") returned 0 [0057.089] lstrlenA (lpString="*.pwm") returned 5 [0057.089] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.1cd") returned 0 [0057.089] lstrlenA (lpString="*.1cd") returned 5 [0057.089] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.md") returned 0 [0057.089] lstrlenA (lpString="*.md") returned 4 [0057.089] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.mdf") returned 0 [0057.089] lstrlenA (lpString="*.mdf") returned 5 [0057.089] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.dbf") returned 0 [0057.089] lstrlenA (lpString="*.dbf") returned 5 [0057.089] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.odt") returned 0 [0057.089] lstrlenA (lpString="*.odt") returned 5 [0057.089] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.vob") returned 0 [0057.089] lstrlenA (lpString="*.vob") returned 5 [0057.089] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.ifo") returned 0 [0057.089] lstrlenA (lpString="*.ifo") returned 5 [0057.089] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.lnk") returned 0 [0057.089] lstrlenA (lpString="*.lnk") returned 5 [0057.089] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.torrent") returned 0 [0057.089] lstrlenA (lpString="*.torrent") returned 9 [0057.089] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.mov") returned 0 [0057.089] lstrlenA (lpString="*.mov") returned 5 [0057.089] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.m2v") returned 0 [0057.089] lstrlenA (lpString="*.m2v") returned 5 [0057.089] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.3gp") returned 0 [0057.090] lstrlenA (lpString="*.3gp") returned 5 [0057.090] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.mpeg") returned 0 [0057.090] lstrlenA (lpString="*.mpeg") returned 6 [0057.090] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.mpg") returned 0 [0057.090] lstrlenA (lpString="*.mpg") returned 5 [0057.090] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.flv") returned 0 [0057.090] lstrlenA (lpString="*.flv") returned 5 [0057.090] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.avi") returned 0 [0057.090] lstrlenA (lpString="*.avi") returned 5 [0057.090] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.mp4") returned 0 [0057.090] lstrlenA (lpString="*.mp4") returned 5 [0057.090] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.wmv") returned 0 [0057.090] lstrlenA (lpString="*.wmv") returned 5 [0057.090] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.divx") returned 0 [0057.090] lstrlenA (lpString="*.divx") returned 6 [0057.090] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.mkv") returned 0 [0057.090] lstrlenA (lpString="*.mkv") returned 5 [0057.090] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.mp3") returned 0 [0057.090] lstrlenA (lpString="*.mp3") returned 5 [0057.090] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.wav") returned 0 [0057.090] lstrlenA (lpString="*.wav") returned 5 [0057.090] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.flac") returned 0 [0057.090] lstrlenA (lpString="*.flac") returned 6 [0057.090] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.ape") returned 0 [0057.090] lstrlenA (lpString="*.ape") returned 5 [0057.090] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.wma") returned 0 [0057.090] lstrlenA (lpString="*.wma") returned 5 [0057.090] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.ac3") returned 0 [0057.091] lstrlenA (lpString="*.ac3") returned 5 [0057.091] FindNextFileA (in: hFindFile=0x6364b0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41a72fa0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41a72fa0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3b39aaf0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x9b2, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.091] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.091] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.091] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.091] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.091] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml") returned="ExcelMUI.xml" [0057.091] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\" [0057.091] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\") returned="" [0057.091] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.091] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.091] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml" [0057.091] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0 [0057.091] lstrlenA (lpString="*.zip") returned 5 [0057.091] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0 [0057.091] lstrlenA (lpString="*.rar") returned 5 [0057.091] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0 [0057.091] lstrlenA (lpString="*.7z") returned 4 [0057.091] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0 [0057.091] lstrlenA (lpString="*.tar") returned 5 [0057.091] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gzip") returned 0 [0057.092] lstrlenA (lpString="*.gzip") returned 6 [0057.092] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0 [0057.092] lstrlenA (lpString="*.jpg") returned 5 [0057.092] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0 [0057.092] lstrlenA (lpString="*.jpeg") returned 6 [0057.092] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0 [0057.092] lstrlenA (lpString="*.psd") returned 5 [0057.092] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cdr") returned 0 [0057.092] lstrlenA (lpString="*.cdr") returned 5 [0057.092] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dwg") returned 0 [0057.092] lstrlenA (lpString="*.dwg") returned 5 [0057.092] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.max") returned 0 [0057.092] lstrlenA (lpString="*.max") returned 5 [0057.092] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.bmp") returned 0 [0057.092] lstrlenA (lpString="*.bmp") returned 5 [0057.092] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gif") returned 0 [0057.092] lstrlenA (lpString="*.gif") returned 5 [0057.092] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.png") returned 0 [0057.092] lstrlenA (lpString="*.png") returned 5 [0057.092] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0 [0057.092] lstrlenA (lpString="*.doc") returned 5 [0057.092] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0 [0057.092] lstrlenA (lpString="*.docx") returned 6 [0057.092] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0 [0057.092] lstrlenA (lpString="*.xls") returned 5 [0057.092] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0 [0057.093] lstrlenA (lpString="*.xlsx") returned 6 [0057.093] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0 [0057.093] lstrlenA (lpString="*.ppt") returned 5 [0057.093] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0 [0057.093] lstrlenA (lpString="*.pptx") returned 6 [0057.093] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.txt") returned 0 [0057.093] lstrlenA (lpString="*.txt") returned 5 [0057.093] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pdf") returned 0 [0057.093] lstrlenA (lpString="*.pdf") returned 5 [0057.093] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.djvu") returned 0 [0057.093] lstrlenA (lpString="*.djvu") returned 6 [0057.093] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.htm") returned 0 [0057.093] lstrlenA (lpString="*.htm") returned 5 [0057.093] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.html") returned 0 [0057.093] lstrlenA (lpString="*.html") returned 6 [0057.093] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mdb") returned 0 [0057.093] lstrlenA (lpString="*.mdb") returned 5 [0057.093] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cer") returned 0 [0057.093] lstrlenA (lpString="*.cer") returned 5 [0057.093] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.p12") returned 0 [0057.093] lstrlenA (lpString="*.p12") returned 5 [0057.093] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pfx") returned 0 [0057.093] lstrlenA (lpString="*.pfx") returned 5 [0057.093] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.kwm") returned 0 [0057.093] lstrlenA (lpString="*.kwm") returned 5 [0057.093] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pwm") returned 0 [0057.093] lstrlenA (lpString="*.pwm") returned 5 [0057.093] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.1cd") returned 0 [0057.094] lstrlenA (lpString="*.1cd") returned 5 [0057.094] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.md") returned 0 [0057.094] lstrlenA (lpString="*.md") returned 4 [0057.094] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mdf") returned 0 [0057.094] lstrlenA (lpString="*.mdf") returned 5 [0057.094] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dbf") returned 0 [0057.094] lstrlenA (lpString="*.dbf") returned 5 [0057.094] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.odt") returned 0 [0057.094] lstrlenA (lpString="*.odt") returned 5 [0057.094] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.vob") returned 0 [0057.094] lstrlenA (lpString="*.vob") returned 5 [0057.094] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ifo") returned 0 [0057.094] lstrlenA (lpString="*.ifo") returned 5 [0057.094] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.lnk") returned 0 [0057.094] lstrlenA (lpString="*.lnk") returned 5 [0057.094] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.torrent") returned 0 [0057.094] lstrlenA (lpString="*.torrent") returned 9 [0057.094] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mov") returned 0 [0057.094] lstrlenA (lpString="*.mov") returned 5 [0057.094] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.m2v") returned 0 [0057.094] lstrlenA (lpString="*.m2v") returned 5 [0057.094] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.3gp") returned 0 [0057.094] lstrlenA (lpString="*.3gp") returned 5 [0057.094] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpeg") returned 0 [0057.094] lstrlenA (lpString="*.mpeg") returned 6 [0057.094] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpg") returned 0 [0057.094] lstrlenA (lpString="*.mpg") returned 5 [0057.095] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flv") returned 0 [0057.095] lstrlenA (lpString="*.flv") returned 5 [0057.095] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.avi") returned 0 [0057.095] lstrlenA (lpString="*.avi") returned 5 [0057.095] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp4") returned 0 [0057.095] lstrlenA (lpString="*.mp4") returned 5 [0057.095] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wmv") returned 0 [0057.095] lstrlenA (lpString="*.wmv") returned 5 [0057.095] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.divx") returned 0 [0057.095] lstrlenA (lpString="*.divx") returned 6 [0057.095] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mkv") returned 0 [0057.095] lstrlenA (lpString="*.mkv") returned 5 [0057.095] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp3") returned 0 [0057.095] lstrlenA (lpString="*.mp3") returned 5 [0057.095] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wav") returned 0 [0057.095] lstrlenA (lpString="*.wav") returned 5 [0057.095] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flac") returned 0 [0057.095] lstrlenA (lpString="*.flac") returned 6 [0057.095] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ape") returned 0 [0057.095] lstrlenA (lpString="*.ape") returned 5 [0057.095] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wma") returned 0 [0057.095] lstrlenA (lpString="*.wma") returned 5 [0057.096] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ac3") returned 0 [0057.096] lstrlenA (lpString="*.ac3") returned 5 [0057.096] FindNextFileA (in: hFindFile=0x6364b0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41a72fa0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41a72fa0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3b39aaf0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x9b2, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.096] FindClose (in: hFindFile=0x6364b0 | out: hFindFile=0x6364b0) returned 1 [0057.096] FindNextFileA (in: hFindFile=0x636470, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c54da11, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c6b4905, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c6b4905, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="{90160000-0018-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9CA7F~1")) returned 1 [0057.096] lstrcmpA (lpString1=".", lpString2="{90160000-0018-0409-0000-0000000FF1CE}-C") returned -1 [0057.096] lstrcmpA (lpString1="..", lpString2="{90160000-0018-0409-0000-0000000FF1CE}-C") returned -1 [0057.096] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.096] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90160000-0018-0409-0000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C" [0057.096] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C") returned 62 [0057.096] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\*.*" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\*.*"), lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c54da11, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c6b4905, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c6b4905, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x636ab0 [0057.098] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.099] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c54da11, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c6b4905, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c6b4905, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="..", cAlternateFileName="")) returned 1 [0057.099] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.099] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.099] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x169d4f10, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x169d4f10, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x3c56b3b0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x247000, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0057.099] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.099] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PowerPointMUI.msi") returned -1 [0057.099] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PowerPointMUI.msi") returned -1 [0057.099] lstrcmpiA (lpString1="", lpString2="PowerPointMUI.msi") returned -1 [0057.099] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.099] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\" [0057.099] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\") returned="" [0057.099] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.099] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.099] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0057.100] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.100] WriteFile (in: hFile=0x1c8, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.101] SetFileTime (hFile=0x1c8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.101] CloseHandle (hObject=0x1c8) returned 1 [0057.101] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\", lpString2="PowerPointMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi") returned="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi" [0057.101] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.zip") returned 0 [0057.101] lstrlenA (lpString="*.zip") returned 5 [0057.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.rar") returned 0 [0057.102] lstrlenA (lpString="*.rar") returned 5 [0057.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.7z") returned 0 [0057.102] lstrlenA (lpString="*.7z") returned 4 [0057.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.tar") returned 0 [0057.102] lstrlenA (lpString="*.tar") returned 5 [0057.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.gzip") returned 0 [0057.102] lstrlenA (lpString="*.gzip") returned 6 [0057.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.jpg") returned 0 [0057.102] lstrlenA (lpString="*.jpg") returned 5 [0057.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.jpeg") returned 0 [0057.102] lstrlenA (lpString="*.jpeg") returned 6 [0057.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.psd") returned 0 [0057.102] lstrlenA (lpString="*.psd") returned 5 [0057.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.cdr") returned 0 [0057.102] lstrlenA (lpString="*.cdr") returned 5 [0057.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.dwg") returned 0 [0057.102] lstrlenA (lpString="*.dwg") returned 5 [0057.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.max") returned 0 [0057.102] lstrlenA (lpString="*.max") returned 5 [0057.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.bmp") returned 0 [0057.102] lstrlenA (lpString="*.bmp") returned 5 [0057.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.gif") returned 0 [0057.102] lstrlenA (lpString="*.gif") returned 5 [0057.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.png") returned 0 [0057.102] lstrlenA (lpString="*.png") returned 5 [0057.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.doc") returned 0 [0057.102] lstrlenA (lpString="*.doc") returned 5 [0057.103] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.docx") returned 0 [0057.103] lstrlenA (lpString="*.docx") returned 6 [0057.103] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.xls") returned 0 [0057.103] lstrlenA (lpString="*.xls") returned 5 [0057.103] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.xlsx") returned 0 [0057.103] lstrlenA (lpString="*.xlsx") returned 6 [0057.103] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.ppt") returned 0 [0057.103] lstrlenA (lpString="*.ppt") returned 5 [0057.103] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.pptx") returned 0 [0057.103] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.txt") returned 0 [0057.103] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.pdf") returned 0 [0057.103] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.djvu") returned 0 [0057.103] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.htm") returned 0 [0057.103] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.html") returned 0 [0057.103] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mdb") returned 0 [0057.103] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.cer") returned 0 [0057.103] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.p12") returned 0 [0057.103] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.pfx") returned 0 [0057.103] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.kwm") returned 0 [0057.103] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.pwm") returned 0 [0057.103] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.1cd") returned 0 [0057.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.md") returned 0 [0057.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mdf") returned 0 [0057.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.dbf") returned 0 [0057.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.odt") returned 0 [0057.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.vob") returned 0 [0057.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.ifo") returned 0 [0057.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.lnk") returned 0 [0057.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.torrent") returned 0 [0057.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mov") returned 0 [0057.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.m2v") returned 0 [0057.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.3gp") returned 0 [0057.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mpeg") returned 0 [0057.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mpg") returned 0 [0057.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.flv") returned 0 [0057.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.avi") returned 0 [0057.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mp4") returned 0 [0057.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.wmv") returned 0 [0057.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.divx") returned 0 [0057.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mkv") returned 0 [0057.105] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mp3") returned 0 [0057.105] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.wav") returned 0 [0057.105] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.flac") returned 0 [0057.105] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.ape") returned 0 [0057.105] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.wma") returned 0 [0057.105] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.ac3") returned 0 [0057.105] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34e10110, ftCreationTime.dwHighDateTime=0x1d0cbb3, ftLastAccessTime.dwLowDateTime=0x34e10110, ftLastAccessTime.dwHighDateTime=0x1d0cbb3, ftLastWriteTime.dwLowDateTime=0x3c54def0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x67d, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0057.105] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.105] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PowerPointMUI.xml") returned -1 [0057.105] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PowerPointMUI.xml") returned -1 [0057.105] lstrcmpiA (lpString1="", lpString2="PowerPointMUI.xml") returned -1 [0057.105] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi") returned="PowerPointMUI.msi" [0057.105] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\" [0057.105] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\") returned="" [0057.105] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.105] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.105] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\", lpString2="PowerPointMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml") returned="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml" [0057.105] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.zip") returned 0 [0057.105] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.rar") returned 0 [0057.105] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.7z") returned 0 [0057.105] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.tar") returned 0 [0057.105] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.gzip") returned 0 [0057.106] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.jpg") returned 0 [0057.106] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.jpeg") returned 0 [0057.106] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.psd") returned 0 [0057.106] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.cdr") returned 0 [0057.106] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.dwg") returned 0 [0057.106] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.max") returned 0 [0057.106] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.bmp") returned 0 [0057.106] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.gif") returned 0 [0057.106] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.png") returned 0 [0057.106] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.doc") returned 0 [0057.106] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.docx") returned 0 [0057.106] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.xls") returned 0 [0057.106] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.xlsx") returned 0 [0057.106] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.ppt") returned 0 [0057.106] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.pptx") returned 0 [0057.106] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.txt") returned 0 [0057.106] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.pdf") returned 0 [0057.106] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.djvu") returned 0 [0057.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.htm") returned 0 [0057.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.html") returned 0 [0057.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mdb") returned 0 [0057.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.cer") returned 0 [0057.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.p12") returned 0 [0057.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.pfx") returned 0 [0057.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.kwm") returned 0 [0057.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.pwm") returned 0 [0057.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.1cd") returned 0 [0057.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.md") returned 0 [0057.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mdf") returned 0 [0057.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.dbf") returned 0 [0057.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.odt") returned 0 [0057.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.vob") returned 0 [0057.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.ifo") returned 0 [0057.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.lnk") returned 0 [0057.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.torrent") returned 0 [0057.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mov") returned 0 [0057.108] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.m2v") returned 0 [0057.108] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.3gp") returned 0 [0057.108] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mpeg") returned 0 [0057.108] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mpg") returned 0 [0057.108] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.flv") returned 0 [0057.108] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.avi") returned 0 [0057.108] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mp4") returned 0 [0057.108] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.wmv") returned 0 [0057.108] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.divx") returned 0 [0057.108] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mkv") returned 0 [0057.108] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mp3") returned 0 [0057.108] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.wav") returned 0 [0057.108] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.flac") returned 0 [0057.108] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.ape") returned 0 [0057.108] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.wma") returned 0 [0057.108] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.ac3") returned 0 [0057.108] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6902120, ftCreationTime.dwHighDateTime=0x1d0cbc1, ftLastAccessTime.dwLowDateTime=0x6902120, ftLastAccessTime.dwHighDateTime=0x1d0cbc1, ftLastWriteTime.dwLowDateTime=0x3c5ddfa0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x6048ee, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0057.108] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.108] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PptLR.cab") returned -1 [0057.108] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PptLR.cab") returned -1 [0057.109] lstrcmpiA (lpString1="", lpString2="PptLR.cab") returned -1 [0057.109] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml") returned="PowerPointMUI.xml" [0057.109] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\" [0057.109] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\") returned="" [0057.109] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.109] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.109] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\", lpString2="PptLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab") returned="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab" [0057.109] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.zip") returned 0 [0057.109] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.rar") returned 0 [0057.109] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.7z") returned 0 [0057.109] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.tar") returned 0 [0057.109] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.gzip") returned 0 [0057.109] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.jpg") returned 0 [0057.109] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.jpeg") returned 0 [0057.109] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.psd") returned 0 [0057.109] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.cdr") returned 0 [0057.109] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.dwg") returned 0 [0057.109] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.max") returned 0 [0057.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.bmp") returned 0 [0057.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.gif") returned 0 [0057.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.png") returned 0 [0057.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.doc") returned 0 [0057.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.docx") returned 0 [0057.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.xls") returned 0 [0057.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.xlsx") returned 0 [0057.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.ppt") returned 0 [0057.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.pptx") returned 0 [0057.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.txt") returned 0 [0057.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.pdf") returned 0 [0057.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.djvu") returned 0 [0057.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.htm") returned 0 [0057.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.html") returned 0 [0057.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.mdb") returned 0 [0057.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.cer") returned 0 [0057.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.p12") returned 0 [0057.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.pfx") returned 0 [0057.111] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.kwm") returned 0 [0057.111] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.pwm") returned 0 [0057.111] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.1cd") returned 0 [0057.111] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.md") returned 0 [0057.111] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.mdf") returned 0 [0057.111] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.dbf") returned 0 [0057.111] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.odt") returned 0 [0057.111] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.vob") returned 0 [0057.111] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.ifo") returned 0 [0057.111] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.lnk") returned 0 [0057.111] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.torrent") returned 0 [0057.111] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.mov") returned 0 [0057.111] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.m2v") returned 0 [0057.111] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.3gp") returned 0 [0057.111] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.mpeg") returned 0 [0057.111] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.mpg") returned 0 [0057.112] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.flv") returned 0 [0057.112] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.avi") returned 0 [0057.112] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.mp4") returned 0 [0057.112] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.wmv") returned 0 [0057.112] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.divx") returned 0 [0057.112] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.mkv") returned 0 [0057.112] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.mp3") returned 0 [0057.112] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.wav") returned 0 [0057.112] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.flac") returned 0 [0057.112] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.ape") returned 0 [0057.112] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.wma") returned 0 [0057.112] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.ac3") returned 0 [0057.112] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x426d17b0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x426d17b0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3c6b2610, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x818, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.112] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.112] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.112] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.112] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.112] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab") returned="PptLR.cab" [0057.112] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\" [0057.112] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\") returned="" [0057.112] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.113] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.113] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml" [0057.113] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0 [0057.113] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0 [0057.113] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0 [0057.113] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0 [0057.113] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gzip") returned 0 [0057.113] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0 [0057.113] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0 [0057.113] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0 [0057.113] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cdr") returned 0 [0057.113] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dwg") returned 0 [0057.113] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.max") returned 0 [0057.113] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.bmp") returned 0 [0057.113] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gif") returned 0 [0057.113] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.png") returned 0 [0057.113] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0 [0057.113] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0 [0057.114] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0 [0057.114] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0 [0057.114] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0 [0057.114] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0 [0057.114] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.txt") returned 0 [0057.114] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pdf") returned 0 [0057.114] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.djvu") returned 0 [0057.114] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.htm") returned 0 [0057.114] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.html") returned 0 [0057.114] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mdb") returned 0 [0057.114] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cer") returned 0 [0057.114] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.p12") returned 0 [0057.114] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pfx") returned 0 [0057.114] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.kwm") returned 0 [0057.114] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pwm") returned 0 [0057.114] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.1cd") returned 0 [0057.114] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.md") returned 0 [0057.114] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mdf") returned 0 [0057.114] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dbf") returned 0 [0057.115] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.odt") returned 0 [0057.115] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.vob") returned 0 [0057.115] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ifo") returned 0 [0057.115] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.lnk") returned 0 [0057.115] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.torrent") returned 0 [0057.115] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mov") returned 0 [0057.115] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.m2v") returned 0 [0057.115] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.3gp") returned 0 [0057.115] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpeg") returned 0 [0057.115] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpg") returned 0 [0057.115] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flv") returned 0 [0057.115] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.avi") returned 0 [0057.115] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp4") returned 0 [0057.115] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wmv") returned 0 [0057.115] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.divx") returned 0 [0057.115] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mkv") returned 0 [0057.115] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp3") returned 0 [0057.115] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wav") returned 0 [0057.115] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flac") returned 0 [0057.115] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ape") returned 0 [0057.116] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wma") returned 0 [0057.116] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ac3") returned 0 [0057.116] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x426d17b0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x426d17b0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3c6b2610, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x818, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.116] FindClose (in: hFindFile=0x636ab0 | out: hFindFile=0x636ab0) returned 1 [0057.116] FindNextFileA (in: hFindFile=0x636470, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c6ca85c, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c7d2320, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c7d2320, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="{90160000-0019-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9032D~1")) returned 1 [0057.116] lstrcmpA (lpString1=".", lpString2="{90160000-0019-0409-0000-0000000FF1CE}-C") returned -1 [0057.116] lstrcmpA (lpString1="..", lpString2="{90160000-0019-0409-0000-0000000FF1CE}-C") returned -1 [0057.116] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.116] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90160000-0019-0409-0000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C" [0057.116] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\*.*" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\*.*"), lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c6ca85c, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c7d2320, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c7d2320, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x636730 [0057.121] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.122] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c6ca85c, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c7d2320, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c7d2320, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="..", cAlternateFileName="")) returned 1 [0057.122] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.122] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.122] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16c60cc0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x16c60cc0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x3c6e3350, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x24c000, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0057.122] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.122] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PublisherMUI.msi") returned -1 [0057.122] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PublisherMUI.msi") returned -1 [0057.122] lstrcmpiA (lpString1="", lpString2="PublisherMUI.msi") returned -1 [0057.122] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.122] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\" [0057.122] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\") returned="" [0057.122] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.122] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.122] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0057.123] WriteFile (in: hFile=0x1c8, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.124] SetFileTime (hFile=0x1c8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.124] CloseHandle (hObject=0x1c8) returned 1 [0057.125] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\", lpString2="PublisherMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi") returned="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi" [0057.125] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.zip") returned 0 [0057.125] lstrlenA (lpString="*.zip") returned 5 [0057.125] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.rar") returned 0 [0057.125] lstrlenA (lpString="*.rar") returned 5 [0057.125] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.7z") returned 0 [0057.125] lstrlenA (lpString="*.7z") returned 4 [0057.125] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.tar") returned 0 [0057.125] lstrlenA (lpString="*.tar") returned 5 [0057.125] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.gzip") returned 0 [0057.125] lstrlenA (lpString="*.gzip") returned 6 [0057.125] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.jpg") returned 0 [0057.125] lstrlenA (lpString="*.jpg") returned 5 [0057.125] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.jpeg") returned 0 [0057.125] lstrlenA (lpString="*.jpeg") returned 6 [0057.125] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.psd") returned 0 [0057.125] lstrlenA (lpString="*.psd") returned 5 [0057.125] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.cdr") returned 0 [0057.125] lstrlenA (lpString="*.cdr") returned 5 [0057.125] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.dwg") returned 0 [0057.125] lstrlenA (lpString="*.dwg") returned 5 [0057.125] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.max") returned 0 [0057.125] lstrlenA (lpString="*.max") returned 5 [0057.126] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.bmp") returned 0 [0057.126] lstrlenA (lpString="*.bmp") returned 5 [0057.126] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.gif") returned 0 [0057.126] lstrlenA (lpString="*.gif") returned 5 [0057.126] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.png") returned 0 [0057.126] lstrlenA (lpString="*.png") returned 5 [0057.126] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.doc") returned 0 [0057.126] lstrlenA (lpString="*.doc") returned 5 [0057.126] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.docx") returned 0 [0057.126] lstrlenA (lpString="*.docx") returned 6 [0057.126] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.xls") returned 0 [0057.126] lstrlenA (lpString="*.xls") returned 5 [0057.126] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.xlsx") returned 0 [0057.126] lstrlenA (lpString="*.xlsx") returned 6 [0057.126] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.ppt") returned 0 [0057.126] lstrlenA (lpString="*.ppt") returned 5 [0057.126] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.pptx") returned 0 [0057.126] lstrlenA (lpString="*.pptx") returned 6 [0057.126] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.txt") returned 0 [0057.126] lstrlenA (lpString="*.txt") returned 5 [0057.127] lstrlenA (lpString="*.pdf") returned 5 [0057.127] lstrlenA (lpString="*.djvu") returned 6 [0057.127] lstrlenA (lpString="*.htm") returned 5 [0057.127] lstrlenA (lpString="*.html") returned 6 [0057.127] lstrlenA (lpString="*.mdb") returned 5 [0057.127] lstrlenA (lpString="*.cer") returned 5 [0057.127] lstrlenA (lpString="*.p12") returned 5 [0057.127] lstrlenA (lpString="*.pfx") returned 5 [0057.127] lstrlenA (lpString="*.kwm") returned 5 [0057.127] lstrlenA (lpString="*.pwm") returned 5 [0057.128] lstrlenA (lpString="*.1cd") returned 5 [0057.128] lstrlenA (lpString="*.md") returned 4 [0057.128] lstrlenA (lpString="*.mdf") returned 5 [0057.128] lstrlenA (lpString="*.dbf") returned 5 [0057.128] lstrlenA (lpString="*.odt") returned 5 [0057.128] lstrlenA (lpString="*.vob") returned 5 [0057.128] lstrlenA (lpString="*.ifo") returned 5 [0057.128] lstrlenA (lpString="*.lnk") returned 5 [0057.128] lstrlenA (lpString="*.torrent") returned 9 [0057.128] lstrlenA (lpString="*.mov") returned 5 [0057.128] lstrlenA (lpString="*.m2v") returned 5 [0057.128] lstrlenA (lpString="*.3gp") returned 5 [0057.128] lstrlenA (lpString="*.mpeg") returned 6 [0057.128] lstrlenA (lpString="*.mpg") returned 5 [0057.128] lstrlenA (lpString="*.flv") returned 5 [0057.128] lstrlenA (lpString="*.avi") returned 5 [0057.128] lstrlenA (lpString="*.mp4") returned 5 [0057.128] lstrlenA (lpString="*.wmv") returned 5 [0057.128] lstrlenA (lpString="*.divx") returned 6 [0057.129] lstrlenA (lpString="*.mkv") returned 5 [0057.129] lstrlenA (lpString="*.mp3") returned 5 [0057.129] lstrlenA (lpString="*.wav") returned 5 [0057.129] lstrlenA (lpString="*.flac") returned 6 [0057.129] lstrlenA (lpString="*.ape") returned 5 [0057.129] lstrlenA (lpString="*.wma") returned 5 [0057.129] lstrlenA (lpString="*.ac3") returned 5 [0057.129] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8263d6b0, ftCreationTime.dwHighDateTime=0x1d0cbb3, ftLastAccessTime.dwLowDateTime=0x8263d6b0, ftLastAccessTime.dwHighDateTime=0x1d0cbb3, ftLastWriteTime.dwLowDateTime=0x3c6cacb0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x67e, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0057.129] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.129] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PublisherMUI.xml") returned -1 [0057.129] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PublisherMUI.xml") returned -1 [0057.129] lstrcmpiA (lpString1="", lpString2="PublisherMUI.xml") returned -1 [0057.129] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi") returned="PublisherMUI.msi" [0057.129] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\" [0057.129] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\") returned="" [0057.129] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.129] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.129] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\", lpString2="PublisherMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml") returned="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml" [0057.129] lstrlenA (lpString="*.zip") returned 5 [0057.130] lstrlenA (lpString="*.rar") returned 5 [0057.130] lstrlenA (lpString="*.7z") returned 4 [0057.130] lstrlenA (lpString="*.tar") returned 5 [0057.130] lstrlenA (lpString="*.gzip") returned 6 [0057.130] lstrlenA (lpString="*.jpg") returned 5 [0057.130] lstrlenA (lpString="*.jpeg") returned 6 [0057.130] lstrlenA (lpString="*.psd") returned 5 [0057.130] lstrlenA (lpString="*.cdr") returned 5 [0057.130] lstrlenA (lpString="*.dwg") returned 5 [0057.130] lstrlenA (lpString="*.max") returned 5 [0057.130] lstrlenA (lpString="*.bmp") returned 5 [0057.130] lstrlenA (lpString="*.gif") returned 5 [0057.130] lstrlenA (lpString="*.png") returned 5 [0057.130] lstrlenA (lpString="*.doc") returned 5 [0057.130] lstrlenA (lpString="*.docx") returned 6 [0057.130] lstrlenA (lpString="*.xls") returned 5 [0057.130] lstrlenA (lpString="*.xlsx") returned 6 [0057.130] lstrlenA (lpString="*.ppt") returned 5 [0057.130] lstrlenA (lpString="*.pptx") returned 6 [0057.131] lstrlenA (lpString="*.txt") returned 5 [0057.131] lstrlenA (lpString="*.pdf") returned 5 [0057.131] lstrlenA (lpString="*.djvu") returned 6 [0057.131] lstrlenA (lpString="*.htm") returned 5 [0057.131] lstrlenA (lpString="*.html") returned 6 [0057.131] lstrlenA (lpString="*.mdb") returned 5 [0057.131] lstrlenA (lpString="*.cer") returned 5 [0057.131] lstrlenA (lpString="*.p12") returned 5 [0057.131] lstrlenA (lpString="*.pfx") returned 5 [0057.131] lstrlenA (lpString="*.kwm") returned 5 [0057.131] lstrlenA (lpString="*.pwm") returned 5 [0057.131] lstrlenA (lpString="*.1cd") returned 5 [0057.131] lstrlenA (lpString="*.md") returned 4 [0057.131] lstrlenA (lpString="*.mdf") returned 5 [0057.131] lstrlenA (lpString="*.dbf") returned 5 [0057.131] lstrlenA (lpString="*.odt") returned 5 [0057.131] lstrlenA (lpString="*.vob") returned 5 [0057.131] lstrlenA (lpString="*.ifo") returned 5 [0057.131] lstrlenA (lpString="*.lnk") returned 5 [0057.132] lstrlenA (lpString="*.torrent") returned 9 [0057.132] lstrlenA (lpString="*.mov") returned 5 [0057.132] lstrlenA (lpString="*.m2v") returned 5 [0057.132] lstrlenA (lpString="*.3gp") returned 5 [0057.132] lstrlenA (lpString="*.mpeg") returned 6 [0057.132] lstrlenA (lpString="*.mpg") returned 5 [0057.132] lstrlenA (lpString="*.flv") returned 5 [0057.132] lstrlenA (lpString="*.avi") returned 5 [0057.132] lstrlenA (lpString="*.mp4") returned 5 [0057.132] lstrlenA (lpString="*.wmv") returned 5 [0057.132] lstrlenA (lpString="*.divx") returned 6 [0057.132] lstrlenA (lpString="*.mkv") returned 5 [0057.132] lstrlenA (lpString="*.mp3") returned 5 [0057.132] lstrlenA (lpString="*.wav") returned 5 [0057.132] lstrlenA (lpString="*.flac") returned 6 [0057.132] lstrlenA (lpString="*.ape") returned 5 [0057.132] lstrlenA (lpString="*.wma") returned 5 [0057.132] lstrlenA (lpString="*.ac3") returned 5 [0057.132] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4d82bc70, ftCreationTime.dwHighDateTime=0x1d0cbbf, ftLastAccessTime.dwLowDateTime=0x4d82bc70, ftLastAccessTime.dwHighDateTime=0x1d0cbbf, ftLastWriteTime.dwLowDateTime=0x3c753830, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x3658af, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0057.132] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.132] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PubLR.cab") returned -1 [0057.133] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PubLR.cab") returned -1 [0057.133] lstrcmpiA (lpString1="", lpString2="PubLR.cab") returned -1 [0057.133] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml") returned="PublisherMUI.xml" [0057.133] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\" [0057.133] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\") returned="" [0057.133] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.133] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.133] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\", lpString2="PubLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PubLR.cab") returned="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PubLR.cab" [0057.133] lstrlenA (lpString="*.zip") returned 5 [0057.133] lstrlenA (lpString="*.rar") returned 5 [0057.133] lstrlenA (lpString="*.7z") returned 4 [0057.133] lstrlenA (lpString="*.tar") returned 5 [0057.133] lstrlenA (lpString="*.gzip") returned 6 [0057.133] lstrlenA (lpString="*.jpg") returned 5 [0057.133] lstrlenA (lpString="*.jpeg") returned 6 [0057.133] lstrlenA (lpString="*.psd") returned 5 [0057.133] lstrlenA (lpString="*.cdr") returned 5 [0057.133] lstrlenA (lpString="*.dwg") returned 5 [0057.133] lstrlenA (lpString="*.max") returned 5 [0057.134] lstrlenA (lpString="*.bmp") returned 5 [0057.134] lstrlenA (lpString="*.gif") returned 5 [0057.134] lstrlenA (lpString="*.png") returned 5 [0057.134] lstrlenA (lpString="*.doc") returned 5 [0057.134] lstrlenA (lpString="*.docx") returned 6 [0057.134] lstrlenA (lpString="*.xls") returned 5 [0057.134] lstrlenA (lpString="*.xlsx") returned 6 [0057.134] lstrlenA (lpString="*.ppt") returned 5 [0057.134] lstrlenA (lpString="*.pptx") returned 6 [0057.134] lstrlenA (lpString="*.txt") returned 5 [0057.134] lstrlenA (lpString="*.pdf") returned 5 [0057.134] lstrlenA (lpString="*.djvu") returned 6 [0057.134] lstrlenA (lpString="*.htm") returned 5 [0057.134] lstrlenA (lpString="*.html") returned 6 [0057.134] lstrlenA (lpString="*.mdb") returned 5 [0057.134] lstrlenA (lpString="*.cer") returned 5 [0057.134] lstrlenA (lpString="*.p12") returned 5 [0057.134] lstrlenA (lpString="*.pfx") returned 5 [0057.134] lstrlenA (lpString="*.kwm") returned 5 [0057.134] lstrlenA (lpString="*.pwm") returned 5 [0057.135] lstrlenA (lpString="*.1cd") returned 5 [0057.135] lstrlenA (lpString="*.md") returned 4 [0057.135] lstrlenA (lpString="*.mdf") returned 5 [0057.135] lstrlenA (lpString="*.dbf") returned 5 [0057.135] lstrlenA (lpString="*.odt") returned 5 [0057.135] lstrlenA (lpString="*.vob") returned 5 [0057.135] lstrlenA (lpString="*.ifo") returned 5 [0057.135] lstrlenA (lpString="*.lnk") returned 5 [0057.135] lstrlenA (lpString="*.torrent") returned 9 [0057.135] lstrlenA (lpString="*.mov") returned 5 [0057.135] lstrlenA (lpString="*.m2v") returned 5 [0057.135] lstrlenA (lpString="*.3gp") returned 5 [0057.135] lstrlenA (lpString="*.mpeg") returned 6 [0057.135] lstrlenA (lpString="*.mpg") returned 5 [0057.135] lstrlenA (lpString="*.flv") returned 5 [0057.135] lstrlenA (lpString="*.avi") returned 5 [0057.135] lstrlenA (lpString="*.mp4") returned 5 [0057.135] lstrlenA (lpString="*.wmv") returned 5 [0057.135] lstrlenA (lpString="*.divx") returned 6 [0057.136] lstrlenA (lpString="*.mkv") returned 5 [0057.136] lstrlenA (lpString="*.mp3") returned 5 [0057.136] lstrlenA (lpString="*.wav") returned 5 [0057.136] lstrlenA (lpString="*.flac") returned 6 [0057.136] lstrlenA (lpString="*.ape") returned 5 [0057.136] lstrlenA (lpString="*.wma") returned 5 [0057.136] lstrlenA (lpString="*.ac3") returned 5 [0057.136] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4278fe90, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x4278fe90, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3c7d0060, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x703, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.136] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.136] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.136] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.136] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.136] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PubLR.cab") returned="PubLR.cab" [0057.136] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\" [0057.136] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\") returned="" [0057.136] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.136] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.136] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml" [0057.136] lstrlenA (lpString="*.zip") returned 5 [0057.137] lstrlenA (lpString="*.rar") returned 5 [0057.137] lstrlenA (lpString="*.7z") returned 4 [0057.137] lstrlenA (lpString="*.tar") returned 5 [0057.137] lstrlenA (lpString="*.gzip") returned 6 [0057.137] lstrlenA (lpString="*.jpg") returned 5 [0057.137] lstrlenA (lpString="*.jpeg") returned 6 [0057.137] lstrlenA (lpString="*.psd") returned 5 [0057.137] lstrlenA (lpString="*.cdr") returned 5 [0057.137] lstrlenA (lpString="*.dwg") returned 5 [0057.137] lstrlenA (lpString="*.max") returned 5 [0057.137] lstrlenA (lpString="*.bmp") returned 5 [0057.137] lstrlenA (lpString="*.gif") returned 5 [0057.137] lstrlenA (lpString="*.png") returned 5 [0057.137] lstrlenA (lpString="*.doc") returned 5 [0057.137] lstrlenA (lpString="*.docx") returned 6 [0057.137] lstrlenA (lpString="*.xls") returned 5 [0057.137] lstrlenA (lpString="*.xlsx") returned 6 [0057.137] lstrlenA (lpString="*.ppt") returned 5 [0057.137] lstrlenA (lpString="*.pptx") returned 6 [0057.137] lstrlenA (lpString="*.txt") returned 5 [0057.138] lstrlenA (lpString="*.pdf") returned 5 [0057.138] lstrlenA (lpString="*.djvu") returned 6 [0057.138] lstrlenA (lpString="*.htm") returned 5 [0057.138] lstrlenA (lpString="*.html") returned 6 [0057.138] lstrlenA (lpString="*.mdb") returned 5 [0057.138] lstrlenA (lpString="*.cer") returned 5 [0057.138] lstrlenA (lpString="*.p12") returned 5 [0057.138] lstrlenA (lpString="*.pfx") returned 5 [0057.138] lstrlenA (lpString="*.kwm") returned 5 [0057.138] lstrlenA (lpString="*.pwm") returned 5 [0057.138] lstrlenA (lpString="*.1cd") returned 5 [0057.138] lstrlenA (lpString="*.md") returned 4 [0057.138] lstrlenA (lpString="*.mdf") returned 5 [0057.138] lstrlenA (lpString="*.dbf") returned 5 [0057.138] lstrlenA (lpString="*.odt") returned 5 [0057.138] lstrlenA (lpString="*.vob") returned 5 [0057.138] lstrlenA (lpString="*.ifo") returned 5 [0057.138] lstrlenA (lpString="*.lnk") returned 5 [0057.138] lstrlenA (lpString="*.torrent") returned 9 [0057.138] lstrlenA (lpString="*.mov") returned 5 [0057.139] lstrlenA (lpString="*.m2v") returned 5 [0057.139] lstrlenA (lpString="*.3gp") returned 5 [0057.139] lstrlenA (lpString="*.mpeg") returned 6 [0057.139] lstrlenA (lpString="*.mpg") returned 5 [0057.139] lstrlenA (lpString="*.flv") returned 5 [0057.139] lstrlenA (lpString="*.avi") returned 5 [0057.139] lstrlenA (lpString="*.mp4") returned 5 [0057.139] lstrlenA (lpString="*.wmv") returned 5 [0057.139] lstrlenA (lpString="*.divx") returned 6 [0057.139] lstrlenA (lpString="*.mkv") returned 5 [0057.139] lstrlenA (lpString="*.mp3") returned 5 [0057.139] lstrlenA (lpString="*.wav") returned 5 [0057.139] lstrlenA (lpString="*.flac") returned 6 [0057.139] lstrlenA (lpString="*.ape") returned 5 [0057.139] lstrlenA (lpString="*.wma") returned 5 [0057.139] lstrlenA (lpString="*.ac3") returned 5 [0057.139] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4278fe90, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x4278fe90, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3c7d0060, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x703, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.139] FindClose (in: hFindFile=0x636730 | out: hFindFile=0x636730) returned 1 [0057.140] FindNextFileA (in: hFindFile=0x636470, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c3e6c4d, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c534059, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c534059, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="{90160000-001A-0409-0000-0000000FF1CE}-C", cAlternateFileName="{98E9A~1")) returned 1 [0057.140] lstrcmpA (lpString1=".", lpString2="{90160000-001A-0409-0000-0000000FF1CE}-C") returned -1 [0057.140] lstrcmpA (lpString1="..", lpString2="{90160000-001A-0409-0000-0000000FF1CE}-C") returned -1 [0057.140] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.140] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90160000-001A-0409-0000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C" [0057.140] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C") returned 62 [0057.140] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\*.*" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\*.*"), lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c3e6c4d, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c534059, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c534059, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x636ab0 [0057.143] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.143] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c3e6c4d, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c534059, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c534059, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="..", cAlternateFileName="")) returned 1 [0057.143] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.143] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.143] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90965df0, ftCreationTime.dwHighDateTime=0x1d0cbbf, ftLastAccessTime.dwLowDateTime=0x90965df0, ftLastAccessTime.dwHighDateTime=0x1d0cbbf, ftLastWriteTime.dwLowDateTime=0x3c4bde40, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x3d2ce1, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0057.144] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.144] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OutlkLR.cab") returned -1 [0057.144] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutlkLR.cab") returned -1 [0057.144] lstrcmpiA (lpString1="", lpString2="OutlkLR.cab") returned -1 [0057.144] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.144] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\" [0057.144] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\") returned="" [0057.144] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.144] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.144] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0057.144] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.144] WriteFile (in: hFile=0x1c8, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.146] SetFileTime (hFile=0x1c8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.146] CloseHandle (hObject=0x1c8) returned 1 [0057.146] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\", lpString2="OutlkLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab") returned="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab" [0057.146] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.zip") returned 0 [0057.146] lstrlenA (lpString="*.zip") returned 5 [0057.146] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.rar") returned 0 [0057.146] lstrlenA (lpString="*.rar") returned 5 [0057.146] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.7z") returned 0 [0057.146] lstrlenA (lpString="*.7z") returned 4 [0057.147] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.tar") returned 0 [0057.147] lstrlenA (lpString="*.tar") returned 5 [0057.147] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.gzip") returned 0 [0057.147] lstrlenA (lpString="*.gzip") returned 6 [0057.147] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.jpg") returned 0 [0057.147] lstrlenA (lpString="*.jpg") returned 5 [0057.147] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.jpeg") returned 0 [0057.147] lstrlenA (lpString="*.jpeg") returned 6 [0057.147] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.psd") returned 0 [0057.147] lstrlenA (lpString="*.psd") returned 5 [0057.147] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.cdr") returned 0 [0057.147] lstrlenA (lpString="*.cdr") returned 5 [0057.147] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.dwg") returned 0 [0057.147] lstrlenA (lpString="*.dwg") returned 5 [0057.147] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.max") returned 0 [0057.147] lstrlenA (lpString="*.max") returned 5 [0057.147] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.bmp") returned 0 [0057.147] lstrlenA (lpString="*.bmp") returned 5 [0057.147] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.gif") returned 0 [0057.147] lstrlenA (lpString="*.gif") returned 5 [0057.147] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.png") returned 0 [0057.147] lstrlenA (lpString="*.png") returned 5 [0057.147] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.doc") returned 0 [0057.147] lstrlenA (lpString="*.doc") returned 5 [0057.147] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.docx") returned 0 [0057.147] lstrlenA (lpString="*.docx") returned 6 [0057.148] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.xls") returned 0 [0057.148] lstrlenA (lpString="*.xls") returned 5 [0057.148] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.xlsx") returned 0 [0057.148] lstrlenA (lpString="*.xlsx") returned 6 [0057.148] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.ppt") returned 0 [0057.148] lstrlenA (lpString="*.ppt") returned 5 [0057.148] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.pptx") returned 0 [0057.148] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.txt") returned 0 [0057.148] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.pdf") returned 0 [0057.148] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.djvu") returned 0 [0057.148] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.htm") returned 0 [0057.148] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.html") returned 0 [0057.148] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.mdb") returned 0 [0057.148] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.cer") returned 0 [0057.148] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.p12") returned 0 [0057.148] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.pfx") returned 0 [0057.148] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.kwm") returned 0 [0057.148] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.pwm") returned 0 [0057.148] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.1cd") returned 0 [0057.148] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.md") returned 0 [0057.148] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.mdf") returned 0 [0057.149] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.dbf") returned 0 [0057.149] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.odt") returned 0 [0057.149] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.vob") returned 0 [0057.149] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.ifo") returned 0 [0057.149] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.lnk") returned 0 [0057.149] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.torrent") returned 0 [0057.149] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.mov") returned 0 [0057.149] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.m2v") returned 0 [0057.149] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.3gp") returned 0 [0057.149] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.mpeg") returned 0 [0057.149] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.mpg") returned 0 [0057.149] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.flv") returned 0 [0057.149] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.avi") returned 0 [0057.149] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.mp4") returned 0 [0057.149] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.wmv") returned 0 [0057.149] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.divx") returned 0 [0057.149] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.mkv") returned 0 [0057.149] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.mp3") returned 0 [0057.149] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.wav") returned 0 [0057.149] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.flac") returned 0 [0057.150] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.ape") returned 0 [0057.150] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.wma") returned 0 [0057.150] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.ac3") returned 0 [0057.150] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749677e0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x749677e0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x3c404580, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3000, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0057.150] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.150] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OutlookMUI.msi") returned -1 [0057.150] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutlookMUI.msi") returned -1 [0057.150] lstrcmpiA (lpString1="", lpString2="OutlookMUI.msi") returned -1 [0057.150] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab") returned="OutlkLR.cab" [0057.150] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\" [0057.150] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\") returned="" [0057.150] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.150] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.150] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\", lpString2="OutlookMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi") returned="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi" [0057.150] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.zip") returned 0 [0057.150] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.rar") returned 0 [0057.150] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.7z") returned 0 [0057.150] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.tar") returned 0 [0057.150] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.gzip") returned 0 [0057.151] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.jpg") returned 0 [0057.151] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.jpeg") returned 0 [0057.151] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.psd") returned 0 [0057.151] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.cdr") returned 0 [0057.151] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.dwg") returned 0 [0057.151] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.max") returned 0 [0057.151] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.bmp") returned 0 [0057.151] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.gif") returned 0 [0057.151] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.png") returned 0 [0057.151] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.doc") returned 0 [0057.151] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.docx") returned 0 [0057.151] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.xls") returned 0 [0057.151] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.xlsx") returned 0 [0057.151] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.ppt") returned 0 [0057.151] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.pptx") returned 0 [0057.151] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.txt") returned 0 [0057.151] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.pdf") returned 0 [0057.151] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.djvu") returned 0 [0057.151] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.htm") returned 0 [0057.152] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.html") returned 0 [0057.152] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.mdb") returned 0 [0057.152] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.cer") returned 0 [0057.152] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.p12") returned 0 [0057.152] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.pfx") returned 0 [0057.152] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.kwm") returned 0 [0057.152] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.pwm") returned 0 [0057.152] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.1cd") returned 0 [0057.152] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.md") returned 0 [0057.152] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.mdf") returned 0 [0057.152] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.dbf") returned 0 [0057.152] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.odt") returned 0 [0057.152] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.vob") returned 0 [0057.152] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.ifo") returned 0 [0057.152] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.lnk") returned 0 [0057.152] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.torrent") returned 0 [0057.152] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.mov") returned 0 [0057.152] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.m2v") returned 0 [0057.152] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.3gp") returned 0 [0057.153] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.mpeg") returned 0 [0057.153] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.mpg") returned 0 [0057.153] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.flv") returned 0 [0057.153] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.avi") returned 0 [0057.153] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.mp4") returned 0 [0057.153] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.wmv") returned 0 [0057.153] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.divx") returned 0 [0057.153] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.mkv") returned 0 [0057.153] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.mp3") returned 0 [0057.153] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.wav") returned 0 [0057.153] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.flac") returned 0 [0057.153] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.ape") returned 0 [0057.153] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.wma") returned 0 [0057.153] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.ac3") returned 0 [0057.153] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfb696530, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0xfb696530, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0x3c3e70c0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0xb15, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0057.153] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.153] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OutlookMUI.xml") returned -1 [0057.153] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutlookMUI.xml") returned -1 [0057.153] lstrcmpiA (lpString1="", lpString2="OutlookMUI.xml") returned -1 [0057.153] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi") returned="OutlookMUI.msi" [0057.153] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\" [0057.154] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\") returned="" [0057.154] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.154] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.154] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\", lpString2="OutlookMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml") returned="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml" [0057.154] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.zip") returned 0 [0057.154] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.rar") returned 0 [0057.154] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.7z") returned 0 [0057.154] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.tar") returned 0 [0057.154] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.gzip") returned 0 [0057.154] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.jpg") returned 0 [0057.154] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.jpeg") returned 0 [0057.154] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.psd") returned 0 [0057.154] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.cdr") returned 0 [0057.154] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.dwg") returned 0 [0057.154] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.max") returned 0 [0057.154] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.bmp") returned 0 [0057.154] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.gif") returned 0 [0057.154] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.png") returned 0 [0057.154] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.doc") returned 0 [0057.155] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.docx") returned 0 [0057.155] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.xls") returned 0 [0057.155] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.xlsx") returned 0 [0057.155] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.ppt") returned 0 [0057.155] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.pptx") returned 0 [0057.155] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.txt") returned 0 [0057.155] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.pdf") returned 0 [0057.155] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.djvu") returned 0 [0057.155] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.htm") returned 0 [0057.155] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.html") returned 0 [0057.155] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.mdb") returned 0 [0057.155] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.cer") returned 0 [0057.155] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.p12") returned 0 [0057.155] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.pfx") returned 0 [0057.155] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.kwm") returned 0 [0057.155] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.pwm") returned 0 [0057.155] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.1cd") returned 0 [0057.155] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.md") returned 0 [0057.155] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.mdf") returned 0 [0057.156] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.dbf") returned 0 [0057.156] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.odt") returned 0 [0057.156] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.vob") returned 0 [0057.156] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.ifo") returned 0 [0057.156] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.lnk") returned 0 [0057.156] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.torrent") returned 0 [0057.156] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.mov") returned 0 [0057.156] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.m2v") returned 0 [0057.156] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.3gp") returned 0 [0057.156] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.mpeg") returned 0 [0057.156] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.mpg") returned 0 [0057.156] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.flv") returned 0 [0057.156] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.avi") returned 0 [0057.156] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.mp4") returned 0 [0057.156] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.wmv") returned 0 [0057.156] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.divx") returned 0 [0057.156] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.mkv") returned 0 [0057.156] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.mp3") returned 0 [0057.156] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.wav") returned 0 [0057.157] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.flac") returned 0 [0057.157] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.ape") returned 0 [0057.157] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.wma") returned 0 [0057.157] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.ac3") returned 0 [0057.157] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x425ebfd0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x425ebfd0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3c533140, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0xf1e, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.157] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.157] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.157] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.157] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.157] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml") returned="OutlookMUI.xml" [0057.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\" [0057.157] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\") returned="" [0057.157] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.157] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.157] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml" [0057.157] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0 [0057.157] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0 [0057.157] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0 [0057.157] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0 [0057.158] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gzip") returned 0 [0057.158] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0 [0057.158] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0 [0057.158] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0 [0057.158] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cdr") returned 0 [0057.158] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dwg") returned 0 [0057.168] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.max") returned 0 [0057.168] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.bmp") returned 0 [0057.168] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gif") returned 0 [0057.168] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.png") returned 0 [0057.168] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0 [0057.168] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0 [0057.168] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0 [0057.168] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0 [0057.168] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0 [0057.168] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0 [0057.168] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.txt") returned 0 [0057.168] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pdf") returned 0 [0057.168] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.djvu") returned 0 [0057.168] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.htm") returned 0 [0057.168] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.html") returned 0 [0057.169] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mdb") returned 0 [0057.169] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cer") returned 0 [0057.169] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.p12") returned 0 [0057.169] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pfx") returned 0 [0057.169] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.kwm") returned 0 [0057.169] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pwm") returned 0 [0057.169] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.1cd") returned 0 [0057.169] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.md") returned 0 [0057.169] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mdf") returned 0 [0057.169] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dbf") returned 0 [0057.169] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.odt") returned 0 [0057.169] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.vob") returned 0 [0057.169] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ifo") returned 0 [0057.169] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.lnk") returned 0 [0057.169] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.torrent") returned 0 [0057.169] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mov") returned 0 [0057.169] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.m2v") returned 0 [0057.169] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.3gp") returned 0 [0057.169] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpeg") returned 0 [0057.170] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpg") returned 0 [0057.170] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flv") returned 0 [0057.170] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.avi") returned 0 [0057.170] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp4") returned 0 [0057.170] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wmv") returned 0 [0057.170] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.divx") returned 0 [0057.170] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mkv") returned 0 [0057.170] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp3") returned 0 [0057.170] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wav") returned 0 [0057.170] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flac") returned 0 [0057.170] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ape") returned 0 [0057.170] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wma") returned 0 [0057.170] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ac3") returned 0 [0057.170] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x425ebfd0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x425ebfd0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3c533140, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0xf1e, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.170] FindClose (in: hFindFile=0x636ab0 | out: hFindFile=0x636ab0) returned 1 [0057.170] FindNextFileA (in: hFindFile=0x636470, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c7ea9fb, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3dcbe363, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3dcbe363, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="{90160000-001B-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9E8C9~1")) returned 1 [0057.171] lstrcmpA (lpString1=".", lpString2="{90160000-001B-0409-0000-0000000FF1CE}-C") returned -1 [0057.171] lstrcmpA (lpString1="..", lpString2="{90160000-001B-0409-0000-0000000FF1CE}-C") returned -1 [0057.171] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.171] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90160000-001B-0409-0000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C" [0057.171] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\*.*" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\*.*"), lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c7ea9fb, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3dcbe363, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3dcbe363, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x6366f0 [0057.172] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.172] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c7ea9fb, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3dcbe363, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3dcbe363, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="..", cAlternateFileName="")) returned 1 [0057.172] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.172] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.172] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4289c770, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x4289c770, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3dce3880, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0xad4, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.172] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.172] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.172] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.172] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.172] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.172] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\" [0057.172] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\") returned="" [0057.173] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.173] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.173] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0057.175] WriteFile (in: hFile=0x1c8, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.176] SetFileTime (hFile=0x1c8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.176] CloseHandle (hObject=0x1c8) returned 1 [0057.177] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml" [0057.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0 [0057.177] lstrlenA (lpString="*.zip") returned 5 [0057.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0 [0057.177] lstrlenA (lpString="*.rar") returned 5 [0057.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0 [0057.177] lstrlenA (lpString="*.7z") returned 4 [0057.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0 [0057.177] lstrlenA (lpString="*.tar") returned 5 [0057.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gzip") returned 0 [0057.177] lstrlenA (lpString="*.gzip") returned 6 [0057.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0 [0057.177] lstrlenA (lpString="*.jpg") returned 5 [0057.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0 [0057.177] lstrlenA (lpString="*.jpeg") returned 6 [0057.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0 [0057.177] lstrlenA (lpString="*.psd") returned 5 [0057.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cdr") returned 0 [0057.177] lstrlenA (lpString="*.cdr") returned 5 [0057.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dwg") returned 0 [0057.177] lstrlenA (lpString="*.dwg") returned 5 [0057.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.max") returned 0 [0057.177] lstrlenA (lpString="*.max") returned 5 [0057.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.bmp") returned 0 [0057.178] lstrlenA (lpString="*.bmp") returned 5 [0057.178] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gif") returned 0 [0057.178] lstrlenA (lpString="*.gif") returned 5 [0057.178] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.png") returned 0 [0057.178] lstrlenA (lpString="*.png") returned 5 [0057.178] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0 [0057.178] lstrlenA (lpString="*.doc") returned 5 [0057.178] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0 [0057.178] lstrlenA (lpString="*.docx") returned 6 [0057.178] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0 [0057.178] lstrlenA (lpString="*.xls") returned 5 [0057.178] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0 [0057.178] lstrlenA (lpString="*.xlsx") returned 6 [0057.178] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0 [0057.178] lstrlenA (lpString="*.ppt") returned 5 [0057.178] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0 [0057.178] lstrlenA (lpString="*.pptx") returned 6 [0057.178] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.txt") returned 0 [0057.178] lstrlenA (lpString="*.txt") returned 5 [0057.179] lstrlenA (lpString="*.pdf") returned 5 [0057.179] lstrlenA (lpString="*.djvu") returned 6 [0057.179] lstrlenA (lpString="*.htm") returned 5 [0057.179] lstrlenA (lpString="*.html") returned 6 [0057.179] lstrlenA (lpString="*.mdb") returned 5 [0057.179] lstrlenA (lpString="*.cer") returned 5 [0057.179] lstrlenA (lpString="*.p12") returned 5 [0057.179] lstrlenA (lpString="*.pfx") returned 5 [0057.179] lstrlenA (lpString="*.kwm") returned 5 [0057.179] lstrlenA (lpString="*.pwm") returned 5 [0057.179] lstrlenA (lpString="*.1cd") returned 5 [0057.179] lstrlenA (lpString="*.md") returned 4 [0057.179] lstrlenA (lpString="*.mdf") returned 5 [0057.179] lstrlenA (lpString="*.dbf") returned 5 [0057.179] lstrlenA (lpString="*.odt") returned 5 [0057.179] lstrlenA (lpString="*.vob") returned 5 [0057.179] lstrlenA (lpString="*.ifo") returned 5 [0057.179] lstrlenA (lpString="*.lnk") returned 5 [0057.179] lstrlenA (lpString="*.torrent") returned 9 [0057.179] lstrlenA (lpString="*.mov") returned 5 [0057.179] lstrlenA (lpString="*.m2v") returned 5 [0057.179] lstrlenA (lpString="*.3gp") returned 5 [0057.180] lstrlenA (lpString="*.mpeg") returned 6 [0057.180] lstrlenA (lpString="*.mpg") returned 5 [0057.180] lstrlenA (lpString="*.flv") returned 5 [0057.180] lstrlenA (lpString="*.avi") returned 5 [0057.180] lstrlenA (lpString="*.mp4") returned 5 [0057.180] lstrlenA (lpString="*.wmv") returned 5 [0057.180] lstrlenA (lpString="*.divx") returned 6 [0057.180] lstrlenA (lpString="*.mkv") returned 5 [0057.180] lstrlenA (lpString="*.mp3") returned 5 [0057.180] lstrlenA (lpString="*.wav") returned 5 [0057.180] lstrlenA (lpString="*.flac") returned 6 [0057.180] lstrlenA (lpString="*.ape") returned 5 [0057.180] lstrlenA (lpString="*.wma") returned 5 [0057.180] lstrlenA (lpString="*.ac3") returned 5 [0057.180] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb3fb20, ftCreationTime.dwHighDateTime=0x1d0cbc0, ftLastAccessTime.dwLowDateTime=0xeb3fb20, ftLastAccessTime.dwHighDateTime=0x1d0cbc0, ftLastWriteTime.dwLowDateTime=0x3c858be0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x99cdf5, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0057.180] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.180] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WordLR.cab") returned -1 [0057.180] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WordLR.cab") returned -1 [0057.180] lstrcmpiA (lpString1="", lpString2="WordLR.cab") returned -1 [0057.180] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml") returned="Setup.xml" [0057.180] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\" [0057.180] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\") returned="" [0057.181] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.181] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.181] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\", lpString2="WordLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordLR.cab") returned="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordLR.cab" [0057.181] lstrlenA (lpString="*.zip") returned 5 [0057.181] lstrlenA (lpString="*.rar") returned 5 [0057.181] lstrlenA (lpString="*.7z") returned 4 [0057.181] lstrlenA (lpString="*.tar") returned 5 [0057.181] lstrlenA (lpString="*.gzip") returned 6 [0057.181] lstrlenA (lpString="*.jpg") returned 5 [0057.181] lstrlenA (lpString="*.jpeg") returned 6 [0057.181] lstrlenA (lpString="*.psd") returned 5 [0057.181] lstrlenA (lpString="*.cdr") returned 5 [0057.181] lstrlenA (lpString="*.dwg") returned 5 [0057.181] lstrlenA (lpString="*.max") returned 5 [0057.181] lstrlenA (lpString="*.bmp") returned 5 [0057.181] lstrlenA (lpString="*.gif") returned 5 [0057.181] lstrlenA (lpString="*.png") returned 5 [0057.181] lstrlenA (lpString="*.doc") returned 5 [0057.181] lstrlenA (lpString="*.docx") returned 6 [0057.182] lstrlenA (lpString="*.xls") returned 5 [0057.182] lstrlenA (lpString="*.xlsx") returned 6 [0057.182] lstrlenA (lpString="*.ppt") returned 5 [0057.182] lstrlenA (lpString="*.pptx") returned 6 [0057.182] lstrlenA (lpString="*.txt") returned 5 [0057.182] lstrlenA (lpString="*.pdf") returned 5 [0057.182] lstrlenA (lpString="*.djvu") returned 6 [0057.182] lstrlenA (lpString="*.htm") returned 5 [0057.182] lstrlenA (lpString="*.html") returned 6 [0057.182] lstrlenA (lpString="*.mdb") returned 5 [0057.182] lstrlenA (lpString="*.cer") returned 5 [0057.182] lstrlenA (lpString="*.p12") returned 5 [0057.182] lstrlenA (lpString="*.pfx") returned 5 [0057.182] lstrlenA (lpString="*.kwm") returned 5 [0057.182] lstrlenA (lpString="*.pwm") returned 5 [0057.182] lstrlenA (lpString="*.1cd") returned 5 [0057.182] lstrlenA (lpString="*.md") returned 4 [0057.182] lstrlenA (lpString="*.mdf") returned 5 [0057.182] lstrlenA (lpString="*.dbf") returned 5 [0057.182] lstrlenA (lpString="*.odt") returned 5 [0057.183] lstrlenA (lpString="*.vob") returned 5 [0057.183] lstrlenA (lpString="*.ifo") returned 5 [0057.183] lstrlenA (lpString="*.lnk") returned 5 [0057.183] lstrlenA (lpString="*.torrent") returned 9 [0057.183] lstrlenA (lpString="*.mov") returned 5 [0057.183] lstrlenA (lpString="*.m2v") returned 5 [0057.183] lstrlenA (lpString="*.3gp") returned 5 [0057.183] lstrlenA (lpString="*.mpeg") returned 6 [0057.183] lstrlenA (lpString="*.mpg") returned 5 [0057.183] lstrlenA (lpString="*.flv") returned 5 [0057.183] lstrlenA (lpString="*.avi") returned 5 [0057.183] lstrlenA (lpString="*.mp4") returned 5 [0057.183] lstrlenA (lpString="*.wmv") returned 5 [0057.183] lstrlenA (lpString="*.divx") returned 6 [0057.183] lstrlenA (lpString="*.mkv") returned 5 [0057.183] lstrlenA (lpString="*.mp3") returned 5 [0057.183] lstrlenA (lpString="*.wav") returned 5 [0057.183] lstrlenA (lpString="*.flac") returned 6 [0057.183] lstrlenA (lpString="*.ape") returned 5 [0057.183] lstrlenA (lpString="*.wma") returned 5 [0057.183] lstrlenA (lpString="*.ac3") returned 5 [0057.183] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc0e93c80, ftCreationTime.dwHighDateTime=0x1d0cbbe, ftLastAccessTime.dwLowDateTime=0xc0e93c80, ftLastAccessTime.dwHighDateTime=0x1d0cbbe, ftLastWriteTime.dwLowDateTime=0x3c8034b0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x24b000, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0057.184] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.184] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WordMUI.msi") returned -1 [0057.184] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WordMUI.msi") returned -1 [0057.184] lstrcmpiA (lpString1="", lpString2="WordMUI.msi") returned -1 [0057.184] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordLR.cab") returned="WordLR.cab" [0057.184] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\" [0057.184] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\") returned="" [0057.184] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.184] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.184] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\", lpString2="WordMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.msi") returned="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.msi" [0057.184] lstrlenA (lpString="*.zip") returned 5 [0057.184] lstrlenA (lpString="*.rar") returned 5 [0057.184] lstrlenA (lpString="*.7z") returned 4 [0057.184] lstrlenA (lpString="*.tar") returned 5 [0057.184] lstrlenA (lpString="*.gzip") returned 6 [0057.184] lstrlenA (lpString="*.jpg") returned 5 [0057.184] lstrlenA (lpString="*.jpeg") returned 6 [0057.184] lstrlenA (lpString="*.psd") returned 5 [0057.184] lstrlenA (lpString="*.cdr") returned 5 [0057.185] lstrlenA (lpString="*.dwg") returned 5 [0057.185] lstrlenA (lpString="*.max") returned 5 [0057.185] lstrlenA (lpString="*.bmp") returned 5 [0057.185] lstrlenA (lpString="*.gif") returned 5 [0057.185] lstrlenA (lpString="*.png") returned 5 [0057.185] lstrlenA (lpString="*.doc") returned 5 [0057.185] lstrlenA (lpString="*.docx") returned 6 [0057.185] lstrlenA (lpString="*.xls") returned 5 [0057.185] lstrlenA (lpString="*.xlsx") returned 6 [0057.185] lstrlenA (lpString="*.ppt") returned 5 [0057.185] lstrlenA (lpString="*.pptx") returned 6 [0057.185] lstrlenA (lpString="*.txt") returned 5 [0057.185] lstrlenA (lpString="*.pdf") returned 5 [0057.185] lstrlenA (lpString="*.djvu") returned 6 [0057.185] lstrlenA (lpString="*.htm") returned 5 [0057.185] lstrlenA (lpString="*.html") returned 6 [0057.185] lstrlenA (lpString="*.mdb") returned 5 [0057.185] lstrlenA (lpString="*.cer") returned 5 [0057.185] lstrlenA (lpString="*.p12") returned 5 [0057.185] lstrlenA (lpString="*.pfx") returned 5 [0057.185] lstrlenA (lpString="*.kwm") returned 5 [0057.186] lstrlenA (lpString="*.pwm") returned 5 [0057.186] lstrlenA (lpString="*.1cd") returned 5 [0057.186] lstrlenA (lpString="*.md") returned 4 [0057.186] lstrlenA (lpString="*.mdf") returned 5 [0057.186] lstrlenA (lpString="*.dbf") returned 5 [0057.186] lstrlenA (lpString="*.odt") returned 5 [0057.186] lstrlenA (lpString="*.vob") returned 5 [0057.186] lstrlenA (lpString="*.ifo") returned 5 [0057.186] lstrlenA (lpString="*.lnk") returned 5 [0057.186] lstrlenA (lpString="*.torrent") returned 9 [0057.186] lstrlenA (lpString="*.mov") returned 5 [0057.186] lstrlenA (lpString="*.m2v") returned 5 [0057.186] lstrlenA (lpString="*.3gp") returned 5 [0057.186] lstrlenA (lpString="*.mpeg") returned 6 [0057.186] lstrlenA (lpString="*.mpg") returned 5 [0057.186] lstrlenA (lpString="*.flv") returned 5 [0057.186] lstrlenA (lpString="*.avi") returned 5 [0057.186] lstrlenA (lpString="*.mp4") returned 5 [0057.186] lstrlenA (lpString="*.wmv") returned 5 [0057.186] lstrlenA (lpString="*.divx") returned 6 [0057.186] lstrlenA (lpString="*.mkv") returned 5 [0057.187] lstrlenA (lpString="*.mp3") returned 5 [0057.187] lstrlenA (lpString="*.wav") returned 5 [0057.187] lstrlenA (lpString="*.flac") returned 6 [0057.187] lstrlenA (lpString="*.ape") returned 5 [0057.187] lstrlenA (lpString="*.wma") returned 5 [0057.187] lstrlenA (lpString="*.ac3") returned 5 [0057.187] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c5504b0, ftCreationTime.dwHighDateTime=0x1d0cbb4, ftLastAccessTime.dwLowDateTime=0x1c5504b0, ftLastAccessTime.dwHighDateTime=0x1d0cbb4, ftLastWriteTime.dwLowDateTime=0x3c7eae10, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0057.187] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.187] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WordMUI.xml") returned -1 [0057.187] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WordMUI.xml") returned -1 [0057.187] lstrcmpiA (lpString1="", lpString2="WordMUI.xml") returned -1 [0057.187] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.msi") returned="WordMUI.msi" [0057.187] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\" [0057.187] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\") returned="" [0057.187] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.187] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.187] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\", lpString2="WordMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml") returned="C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml" [0057.187] lstrlenA (lpString="*.zip") returned 5 [0057.187] lstrlenA (lpString="*.rar") returned 5 [0057.187] lstrlenA (lpString="*.7z") returned 4 [0057.188] lstrlenA (lpString="*.tar") returned 5 [0057.188] lstrlenA (lpString="*.gzip") returned 6 [0057.188] lstrlenA (lpString="*.jpg") returned 5 [0057.188] lstrlenA (lpString="*.jpeg") returned 6 [0057.188] lstrlenA (lpString="*.psd") returned 5 [0057.188] lstrlenA (lpString="*.cdr") returned 5 [0057.188] lstrlenA (lpString="*.dwg") returned 5 [0057.188] lstrlenA (lpString="*.max") returned 5 [0057.188] lstrlenA (lpString="*.bmp") returned 5 [0057.188] lstrlenA (lpString="*.gif") returned 5 [0057.188] lstrlenA (lpString="*.png") returned 5 [0057.188] lstrlenA (lpString="*.doc") returned 5 [0057.188] lstrlenA (lpString="*.docx") returned 6 [0057.188] lstrlenA (lpString="*.xls") returned 5 [0057.188] lstrlenA (lpString="*.xlsx") returned 6 [0057.188] lstrlenA (lpString="*.ppt") returned 5 [0057.188] lstrlenA (lpString="*.pptx") returned 6 [0057.188] lstrlenA (lpString="*.txt") returned 5 [0057.188] lstrlenA (lpString="*.pdf") returned 5 [0057.188] lstrlenA (lpString="*.djvu") returned 6 [0057.188] lstrlenA (lpString="*.htm") returned 5 [0057.188] lstrlenA (lpString="*.html") returned 6 [0057.188] lstrlenA (lpString="*.mdb") returned 5 [0057.189] lstrlenA (lpString="*.cer") returned 5 [0057.189] lstrlenA (lpString="*.p12") returned 5 [0057.189] lstrlenA (lpString="*.pfx") returned 5 [0057.189] lstrlenA (lpString="*.kwm") returned 5 [0057.189] lstrlenA (lpString="*.pwm") returned 5 [0057.189] lstrlenA (lpString="*.1cd") returned 5 [0057.189] lstrlenA (lpString="*.md") returned 4 [0057.189] lstrlenA (lpString="*.mdf") returned 5 [0057.189] lstrlenA (lpString="*.dbf") returned 5 [0057.189] lstrlenA (lpString="*.odt") returned 5 [0057.189] lstrlenA (lpString="*.vob") returned 5 [0057.189] lstrlenA (lpString="*.ifo") returned 5 [0057.190] lstrlenA (lpString="*.lnk") returned 5 [0057.190] lstrlenA (lpString="*.torrent") returned 9 [0057.190] lstrlenA (lpString="*.mov") returned 5 [0057.190] lstrlenA (lpString="*.m2v") returned 5 [0057.190] lstrlenA (lpString="*.3gp") returned 5 [0057.190] lstrlenA (lpString="*.mpeg") returned 6 [0057.190] lstrlenA (lpString="*.mpg") returned 5 [0057.190] lstrlenA (lpString="*.flv") returned 5 [0057.190] lstrlenA (lpString="*.avi") returned 5 [0057.190] lstrlenA (lpString="*.mp4") returned 5 [0057.190] lstrlenA (lpString="*.wmv") returned 5 [0057.190] lstrlenA (lpString="*.divx") returned 6 [0057.190] lstrlenA (lpString="*.mkv") returned 5 [0057.190] lstrlenA (lpString="*.mp3") returned 5 [0057.190] lstrlenA (lpString="*.wav") returned 5 [0057.190] lstrlenA (lpString="*.flac") returned 6 [0057.190] lstrlenA (lpString="*.ape") returned 5 [0057.190] lstrlenA (lpString="*.wma") returned 5 [0057.190] lstrlenA (lpString="*.ac3") returned 5 [0057.190] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c5504b0, ftCreationTime.dwHighDateTime=0x1d0cbb4, ftLastAccessTime.dwLowDateTime=0x1c5504b0, ftLastAccessTime.dwHighDateTime=0x1d0cbb4, ftLastWriteTime.dwLowDateTime=0x3c7eae10, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0057.190] FindClose (in: hFindFile=0x6366f0 | out: hFindFile=0x6366f0) returned 1 [0057.191] FindNextFileA (in: hFindFile=0x636470, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3785d7ae, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x39a5db44, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x39a5db44, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="{90160000-002C-0409-0000-0000000FF1CE}-C", cAlternateFileName="{90160~3")) returned 1 [0057.191] lstrcmpA (lpString1=".", lpString2="{90160000-002C-0409-0000-0000000FF1CE}-C") returned -1 [0057.191] lstrcmpA (lpString1="..", lpString2="{90160000-002C-0409-0000-0000000FF1CE}-C") returned -1 [0057.191] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.191] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90160000-002C-0409-0000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C" [0057.191] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C") returned 62 [0057.191] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\*.*" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\*.*"), lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3785d7ae, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x39a5db44, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x39a5db44, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x636730 [0057.196] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.196] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3785d7ae, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x39a5db44, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x39a5db44, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="..", cAlternateFileName="")) returned 1 [0057.196] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.196] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.196] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x37883c64, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x378d01b5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x378d01b5, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0057.196] lstrcmpA (lpString1=".", lpString2="Proof.en") returned -1 [0057.196] lstrcmpA (lpString1="..", lpString2="Proof.en") returned -1 [0057.196] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.196] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\", lpString2="Proof.en" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en" [0057.196] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en") returned 71 [0057.196] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\*.*" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\*.*"), lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x37883c64, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x378d01b5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x378d01b5, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x640870, dwReserved1=0x640868, cFileName=".", cAlternateFileName="")) returned 0x636770 [0057.197] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.197] FindNextFileA (in: hFindFile=0x636770, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x37883c64, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x378d01b5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x378d01b5, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x640870, dwReserved1=0x640868, cFileName="..", cAlternateFileName="")) returned 1 [0057.198] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.198] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.198] FindNextFileA (in: hFindFile=0x636770, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c2c09d0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x1c2c09d0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x378cf6a0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0xb1e33f, dwReserved0=0x640870, dwReserved1=0x640868, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0057.198] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0057.198] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proof.cab") returned -1 [0057.198] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.cab") returned -1 [0057.198] lstrcmpiA (lpString1="", lpString2="Proof.cab") returned -1 [0057.198] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\*.*") returned="*.*" [0057.198] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\" [0057.198] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\") returned="" [0057.198] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt" [0057.198] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\how to decrypt files.txt")) returned 0xffffffff [0057.198] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0057.198] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.199] WriteFile (in: hFile=0x1cc, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.200] SetFileTime (hFile=0x1cc, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.200] CloseHandle (hObject=0x1cc) returned 1 [0057.200] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\", lpString2="Proof.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab" [0057.200] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.zip") returned 0 [0057.200] lstrlenA (lpString="*.zip") returned 5 [0057.200] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.rar") returned 0 [0057.200] lstrlenA (lpString="*.rar") returned 5 [0057.200] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.7z") returned 0 [0057.200] lstrlenA (lpString="*.7z") returned 4 [0057.200] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.tar") returned 0 [0057.200] lstrlenA (lpString="*.tar") returned 5 [0057.200] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.gzip") returned 0 [0057.201] lstrlenA (lpString="*.gzip") returned 6 [0057.201] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.jpg") returned 0 [0057.201] lstrlenA (lpString="*.jpg") returned 5 [0057.201] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.jpeg") returned 0 [0057.201] lstrlenA (lpString="*.jpeg") returned 6 [0057.201] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.psd") returned 0 [0057.201] lstrlenA (lpString="*.psd") returned 5 [0057.201] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.cdr") returned 0 [0057.201] lstrlenA (lpString="*.cdr") returned 5 [0057.201] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.dwg") returned 0 [0057.201] lstrlenA (lpString="*.dwg") returned 5 [0057.201] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.max") returned 0 [0057.201] lstrlenA (lpString="*.max") returned 5 [0057.201] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.bmp") returned 0 [0057.201] lstrlenA (lpString="*.bmp") returned 5 [0057.201] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.gif") returned 0 [0057.201] lstrlenA (lpString="*.gif") returned 5 [0057.201] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.png") returned 0 [0057.201] lstrlenA (lpString="*.png") returned 5 [0057.201] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.doc") returned 0 [0057.201] lstrlenA (lpString="*.doc") returned 5 [0057.201] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.docx") returned 0 [0057.201] lstrlenA (lpString="*.docx") returned 6 [0057.201] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.xls") returned 0 [0057.201] lstrlenA (lpString="*.xls") returned 5 [0057.201] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.xlsx") returned 0 [0057.202] lstrlenA (lpString="*.xlsx") returned 6 [0057.202] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.ppt") returned 0 [0057.202] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.pptx") returned 0 [0057.202] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.txt") returned 0 [0057.202] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.pdf") returned 0 [0057.202] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.djvu") returned 0 [0057.202] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.htm") returned 0 [0057.202] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.html") returned 0 [0057.202] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.mdb") returned 0 [0057.202] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.cer") returned 0 [0057.202] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.p12") returned 0 [0057.202] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.pfx") returned 0 [0057.202] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.kwm") returned 0 [0057.202] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.pwm") returned 0 [0057.202] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.1cd") returned 0 [0057.202] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.md") returned 0 [0057.202] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.mdf") returned 0 [0057.202] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.dbf") returned 0 [0057.202] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.odt") returned 0 [0057.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.vob") returned 0 [0057.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.ifo") returned 0 [0057.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.lnk") returned 0 [0057.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.torrent") returned 0 [0057.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.mov") returned 0 [0057.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.m2v") returned 0 [0057.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.3gp") returned 0 [0057.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.mpeg") returned 0 [0057.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.mpg") returned 0 [0057.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.flv") returned 0 [0057.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.avi") returned 0 [0057.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.mp4") returned 0 [0057.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.wmv") returned 0 [0057.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.divx") returned 0 [0057.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.mkv") returned 0 [0057.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.mp3") returned 0 [0057.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.wav") returned 0 [0057.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.flac") returned 0 [0057.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.ape") returned 0 [0057.204] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.wma") returned 0 [0057.204] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.ac3") returned 0 [0057.204] FindNextFileA (in: hFindFile=0x636770, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbacf58c0, ftCreationTime.dwHighDateTime=0x1d0cbbe, ftLastAccessTime.dwLowDateTime=0xbacf58c0, ftLastAccessTime.dwHighDateTime=0x1d0cbbe, ftLastWriteTime.dwLowDateTime=0x37883bb0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x201000, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0057.204] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0057.204] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proof.msi") returned -1 [0057.204] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.msi") returned -1 [0057.204] lstrcmpiA (lpString1="", lpString2="Proof.msi") returned -1 [0057.204] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned="Proof.cab" [0057.204] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\" [0057.204] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\") returned="" [0057.204] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt" [0057.204] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\how to decrypt files.txt")) returned 0x2020 [0057.204] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\", lpString2="Proof.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi" [0057.204] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.zip") returned 0 [0057.204] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.rar") returned 0 [0057.204] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.7z") returned 0 [0057.204] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.tar") returned 0 [0057.204] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.gzip") returned 0 [0057.204] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.jpg") returned 0 [0057.204] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.jpeg") returned 0 [0057.205] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.psd") returned 0 [0057.205] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.cdr") returned 0 [0057.205] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.dwg") returned 0 [0057.210] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.max") returned 0 [0057.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.bmp") returned 0 [0057.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.gif") returned 0 [0057.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.png") returned 0 [0057.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.doc") returned 0 [0057.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.docx") returned 0 [0057.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.xls") returned 0 [0057.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.xlsx") returned 0 [0057.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.ppt") returned 0 [0057.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.pptx") returned 0 [0057.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.txt") returned 0 [0057.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.pdf") returned 0 [0057.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.djvu") returned 0 [0057.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.htm") returned 0 [0057.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.html") returned 0 [0057.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.mdb") returned 0 [0057.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.cer") returned 0 [0057.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.p12") returned 0 [0057.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.pfx") returned 0 [0057.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.kwm") returned 0 [0057.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.pwm") returned 0 [0057.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.1cd") returned 0 [0057.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.md") returned 0 [0057.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.mdf") returned 0 [0057.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.dbf") returned 0 [0057.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.odt") returned 0 [0057.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.vob") returned 0 [0057.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.ifo") returned 0 [0057.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.lnk") returned 0 [0057.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.torrent") returned 0 [0057.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.mov") returned 0 [0057.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.m2v") returned 0 [0057.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.3gp") returned 0 [0057.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.mpeg") returned 0 [0057.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.mpg") returned 0 [0057.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.flv") returned 0 [0057.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.avi") returned 0 [0057.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.mp4") returned 0 [0057.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.wmv") returned 0 [0057.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.divx") returned 0 [0057.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.mkv") returned 0 [0057.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.mp3") returned 0 [0057.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.wav") returned 0 [0057.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.flac") returned 0 [0057.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.ape") returned 0 [0057.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.wma") returned 0 [0057.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.ac3") returned 0 [0057.213] FindNextFileA (in: hFindFile=0x636770, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf21b6da0, ftCreationTime.dwHighDateTime=0x1d0cbb4, ftLastAccessTime.dwLowDateTime=0xf21b6da0, ftLastAccessTime.dwHighDateTime=0x1d0cbb4, ftLastWriteTime.dwLowDateTime=0x37883bb0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x613, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0057.213] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0057.213] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proof.xml") returned -1 [0057.213] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.xml") returned -1 [0057.213] lstrcmpiA (lpString1="", lpString2="Proof.xml") returned -1 [0057.213] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned="Proof.msi" [0057.213] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\" [0057.213] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\") returned="" [0057.213] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt" [0057.213] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\how to decrypt files.txt")) returned 0x2020 [0057.214] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\", lpString2="Proof.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml" [0057.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.zip") returned 0 [0057.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.rar") returned 0 [0057.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.7z") returned 0 [0057.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.tar") returned 0 [0057.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.gzip") returned 0 [0057.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.jpg") returned 0 [0057.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.jpeg") returned 0 [0057.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.psd") returned 0 [0057.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.cdr") returned 0 [0057.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.dwg") returned 0 [0057.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.max") returned 0 [0057.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.bmp") returned 0 [0057.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.gif") returned 0 [0057.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.png") returned 0 [0057.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.doc") returned 0 [0057.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.docx") returned 0 [0057.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.xls") returned 0 [0057.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.xlsx") returned 0 [0057.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.ppt") returned 0 [0057.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.pptx") returned 0 [0057.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.txt") returned 0 [0057.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.pdf") returned 0 [0057.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.djvu") returned 0 [0057.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.htm") returned 0 [0057.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.html") returned 0 [0057.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.mdb") returned 0 [0057.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.cer") returned 0 [0057.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.p12") returned 0 [0057.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.pfx") returned 0 [0057.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.kwm") returned 0 [0057.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.pwm") returned 0 [0057.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.1cd") returned 0 [0057.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.md") returned 0 [0057.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.mdf") returned 0 [0057.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.dbf") returned 0 [0057.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.odt") returned 0 [0057.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.vob") returned 0 [0057.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.ifo") returned 0 [0057.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.lnk") returned 0 [0057.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.torrent") returned 0 [0057.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.mov") returned 0 [0057.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.m2v") returned 0 [0057.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.3gp") returned 0 [0057.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.mpeg") returned 0 [0057.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.mpg") returned 0 [0057.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.flv") returned 0 [0057.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.avi") returned 0 [0057.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.mp4") returned 0 [0057.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.wmv") returned 0 [0057.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.divx") returned 0 [0057.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.mkv") returned 0 [0057.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.mp3") returned 0 [0057.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.wav") returned 0 [0057.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.flac") returned 0 [0057.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.ape") returned 0 [0057.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.wma") returned 0 [0057.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.ac3") returned 0 [0057.216] FindNextFileA (in: hFindFile=0x636770, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf21b6da0, ftCreationTime.dwHighDateTime=0x1d0cbb4, ftLastAccessTime.dwLowDateTime=0xf21b6da0, ftLastAccessTime.dwHighDateTime=0x1d0cbb4, ftLastWriteTime.dwLowDateTime=0x37883bb0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x613, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0057.217] FindClose (in: hFindFile=0x636770 | out: hFindFile=0x636770) returned 1 [0057.217] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x38ee9095, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x38f352b8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x38f352b8, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0057.217] lstrcmpA (lpString1=".", lpString2="Proof.es") returned -1 [0057.217] lstrcmpA (lpString1="..", lpString2="Proof.es") returned -1 [0057.217] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.217] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\", lpString2="Proof.es" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es" [0057.217] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\*.*" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\*.*"), lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x38ee9095, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x38f352b8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x38f352b8, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x590052, dwReserved1=0x540050, cFileName=".", cAlternateFileName="")) returned 0x6364f0 [0057.217] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.217] FindNextFileA (in: hFindFile=0x6364f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x38ee9095, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x38f352b8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x38f352b8, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="..", cAlternateFileName="")) returned 1 [0057.217] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.217] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.217] FindNextFileA (in: hFindFile=0x6364f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x18e4a700, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x18e4a700, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x38f33d60, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0xd43dbd, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0057.218] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0057.218] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proof.cab") returned -1 [0057.218] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.cab") returned -1 [0057.218] lstrcmpiA (lpString1="", lpString2="Proof.cab") returned -1 [0057.218] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\*.*") returned="*.*" [0057.218] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\" [0057.218] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\") returned="" [0057.218] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt" [0057.218] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\how to decrypt files.txt")) returned 0xffffffff [0057.218] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0057.218] WriteFile (in: hFile=0x1cc, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.222] SetFileTime (hFile=0x1cc, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.223] CloseHandle (hObject=0x1cc) returned 1 [0057.223] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\", lpString2="Proof.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab" [0057.223] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.zip") returned 0 [0057.223] lstrlenA (lpString="*.zip") returned 5 [0057.223] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.rar") returned 0 [0057.223] lstrlenA (lpString="*.rar") returned 5 [0057.223] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.7z") returned 0 [0057.223] lstrlenA (lpString="*.7z") returned 4 [0057.223] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.tar") returned 0 [0057.223] lstrlenA (lpString="*.tar") returned 5 [0057.223] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.gzip") returned 0 [0057.223] lstrlenA (lpString="*.gzip") returned 6 [0057.223] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.jpg") returned 0 [0057.223] lstrlenA (lpString="*.jpg") returned 5 [0057.223] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.jpeg") returned 0 [0057.223] lstrlenA (lpString="*.jpeg") returned 6 [0057.223] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.psd") returned 0 [0057.224] lstrlenA (lpString="*.psd") returned 5 [0057.224] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.cdr") returned 0 [0057.224] lstrlenA (lpString="*.cdr") returned 5 [0057.224] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.dwg") returned 0 [0057.224] lstrlenA (lpString="*.dwg") returned 5 [0057.224] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.max") returned 0 [0057.224] lstrlenA (lpString="*.max") returned 5 [0057.224] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.bmp") returned 0 [0057.224] lstrlenA (lpString="*.bmp") returned 5 [0057.224] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.gif") returned 0 [0057.224] lstrlenA (lpString="*.gif") returned 5 [0057.224] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.png") returned 0 [0057.224] lstrlenA (lpString="*.png") returned 5 [0057.224] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.doc") returned 0 [0057.224] lstrlenA (lpString="*.doc") returned 5 [0057.224] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.docx") returned 0 [0057.224] lstrlenA (lpString="*.docx") returned 6 [0057.224] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.xls") returned 0 [0057.224] lstrlenA (lpString="*.xls") returned 5 [0057.224] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.xlsx") returned 0 [0057.224] lstrlenA (lpString="*.xlsx") returned 6 [0057.224] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.ppt") returned 0 [0057.224] lstrlenA (lpString="*.ppt") returned 5 [0057.224] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.pptx") returned 0 [0057.224] lstrlenA (lpString="*.pptx") returned 6 [0057.224] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.txt") returned 0 [0057.225] lstrlenA (lpString="*.txt") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.pdf") returned 0 [0057.225] lstrlenA (lpString="*.pdf") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.djvu") returned 0 [0057.225] lstrlenA (lpString="*.djvu") returned 6 [0057.225] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.htm") returned 0 [0057.225] lstrlenA (lpString="*.htm") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.html") returned 0 [0057.225] lstrlenA (lpString="*.html") returned 6 [0057.225] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.mdb") returned 0 [0057.225] lstrlenA (lpString="*.mdb") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.cer") returned 0 [0057.225] lstrlenA (lpString="*.cer") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.p12") returned 0 [0057.225] lstrlenA (lpString="*.p12") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.pfx") returned 0 [0057.225] lstrlenA (lpString="*.pfx") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.kwm") returned 0 [0057.225] lstrlenA (lpString="*.kwm") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.pwm") returned 0 [0057.225] lstrlenA (lpString="*.pwm") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.1cd") returned 0 [0057.225] lstrlenA (lpString="*.1cd") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.md") returned 0 [0057.225] lstrlenA (lpString="*.md") returned 4 [0057.225] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.mdf") returned 0 [0057.226] lstrlenA (lpString="*.mdf") returned 5 [0057.226] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.dbf") returned 0 [0057.226] lstrlenA (lpString="*.dbf") returned 5 [0057.226] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.odt") returned 0 [0057.226] lstrlenA (lpString="*.odt") returned 5 [0057.226] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.vob") returned 0 [0057.226] lstrlenA (lpString="*.vob") returned 5 [0057.226] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.ifo") returned 0 [0057.226] lstrlenA (lpString="*.ifo") returned 5 [0057.226] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.lnk") returned 0 [0057.226] lstrlenA (lpString="*.lnk") returned 5 [0057.226] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.torrent") returned 0 [0057.226] lstrlenA (lpString="*.torrent") returned 9 [0057.226] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.mov") returned 0 [0057.226] lstrlenA (lpString="*.mov") returned 5 [0057.226] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.m2v") returned 0 [0057.226] lstrlenA (lpString="*.m2v") returned 5 [0057.226] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.3gp") returned 0 [0057.226] lstrlenA (lpString="*.3gp") returned 5 [0057.226] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.mpeg") returned 0 [0057.226] lstrlenA (lpString="*.mpeg") returned 6 [0057.226] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.mpg") returned 0 [0057.226] lstrlenA (lpString="*.mpg") returned 5 [0057.226] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.flv") returned 0 [0057.226] lstrlenA (lpString="*.flv") returned 5 [0057.227] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.avi") returned 0 [0057.227] lstrlenA (lpString="*.avi") returned 5 [0057.227] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.mp4") returned 0 [0057.227] lstrlenA (lpString="*.mp4") returned 5 [0057.227] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.wmv") returned 0 [0057.227] lstrlenA (lpString="*.wmv") returned 5 [0057.227] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.divx") returned 0 [0057.227] lstrlenA (lpString="*.divx") returned 6 [0057.227] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.mkv") returned 0 [0057.227] lstrlenA (lpString="*.mkv") returned 5 [0057.227] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.mp3") returned 0 [0057.227] lstrlenA (lpString="*.mp3") returned 5 [0057.227] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.wav") returned 0 [0057.227] lstrlenA (lpString="*.wav") returned 5 [0057.227] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.flac") returned 0 [0057.227] lstrlenA (lpString="*.flac") returned 6 [0057.227] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.ape") returned 0 [0057.227] lstrlenA (lpString="*.ape") returned 5 [0057.227] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.wma") returned 0 [0057.227] lstrlenA (lpString="*.wma") returned 5 [0057.227] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.ac3") returned 0 [0057.227] lstrlenA (lpString="*.ac3") returned 5 [0057.227] FindNextFileA (in: hFindFile=0x6364f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc3553370, ftCreationTime.dwHighDateTime=0x1d0cbbe, ftLastAccessTime.dwLowDateTime=0xc3553370, ftLastAccessTime.dwHighDateTime=0x1d0cbbe, ftLastWriteTime.dwLowDateTime=0x38f0cc60, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x203000, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0057.227] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0057.227] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proof.msi") returned -1 [0057.228] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.msi") returned -1 [0057.228] lstrcmpiA (lpString1="", lpString2="Proof.msi") returned -1 [0057.228] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned="Proof.cab" [0057.228] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\" [0057.228] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\") returned="" [0057.228] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt" [0057.228] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\how to decrypt files.txt")) returned 0x2020 [0057.228] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\", lpString2="Proof.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi" [0057.228] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.zip") returned 0 [0057.228] lstrlenA (lpString="*.zip") returned 5 [0057.228] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.rar") returned 0 [0057.228] lstrlenA (lpString="*.rar") returned 5 [0057.228] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.7z") returned 0 [0057.228] lstrlenA (lpString="*.7z") returned 4 [0057.228] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.tar") returned 0 [0057.228] lstrlenA (lpString="*.tar") returned 5 [0057.228] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.gzip") returned 0 [0057.228] lstrlenA (lpString="*.gzip") returned 6 [0057.228] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.jpg") returned 0 [0057.228] lstrlenA (lpString="*.jpg") returned 5 [0057.228] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.jpeg") returned 0 [0057.228] lstrlenA (lpString="*.jpeg") returned 6 [0057.229] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.psd") returned 0 [0057.229] lstrlenA (lpString="*.psd") returned 5 [0057.229] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.cdr") returned 0 [0057.229] lstrlenA (lpString="*.cdr") returned 5 [0057.229] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.dwg") returned 0 [0057.229] lstrlenA (lpString="*.dwg") returned 5 [0057.229] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.max") returned 0 [0057.229] lstrlenA (lpString="*.max") returned 5 [0057.229] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.bmp") returned 0 [0057.229] lstrlenA (lpString="*.bmp") returned 5 [0057.229] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.gif") returned 0 [0057.229] lstrlenA (lpString="*.gif") returned 5 [0057.229] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.png") returned 0 [0057.229] lstrlenA (lpString="*.png") returned 5 [0057.229] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.doc") returned 0 [0057.229] lstrlenA (lpString="*.doc") returned 5 [0057.229] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.docx") returned 0 [0057.229] lstrlenA (lpString="*.docx") returned 6 [0057.229] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.xls") returned 0 [0057.229] lstrlenA (lpString="*.xls") returned 5 [0057.229] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.xlsx") returned 0 [0057.229] lstrlenA (lpString="*.xlsx") returned 6 [0057.229] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.ppt") returned 0 [0057.229] lstrlenA (lpString="*.ppt") returned 5 [0057.229] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.pptx") returned 0 [0057.230] lstrlenA (lpString="*.pptx") returned 6 [0057.230] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.txt") returned 0 [0057.230] lstrlenA (lpString="*.txt") returned 5 [0057.230] lstrlenA (lpString="*.pdf") returned 5 [0057.230] lstrlenA (lpString="*.djvu") returned 6 [0057.230] lstrlenA (lpString="*.htm") returned 5 [0057.230] lstrlenA (lpString="*.html") returned 6 [0057.230] lstrlenA (lpString="*.mdb") returned 5 [0057.230] lstrlenA (lpString="*.cer") returned 5 [0057.230] lstrlenA (lpString="*.p12") returned 5 [0057.230] lstrlenA (lpString="*.pfx") returned 5 [0057.230] lstrlenA (lpString="*.kwm") returned 5 [0057.230] lstrlenA (lpString="*.pwm") returned 5 [0057.230] lstrlenA (lpString="*.1cd") returned 5 [0057.230] lstrlenA (lpString="*.md") returned 4 [0057.230] lstrlenA (lpString="*.mdf") returned 5 [0057.231] lstrlenA (lpString="*.dbf") returned 5 [0057.231] lstrlenA (lpString="*.odt") returned 5 [0057.231] lstrlenA (lpString="*.vob") returned 5 [0057.231] lstrlenA (lpString="*.ifo") returned 5 [0057.231] lstrlenA (lpString="*.lnk") returned 5 [0057.231] lstrlenA (lpString="*.torrent") returned 9 [0057.231] lstrlenA (lpString="*.mov") returned 5 [0057.231] lstrlenA (lpString="*.m2v") returned 5 [0057.231] lstrlenA (lpString="*.3gp") returned 5 [0057.231] lstrlenA (lpString="*.mpeg") returned 6 [0057.231] lstrlenA (lpString="*.mpg") returned 5 [0057.231] lstrlenA (lpString="*.flv") returned 5 [0057.231] lstrlenA (lpString="*.avi") returned 5 [0057.231] lstrlenA (lpString="*.mp4") returned 5 [0057.231] lstrlenA (lpString="*.wmv") returned 5 [0057.231] lstrlenA (lpString="*.divx") returned 6 [0057.231] lstrlenA (lpString="*.mkv") returned 5 [0057.231] lstrlenA (lpString="*.mp3") returned 5 [0057.231] lstrlenA (lpString="*.wav") returned 5 [0057.231] lstrlenA (lpString="*.flac") returned 6 [0057.231] lstrlenA (lpString="*.ape") returned 5 [0057.232] lstrlenA (lpString="*.wma") returned 5 [0057.232] lstrlenA (lpString="*.ac3") returned 5 [0057.232] FindNextFileA (in: hFindFile=0x6364f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4320350, ftCreationTime.dwHighDateTime=0x1d0cbb5, ftLastAccessTime.dwLowDateTime=0x4320350, ftLastAccessTime.dwHighDateTime=0x1d0cbb5, ftLastWriteTime.dwLowDateTime=0x38ee8270, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x681, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0057.232] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0057.232] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proof.xml") returned -1 [0057.232] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.xml") returned -1 [0057.232] lstrcmpiA (lpString1="", lpString2="Proof.xml") returned -1 [0057.232] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned="Proof.msi" [0057.232] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\" [0057.232] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\") returned="" [0057.232] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt" [0057.232] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\how to decrypt files.txt")) returned 0x2020 [0057.232] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\", lpString2="Proof.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml" [0057.232] lstrlenA (lpString="*.zip") returned 5 [0057.232] lstrlenA (lpString="*.rar") returned 5 [0057.232] lstrlenA (lpString="*.7z") returned 4 [0057.232] lstrlenA (lpString="*.tar") returned 5 [0057.232] lstrlenA (lpString="*.gzip") returned 6 [0057.232] lstrlenA (lpString="*.jpg") returned 5 [0057.233] lstrlenA (lpString="*.jpeg") returned 6 [0057.233] lstrlenA (lpString="*.psd") returned 5 [0057.233] lstrlenA (lpString="*.cdr") returned 5 [0057.233] lstrlenA (lpString="*.dwg") returned 5 [0057.233] lstrlenA (lpString="*.max") returned 5 [0057.233] lstrlenA (lpString="*.bmp") returned 5 [0057.233] lstrlenA (lpString="*.gif") returned 5 [0057.233] lstrlenA (lpString="*.png") returned 5 [0057.233] lstrlenA (lpString="*.doc") returned 5 [0057.233] lstrlenA (lpString="*.docx") returned 6 [0057.233] lstrlenA (lpString="*.xls") returned 5 [0057.233] lstrlenA (lpString="*.xlsx") returned 6 [0057.233] lstrlenA (lpString="*.ppt") returned 5 [0057.233] lstrlenA (lpString="*.pptx") returned 6 [0057.233] lstrlenA (lpString="*.txt") returned 5 [0057.233] lstrlenA (lpString="*.pdf") returned 5 [0057.233] lstrlenA (lpString="*.djvu") returned 6 [0057.233] lstrlenA (lpString="*.htm") returned 5 [0057.233] lstrlenA (lpString="*.html") returned 6 [0057.233] lstrlenA (lpString="*.mdb") returned 5 [0057.234] lstrlenA (lpString="*.cer") returned 5 [0057.234] lstrlenA (lpString="*.p12") returned 5 [0057.234] lstrlenA (lpString="*.pfx") returned 5 [0057.234] lstrlenA (lpString="*.kwm") returned 5 [0057.234] lstrlenA (lpString="*.pwm") returned 5 [0057.234] lstrlenA (lpString="*.1cd") returned 5 [0057.234] lstrlenA (lpString="*.md") returned 4 [0057.234] lstrlenA (lpString="*.mdf") returned 5 [0057.234] lstrlenA (lpString="*.dbf") returned 5 [0057.234] lstrlenA (lpString="*.odt") returned 5 [0057.234] lstrlenA (lpString="*.vob") returned 5 [0057.234] lstrlenA (lpString="*.ifo") returned 5 [0057.234] lstrlenA (lpString="*.lnk") returned 5 [0057.234] lstrlenA (lpString="*.torrent") returned 9 [0057.234] lstrlenA (lpString="*.mov") returned 5 [0057.234] lstrlenA (lpString="*.m2v") returned 5 [0057.234] lstrlenA (lpString="*.3gp") returned 5 [0057.234] lstrlenA (lpString="*.mpeg") returned 6 [0057.234] lstrlenA (lpString="*.mpg") returned 5 [0057.234] lstrlenA (lpString="*.flv") returned 5 [0057.234] lstrlenA (lpString="*.avi") returned 5 [0057.235] lstrlenA (lpString="*.mp4") returned 5 [0057.235] lstrlenA (lpString="*.wmv") returned 5 [0057.235] lstrlenA (lpString="*.divx") returned 6 [0057.235] lstrlenA (lpString="*.mkv") returned 5 [0057.235] lstrlenA (lpString="*.mp3") returned 5 [0057.235] lstrlenA (lpString="*.wav") returned 5 [0057.235] lstrlenA (lpString="*.flac") returned 6 [0057.235] lstrlenA (lpString="*.ape") returned 5 [0057.235] lstrlenA (lpString="*.wma") returned 5 [0057.235] lstrlenA (lpString="*.ac3") returned 5 [0057.235] FindNextFileA (in: hFindFile=0x6364f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4320350, ftCreationTime.dwHighDateTime=0x1d0cbb5, ftLastAccessTime.dwLowDateTime=0x4320350, ftLastAccessTime.dwHighDateTime=0x1d0cbb5, ftLastWriteTime.dwLowDateTime=0x38ee8270, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x681, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0057.235] FindClose (in: hFindFile=0x6364f0 | out: hFindFile=0x6364f0) returned 1 [0057.235] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x38372840, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x383a8996, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x383a8996, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0057.235] lstrcmpA (lpString1=".", lpString2="Proof.fr") returned -1 [0057.235] lstrcmpA (lpString1="..", lpString2="Proof.fr") returned -1 [0057.235] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.235] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\", lpString2="Proof.fr" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr" [0057.235] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr") returned 71 [0057.235] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\*.*" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\*.*"), lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x38372840, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x383a8996, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x383a8996, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x590052, dwReserved1=0x540050, cFileName=".", cAlternateFileName="")) returned 0x636ab0 [0057.237] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.237] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x38372840, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x383a8996, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x383a8996, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="..", cAlternateFileName="")) returned 1 [0057.237] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.237] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.237] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c2727d0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x1c2727d0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x383a74b0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0xd36695, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0057.237] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0057.237] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proof.cab") returned -1 [0057.237] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.cab") returned -1 [0057.237] lstrcmpiA (lpString1="", lpString2="Proof.cab") returned -1 [0057.237] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\*.*") returned="*.*" [0057.237] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\" [0057.237] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\") returned="" [0057.237] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt" [0057.237] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\how to decrypt files.txt")) returned 0xffffffff [0057.237] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0057.238] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.238] WriteFile (in: hFile=0x1cc, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.239] SetFileTime (hFile=0x1cc, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.239] CloseHandle (hObject=0x1cc) returned 1 [0057.240] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\", lpString2="Proof.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" [0057.240] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.zip") returned 0 [0057.240] lstrlenA (lpString="*.zip") returned 5 [0057.240] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.rar") returned 0 [0057.240] lstrlenA (lpString="*.rar") returned 5 [0057.240] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.7z") returned 0 [0057.240] lstrlenA (lpString="*.7z") returned 4 [0057.240] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.tar") returned 0 [0057.240] lstrlenA (lpString="*.tar") returned 5 [0057.240] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.gzip") returned 0 [0057.240] lstrlenA (lpString="*.gzip") returned 6 [0057.240] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.jpg") returned 0 [0057.240] lstrlenA (lpString="*.jpg") returned 5 [0057.240] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.jpeg") returned 0 [0057.240] lstrlenA (lpString="*.jpeg") returned 6 [0057.240] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.psd") returned 0 [0057.240] lstrlenA (lpString="*.psd") returned 5 [0057.240] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.cdr") returned 0 [0057.240] lstrlenA (lpString="*.cdr") returned 5 [0057.240] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.dwg") returned 0 [0057.241] lstrlenA (lpString="*.dwg") returned 5 [0057.241] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.max") returned 0 [0057.241] lstrlenA (lpString="*.max") returned 5 [0057.241] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.bmp") returned 0 [0057.241] lstrlenA (lpString="*.bmp") returned 5 [0057.241] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.gif") returned 0 [0057.241] lstrlenA (lpString="*.gif") returned 5 [0057.241] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.png") returned 0 [0057.241] lstrlenA (lpString="*.png") returned 5 [0057.241] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.doc") returned 0 [0057.241] lstrlenA (lpString="*.doc") returned 5 [0057.241] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.docx") returned 0 [0057.241] lstrlenA (lpString="*.docx") returned 6 [0057.241] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.xls") returned 0 [0057.241] lstrlenA (lpString="*.xls") returned 5 [0057.241] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.xlsx") returned 0 [0057.241] lstrlenA (lpString="*.xlsx") returned 6 [0057.241] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.ppt") returned 0 [0057.241] lstrlenA (lpString="*.ppt") returned 5 [0057.241] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.pptx") returned 0 [0057.241] lstrlenA (lpString="*.pptx") returned 6 [0057.241] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.txt") returned 0 [0057.241] lstrlenA (lpString="*.txt") returned 5 [0057.241] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.pdf") returned 0 [0057.241] lstrlenA (lpString="*.pdf") returned 5 [0057.241] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.djvu") returned 0 [0057.241] lstrlenA (lpString="*.djvu") returned 6 [0057.242] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.htm") returned 0 [0057.242] lstrlenA (lpString="*.htm") returned 5 [0057.242] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.html") returned 0 [0057.242] lstrlenA (lpString="*.html") returned 6 [0057.242] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.mdb") returned 0 [0057.242] lstrlenA (lpString="*.mdb") returned 5 [0057.242] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.cer") returned 0 [0057.242] lstrlenA (lpString="*.cer") returned 5 [0057.242] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.p12") returned 0 [0057.242] lstrlenA (lpString="*.p12") returned 5 [0057.242] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.pfx") returned 0 [0057.242] lstrlenA (lpString="*.pfx") returned 5 [0057.242] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.kwm") returned 0 [0057.242] lstrlenA (lpString="*.kwm") returned 5 [0057.242] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.pwm") returned 0 [0057.242] lstrlenA (lpString="*.pwm") returned 5 [0057.242] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.1cd") returned 0 [0057.242] lstrlenA (lpString="*.1cd") returned 5 [0057.242] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.md") returned 0 [0057.242] lstrlenA (lpString="*.md") returned 4 [0057.242] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.mdf") returned 0 [0057.242] lstrlenA (lpString="*.mdf") returned 5 [0057.242] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.dbf") returned 0 [0057.242] lstrlenA (lpString="*.dbf") returned 5 [0057.242] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.odt") returned 0 [0057.243] lstrlenA (lpString="*.odt") returned 5 [0057.243] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.vob") returned 0 [0057.243] lstrlenA (lpString="*.vob") returned 5 [0057.243] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.ifo") returned 0 [0057.243] lstrlenA (lpString="*.ifo") returned 5 [0057.243] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.lnk") returned 0 [0057.243] lstrlenA (lpString="*.lnk") returned 5 [0057.243] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.torrent") returned 0 [0057.243] lstrlenA (lpString="*.torrent") returned 9 [0057.243] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.mov") returned 0 [0057.243] lstrlenA (lpString="*.mov") returned 5 [0057.243] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.m2v") returned 0 [0057.243] lstrlenA (lpString="*.m2v") returned 5 [0057.243] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.3gp") returned 0 [0057.243] lstrlenA (lpString="*.3gp") returned 5 [0057.243] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.mpeg") returned 0 [0057.243] lstrlenA (lpString="*.mpeg") returned 6 [0057.243] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.mpg") returned 0 [0057.243] lstrlenA (lpString="*.mpg") returned 5 [0057.243] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.flv") returned 0 [0057.243] lstrlenA (lpString="*.flv") returned 5 [0057.243] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.avi") returned 0 [0057.243] lstrlenA (lpString="*.avi") returned 5 [0057.243] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.mp4") returned 0 [0057.243] lstrlenA (lpString="*.mp4") returned 5 [0057.243] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.wmv") returned 0 [0057.243] lstrlenA (lpString="*.wmv") returned 5 [0057.244] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.divx") returned 0 [0057.244] lstrlenA (lpString="*.divx") returned 6 [0057.244] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.mkv") returned 0 [0057.244] lstrlenA (lpString="*.mkv") returned 5 [0057.244] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.mp3") returned 0 [0057.244] lstrlenA (lpString="*.mp3") returned 5 [0057.244] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.wav") returned 0 [0057.244] lstrlenA (lpString="*.wav") returned 5 [0057.244] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.flac") returned 0 [0057.244] lstrlenA (lpString="*.flac") returned 6 [0057.244] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.ape") returned 0 [0057.244] lstrlenA (lpString="*.ape") returned 5 [0057.244] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.wma") returned 0 [0057.244] lstrlenA (lpString="*.wma") returned 5 [0057.244] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.ac3") returned 0 [0057.244] lstrlenA (lpString="*.ac3") returned 5 [0057.244] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe24ec60, ftCreationTime.dwHighDateTime=0x1d0cbbe, ftLastAccessTime.dwLowDateTime=0xbe24ec60, ftLastAccessTime.dwHighDateTime=0x1d0cbbe, ftLastWriteTime.dwLowDateTime=0x38371950, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x203000, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0057.244] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0057.244] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proof.msi") returned -1 [0057.244] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.msi") returned -1 [0057.244] lstrcmpiA (lpString1="", lpString2="Proof.msi") returned -1 [0057.244] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned="Proof.cab" [0057.244] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\" [0057.244] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\") returned="" [0057.244] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt" [0057.245] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\how to decrypt files.txt")) returned 0x2020 [0057.245] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\", lpString2="Proof.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" [0057.245] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.zip") returned 0 [0057.245] lstrlenA (lpString="*.zip") returned 5 [0057.245] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.rar") returned 0 [0057.245] lstrlenA (lpString="*.rar") returned 5 [0057.245] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.7z") returned 0 [0057.245] lstrlenA (lpString="*.7z") returned 4 [0057.245] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.tar") returned 0 [0057.245] lstrlenA (lpString="*.tar") returned 5 [0057.245] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.gzip") returned 0 [0057.245] lstrlenA (lpString="*.gzip") returned 6 [0057.245] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.jpg") returned 0 [0057.245] lstrlenA (lpString="*.jpg") returned 5 [0057.245] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.jpeg") returned 0 [0057.245] lstrlenA (lpString="*.jpeg") returned 6 [0057.245] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.psd") returned 0 [0057.245] lstrlenA (lpString="*.psd") returned 5 [0057.245] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.cdr") returned 0 [0057.245] lstrlenA (lpString="*.cdr") returned 5 [0057.245] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.dwg") returned 0 [0057.245] lstrlenA (lpString="*.dwg") returned 5 [0057.246] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.max") returned 0 [0057.246] lstrlenA (lpString="*.max") returned 5 [0057.246] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.bmp") returned 0 [0057.246] lstrlenA (lpString="*.bmp") returned 5 [0057.246] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.gif") returned 0 [0057.246] lstrlenA (lpString="*.gif") returned 5 [0057.246] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.png") returned 0 [0057.246] lstrlenA (lpString="*.png") returned 5 [0057.246] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.doc") returned 0 [0057.246] lstrlenA (lpString="*.doc") returned 5 [0057.246] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.docx") returned 0 [0057.246] lstrlenA (lpString="*.docx") returned 6 [0057.246] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.xls") returned 0 [0057.246] lstrlenA (lpString="*.xls") returned 5 [0057.246] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.xlsx") returned 0 [0057.246] lstrlenA (lpString="*.xlsx") returned 6 [0057.246] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.ppt") returned 0 [0057.246] lstrlenA (lpString="*.ppt") returned 5 [0057.246] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.pptx") returned 0 [0057.246] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.txt") returned 0 [0057.246] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.pdf") returned 0 [0057.246] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.djvu") returned 0 [0057.246] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.htm") returned 0 [0057.246] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.html") returned 0 [0057.247] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.mdb") returned 0 [0057.247] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.cer") returned 0 [0057.247] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.p12") returned 0 [0057.247] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.pfx") returned 0 [0057.247] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.kwm") returned 0 [0057.247] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.pwm") returned 0 [0057.247] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.1cd") returned 0 [0057.247] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.md") returned 0 [0057.247] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.mdf") returned 0 [0057.247] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.dbf") returned 0 [0057.247] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.odt") returned 0 [0057.247] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.vob") returned 0 [0057.247] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.ifo") returned 0 [0057.247] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.lnk") returned 0 [0057.247] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.torrent") returned 0 [0057.247] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.mov") returned 0 [0057.247] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.m2v") returned 0 [0057.247] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.3gp") returned 0 [0057.248] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.mpeg") returned 0 [0057.248] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.mpg") returned 0 [0057.248] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.flv") returned 0 [0057.248] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.avi") returned 0 [0057.248] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.mp4") returned 0 [0057.248] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.wmv") returned 0 [0057.248] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.divx") returned 0 [0057.248] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.mkv") returned 0 [0057.248] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.mp3") returned 0 [0057.248] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.wav") returned 0 [0057.248] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.flac") returned 0 [0057.248] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.ape") returned 0 [0057.248] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.wma") returned 0 [0057.248] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.ac3") returned 0 [0057.248] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x578b420, ftCreationTime.dwHighDateTime=0x1d0cbb5, ftLastAccessTime.dwLowDateTime=0x578b420, ftLastAccessTime.dwHighDateTime=0x1d0cbb5, ftLastWriteTime.dwLowDateTime=0x38371950, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x681, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0057.248] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0057.248] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proof.xml") returned -1 [0057.248] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.xml") returned -1 [0057.248] lstrcmpiA (lpString1="", lpString2="Proof.xml") returned -1 [0057.248] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned="Proof.msi" [0057.248] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\" [0057.249] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\") returned="" [0057.249] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt" [0057.249] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\how to decrypt files.txt")) returned 0x2020 [0057.249] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\", lpString2="Proof.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" [0057.249] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.zip") returned 0 [0057.249] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.rar") returned 0 [0057.249] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.7z") returned 0 [0057.249] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.tar") returned 0 [0057.249] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.gzip") returned 0 [0057.249] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.jpg") returned 0 [0057.249] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.jpeg") returned 0 [0057.249] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.psd") returned 0 [0057.249] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.cdr") returned 0 [0057.249] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.dwg") returned 0 [0057.249] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.max") returned 0 [0057.249] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.bmp") returned 0 [0057.249] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.gif") returned 0 [0057.249] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.png") returned 0 [0057.250] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.doc") returned 0 [0057.250] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.docx") returned 0 [0057.250] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.xls") returned 0 [0057.250] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.xlsx") returned 0 [0057.250] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.ppt") returned 0 [0057.250] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.pptx") returned 0 [0057.250] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.txt") returned 0 [0057.250] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.pdf") returned 0 [0057.250] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.djvu") returned 0 [0057.250] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.htm") returned 0 [0057.250] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.html") returned 0 [0057.250] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.mdb") returned 0 [0057.250] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.cer") returned 0 [0057.250] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.p12") returned 0 [0057.250] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.pfx") returned 0 [0057.250] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.kwm") returned 0 [0057.250] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.pwm") returned 0 [0057.250] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.1cd") returned 0 [0057.250] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.md") returned 0 [0057.251] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.mdf") returned 0 [0057.251] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.dbf") returned 0 [0057.251] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.odt") returned 0 [0057.251] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.vob") returned 0 [0057.251] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.ifo") returned 0 [0057.251] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.lnk") returned 0 [0057.251] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.torrent") returned 0 [0057.251] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.mov") returned 0 [0057.251] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.m2v") returned 0 [0057.251] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.3gp") returned 0 [0057.251] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.mpeg") returned 0 [0057.251] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.mpg") returned 0 [0057.251] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.flv") returned 0 [0057.251] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.avi") returned 0 [0057.251] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.mp4") returned 0 [0057.251] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.wmv") returned 0 [0057.251] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.divx") returned 0 [0057.251] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.mkv") returned 0 [0057.251] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.mp3") returned 0 [0057.251] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.wav") returned 0 [0057.252] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.flac") returned 0 [0057.258] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.ape") returned 0 [0057.258] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.wma") returned 0 [0057.258] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.ac3") returned 0 [0057.258] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x578b420, ftCreationTime.dwHighDateTime=0x1d0cbb5, ftLastAccessTime.dwLowDateTime=0x578b420, ftLastAccessTime.dwHighDateTime=0x1d0cbb5, ftLastWriteTime.dwLowDateTime=0x38371950, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x681, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0057.258] FindClose (in: hFindFile=0x636ab0 | out: hFindFile=0x636ab0) returned 1 [0057.258] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a506c00, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x1a506c00, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x37883bb0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x103000, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0057.258] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.258] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proofing.msi") returned -1 [0057.258] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proofing.msi") returned -1 [0057.258] lstrcmpiA (lpString1="", lpString2="Proofing.msi") returned -1 [0057.258] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.258] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\" [0057.258] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\") returned="" [0057.258] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.258] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.259] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0057.259] WriteFile (in: hFile=0x1c8, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.260] SetFileTime (hFile=0x1c8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.260] CloseHandle (hObject=0x1c8) returned 1 [0057.261] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\", lpString2="Proofing.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi" [0057.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.zip") returned 0 [0057.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.rar") returned 0 [0057.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.7z") returned 0 [0057.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.tar") returned 0 [0057.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.gzip") returned 0 [0057.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.jpg") returned 0 [0057.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.jpeg") returned 0 [0057.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.psd") returned 0 [0057.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.cdr") returned 0 [0057.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.dwg") returned 0 [0057.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.max") returned 0 [0057.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.bmp") returned 0 [0057.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.gif") returned 0 [0057.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.png") returned 0 [0057.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.doc") returned 0 [0057.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.docx") returned 0 [0057.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.xls") returned 0 [0057.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.xlsx") returned 0 [0057.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.ppt") returned 0 [0057.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.pptx") returned 0 [0057.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.txt") returned 0 [0057.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.pdf") returned 0 [0057.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.djvu") returned 0 [0057.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.htm") returned 0 [0057.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.html") returned 0 [0057.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.mdb") returned 0 [0057.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.cer") returned 0 [0057.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.p12") returned 0 [0057.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.pfx") returned 0 [0057.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.kwm") returned 0 [0057.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.pwm") returned 0 [0057.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.1cd") returned 0 [0057.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.md") returned 0 [0057.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.mdf") returned 0 [0057.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.dbf") returned 0 [0057.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.odt") returned 0 [0057.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.vob") returned 0 [0057.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.ifo") returned 0 [0057.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.lnk") returned 0 [0057.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.torrent") returned 0 [0057.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.mov") returned 0 [0057.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.m2v") returned 0 [0057.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.3gp") returned 0 [0057.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.mpeg") returned 0 [0057.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.mpg") returned 0 [0057.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.flv") returned 0 [0057.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.avi") returned 0 [0057.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.mp4") returned 0 [0057.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.wmv") returned 0 [0057.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.divx") returned 0 [0057.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.mkv") returned 0 [0057.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.mp3") returned 0 [0057.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.wav") returned 0 [0057.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.flac") returned 0 [0057.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.ape") returned 0 [0057.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.wma") returned 0 [0057.264] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.ac3") returned 0 [0057.264] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66266080, ftCreationTime.dwHighDateTime=0x1d0cbb3, ftLastAccessTime.dwLowDateTime=0x66266080, ftLastAccessTime.dwHighDateTime=0x1d0cbb3, ftLastWriteTime.dwLowDateTime=0x3785cab0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0057.264] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.264] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proofing.xml") returned -1 [0057.264] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proofing.xml") returned -1 [0057.264] lstrcmpiA (lpString1="", lpString2="Proofing.xml") returned -1 [0057.264] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi") returned="Proofing.msi" [0057.264] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\" [0057.264] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\") returned="" [0057.264] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.264] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.264] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\", lpString2="Proofing.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml" [0057.264] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.zip") returned 0 [0057.264] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.rar") returned 0 [0057.264] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.7z") returned 0 [0057.264] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.tar") returned 0 [0057.264] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.gzip") returned 0 [0057.264] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.jpg") returned 0 [0057.264] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.jpeg") returned 0 [0057.264] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.psd") returned 0 [0057.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.cdr") returned 0 [0057.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.dwg") returned 0 [0057.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.max") returned 0 [0057.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.bmp") returned 0 [0057.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.gif") returned 0 [0057.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.png") returned 0 [0057.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.doc") returned 0 [0057.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.docx") returned 0 [0057.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.xls") returned 0 [0057.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.xlsx") returned 0 [0057.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.ppt") returned 0 [0057.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.pptx") returned 0 [0057.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.txt") returned 0 [0057.265] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42175690, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x42175690, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x39a5c480, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x17b3, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.265] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.266] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.266] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.266] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.266] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml") returned="Proofing.xml" [0057.266] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\" [0057.266] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\") returned="" [0057.266] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.266] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.266] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml" [0057.266] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42175690, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x42175690, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x39a5c480, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x17b3, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.266] FindClose (in: hFindFile=0x636730 | out: hFindFile=0x636730) returned 1 [0057.266] FindNextFileA (in: hFindFile=0x636470, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3b45d49b, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3b567558, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3b567558, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="{90160000-0044-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9E0A5~1")) returned 1 [0057.266] lstrcmpA (lpString1=".", lpString2="{90160000-0044-0409-0000-0000000FF1CE}-C") returned -1 [0057.266] lstrcmpA (lpString1="..", lpString2="{90160000-0044-0409-0000-0000000FF1CE}-C") returned -1 [0057.266] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.266] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90160000-0044-0409-0000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C" [0057.266] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\*.*" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\*.*"), lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3b45d49b, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3b567558, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3b567558, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x636ab0 [0057.269] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.269] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3b45d49b, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3b567558, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3b567558, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="..", cAlternateFileName="")) returned 1 [0057.269] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.269] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.269] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce2ab890, ftCreationTime.dwHighDateTime=0x1d0cbc0, ftLastAccessTime.dwLowDateTime=0xce2ab890, ftLastAccessTime.dwHighDateTime=0x1d0cbc0, ftLastWriteTime.dwLowDateTime=0x3b4f07b0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x3bafe2, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0057.269] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.269] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InfLR.cab") returned -1 [0057.269] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InfLR.cab") returned -1 [0057.269] lstrcmpiA (lpString1="", lpString2="InfLR.cab") returned -1 [0057.269] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.269] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\" [0057.269] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\") returned="" [0057.269] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.269] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.269] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0057.270] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.270] WriteFile (in: hFile=0x1c8, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.271] SetFileTime (hFile=0x1c8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.275] CloseHandle (hObject=0x1c8) returned 1 [0057.275] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\", lpString2="InfLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab") returned="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab" [0057.276] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.zip") returned 0 [0057.276] lstrlenA (lpString="*.zip") returned 5 [0057.276] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.rar") returned 0 [0057.276] lstrlenA (lpString="*.rar") returned 5 [0057.276] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.7z") returned 0 [0057.276] lstrlenA (lpString="*.7z") returned 4 [0057.276] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.tar") returned 0 [0057.276] lstrlenA (lpString="*.tar") returned 5 [0057.276] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.gzip") returned 0 [0057.276] lstrlenA (lpString="*.gzip") returned 6 [0057.276] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.jpg") returned 0 [0057.276] lstrlenA (lpString="*.jpg") returned 5 [0057.276] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.jpeg") returned 0 [0057.276] lstrlenA (lpString="*.jpeg") returned 6 [0057.276] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.psd") returned 0 [0057.276] lstrlenA (lpString="*.psd") returned 5 [0057.276] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.cdr") returned 0 [0057.276] lstrlenA (lpString="*.cdr") returned 5 [0057.276] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.dwg") returned 0 [0057.276] lstrlenA (lpString="*.dwg") returned 5 [0057.276] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.max") returned 0 [0057.276] lstrlenA (lpString="*.max") returned 5 [0057.276] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.bmp") returned 0 [0057.276] lstrlenA (lpString="*.bmp") returned 5 [0057.276] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.gif") returned 0 [0057.277] lstrlenA (lpString="*.gif") returned 5 [0057.277] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.png") returned 0 [0057.277] lstrlenA (lpString="*.png") returned 5 [0057.277] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.doc") returned 0 [0057.277] lstrlenA (lpString="*.doc") returned 5 [0057.277] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.docx") returned 0 [0057.277] lstrlenA (lpString="*.docx") returned 6 [0057.277] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.xls") returned 0 [0057.277] lstrlenA (lpString="*.xls") returned 5 [0057.277] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.xlsx") returned 0 [0057.277] lstrlenA (lpString="*.xlsx") returned 6 [0057.277] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.ppt") returned 0 [0057.277] lstrlenA (lpString="*.ppt") returned 5 [0057.277] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.pptx") returned 0 [0057.277] lstrlenA (lpString="*.pptx") returned 6 [0057.277] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.txt") returned 0 [0057.277] lstrlenA (lpString="*.txt") returned 5 [0057.277] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.pdf") returned 0 [0057.277] lstrlenA (lpString="*.pdf") returned 5 [0057.277] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.djvu") returned 0 [0057.277] lstrlenA (lpString="*.djvu") returned 6 [0057.277] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.htm") returned 0 [0057.277] lstrlenA (lpString="*.htm") returned 5 [0057.277] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.html") returned 0 [0057.277] lstrlenA (lpString="*.html") returned 6 [0057.277] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.mdb") returned 0 [0057.278] lstrlenA (lpString="*.mdb") returned 5 [0057.278] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.cer") returned 0 [0057.278] lstrlenA (lpString="*.cer") returned 5 [0057.278] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.p12") returned 0 [0057.278] lstrlenA (lpString="*.p12") returned 5 [0057.278] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.pfx") returned 0 [0057.278] lstrlenA (lpString="*.pfx") returned 5 [0057.278] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.kwm") returned 0 [0057.278] lstrlenA (lpString="*.kwm") returned 5 [0057.278] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.pwm") returned 0 [0057.278] lstrlenA (lpString="*.pwm") returned 5 [0057.278] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.1cd") returned 0 [0057.278] lstrlenA (lpString="*.1cd") returned 5 [0057.278] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.md") returned 0 [0057.278] lstrlenA (lpString="*.md") returned 4 [0057.278] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.mdf") returned 0 [0057.278] lstrlenA (lpString="*.mdf") returned 5 [0057.278] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.dbf") returned 0 [0057.278] lstrlenA (lpString="*.dbf") returned 5 [0057.278] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.odt") returned 0 [0057.278] lstrlenA (lpString="*.odt") returned 5 [0057.278] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.vob") returned 0 [0057.278] lstrlenA (lpString="*.vob") returned 5 [0057.278] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.ifo") returned 0 [0057.278] lstrlenA (lpString="*.ifo") returned 5 [0057.278] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.lnk") returned 0 [0057.278] lstrlenA (lpString="*.lnk") returned 5 [0057.279] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.torrent") returned 0 [0057.279] lstrlenA (lpString="*.torrent") returned 9 [0057.279] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.mov") returned 0 [0057.279] lstrlenA (lpString="*.mov") returned 5 [0057.279] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.m2v") returned 0 [0057.279] lstrlenA (lpString="*.m2v") returned 5 [0057.279] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.3gp") returned 0 [0057.279] lstrlenA (lpString="*.3gp") returned 5 [0057.279] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.mpeg") returned 0 [0057.279] lstrlenA (lpString="*.mpeg") returned 6 [0057.279] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.mpg") returned 0 [0057.279] lstrlenA (lpString="*.mpg") returned 5 [0057.279] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.flv") returned 0 [0057.279] lstrlenA (lpString="*.flv") returned 5 [0057.279] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.avi") returned 0 [0057.279] lstrlenA (lpString="*.avi") returned 5 [0057.279] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.mp4") returned 0 [0057.279] lstrlenA (lpString="*.mp4") returned 5 [0057.279] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.wmv") returned 0 [0057.279] lstrlenA (lpString="*.wmv") returned 5 [0057.279] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.divx") returned 0 [0057.279] lstrlenA (lpString="*.divx") returned 6 [0057.279] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.mkv") returned 0 [0057.279] lstrlenA (lpString="*.mkv") returned 5 [0057.279] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.mp3") returned 0 [0057.279] lstrlenA (lpString="*.mp3") returned 5 [0057.279] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.wav") returned 0 [0057.280] lstrlenA (lpString="*.wav") returned 5 [0057.280] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.flac") returned 0 [0057.280] lstrlenA (lpString="*.flac") returned 6 [0057.280] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.ape") returned 0 [0057.280] lstrlenA (lpString="*.ape") returned 5 [0057.280] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.wma") returned 0 [0057.280] lstrlenA (lpString="*.wma") returned 5 [0057.280] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.ac3") returned 0 [0057.280] lstrlenA (lpString="*.ac3") returned 5 [0057.280] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3d24d0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0xe3d24d0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x3b476690, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x246000, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0057.280] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.280] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InfoPathMUI.msi") returned -1 [0057.280] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InfoPathMUI.msi") returned -1 [0057.280] lstrcmpiA (lpString1="", lpString2="InfoPathMUI.msi") returned -1 [0057.280] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab") returned="InfLR.cab" [0057.280] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\" [0057.280] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\") returned="" [0057.280] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.280] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.280] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\", lpString2="InfoPathMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi") returned="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi" [0057.280] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.zip") returned 0 [0057.280] lstrlenA (lpString="*.zip") returned 5 [0057.281] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.rar") returned 0 [0057.281] lstrlenA (lpString="*.rar") returned 5 [0057.281] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.7z") returned 0 [0057.281] lstrlenA (lpString="*.7z") returned 4 [0057.281] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.tar") returned 0 [0057.281] lstrlenA (lpString="*.tar") returned 5 [0057.281] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.gzip") returned 0 [0057.281] lstrlenA (lpString="*.gzip") returned 6 [0057.281] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.jpg") returned 0 [0057.281] lstrlenA (lpString="*.jpg") returned 5 [0057.281] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.jpeg") returned 0 [0057.281] lstrlenA (lpString="*.jpeg") returned 6 [0057.281] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.psd") returned 0 [0057.281] lstrlenA (lpString="*.psd") returned 5 [0057.281] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.cdr") returned 0 [0057.281] lstrlenA (lpString="*.cdr") returned 5 [0057.281] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.dwg") returned 0 [0057.281] lstrlenA (lpString="*.dwg") returned 5 [0057.281] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.max") returned 0 [0057.281] lstrlenA (lpString="*.max") returned 5 [0057.281] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.bmp") returned 0 [0057.281] lstrlenA (lpString="*.bmp") returned 5 [0057.281] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.gif") returned 0 [0057.281] lstrlenA (lpString="*.gif") returned 5 [0057.281] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.png") returned 0 [0057.281] lstrlenA (lpString="*.png") returned 5 [0057.282] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.doc") returned 0 [0057.282] lstrlenA (lpString="*.doc") returned 5 [0057.282] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.docx") returned 0 [0057.282] lstrlenA (lpString="*.docx") returned 6 [0057.282] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.xls") returned 0 [0057.282] lstrlenA (lpString="*.xls") returned 5 [0057.282] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.xlsx") returned 0 [0057.282] lstrlenA (lpString="*.xlsx") returned 6 [0057.282] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.ppt") returned 0 [0057.282] lstrlenA (lpString="*.ppt") returned 5 [0057.282] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.pptx") returned 0 [0057.282] lstrlenA (lpString="*.pptx") returned 6 [0057.282] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.txt") returned 0 [0057.282] lstrlenA (lpString="*.txt") returned 5 [0057.282] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.pdf") returned 0 [0057.282] lstrlenA (lpString="*.pdf") returned 5 [0057.282] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.djvu") returned 0 [0057.282] lstrlenA (lpString="*.djvu") returned 6 [0057.282] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.htm") returned 0 [0057.282] lstrlenA (lpString="*.htm") returned 5 [0057.282] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.html") returned 0 [0057.282] lstrlenA (lpString="*.html") returned 6 [0057.282] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.mdb") returned 0 [0057.282] lstrlenA (lpString="*.mdb") returned 5 [0057.282] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.cer") returned 0 [0057.282] lstrlenA (lpString="*.cer") returned 5 [0057.282] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.p12") returned 0 [0057.283] lstrlenA (lpString="*.p12") returned 5 [0057.283] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.pfx") returned 0 [0057.283] lstrlenA (lpString="*.pfx") returned 5 [0057.283] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.kwm") returned 0 [0057.283] lstrlenA (lpString="*.kwm") returned 5 [0057.283] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.pwm") returned 0 [0057.283] lstrlenA (lpString="*.pwm") returned 5 [0057.283] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.1cd") returned 0 [0057.283] lstrlenA (lpString="*.1cd") returned 5 [0057.283] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.md") returned 0 [0057.283] lstrlenA (lpString="*.md") returned 4 [0057.283] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.mdf") returned 0 [0057.283] lstrlenA (lpString="*.mdf") returned 5 [0057.283] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.dbf") returned 0 [0057.283] lstrlenA (lpString="*.dbf") returned 5 [0057.283] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.odt") returned 0 [0057.283] lstrlenA (lpString="*.odt") returned 5 [0057.283] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.vob") returned 0 [0057.283] lstrlenA (lpString="*.vob") returned 5 [0057.283] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.ifo") returned 0 [0057.283] lstrlenA (lpString="*.ifo") returned 5 [0057.283] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.lnk") returned 0 [0057.284] lstrlenA (lpString="*.lnk") returned 5 [0057.284] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.torrent") returned 0 [0057.284] lstrlenA (lpString="*.torrent") returned 9 [0057.284] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.mov") returned 0 [0057.284] lstrlenA (lpString="*.mov") returned 5 [0057.284] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.m2v") returned 0 [0057.284] lstrlenA (lpString="*.m2v") returned 5 [0057.284] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.3gp") returned 0 [0057.284] lstrlenA (lpString="*.3gp") returned 5 [0057.284] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.mpeg") returned 0 [0057.284] lstrlenA (lpString="*.mpeg") returned 6 [0057.284] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.mpg") returned 0 [0057.284] lstrlenA (lpString="*.mpg") returned 5 [0057.284] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.flv") returned 0 [0057.284] lstrlenA (lpString="*.flv") returned 5 [0057.284] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.avi") returned 0 [0057.284] lstrlenA (lpString="*.avi") returned 5 [0057.284] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.mp4") returned 0 [0057.284] lstrlenA (lpString="*.mp4") returned 5 [0057.284] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.wmv") returned 0 [0057.284] lstrlenA (lpString="*.wmv") returned 5 [0057.284] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.divx") returned 0 [0057.284] lstrlenA (lpString="*.divx") returned 6 [0057.284] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.mkv") returned 0 [0057.284] lstrlenA (lpString="*.mkv") returned 5 [0057.284] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.mp3") returned 0 [0057.284] lstrlenA (lpString="*.mp3") returned 5 [0057.285] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.wav") returned 0 [0057.285] lstrlenA (lpString="*.wav") returned 5 [0057.285] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.flac") returned 0 [0057.285] lstrlenA (lpString="*.flac") returned 6 [0057.285] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.ape") returned 0 [0057.285] lstrlenA (lpString="*.ape") returned 5 [0057.285] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.wma") returned 0 [0057.285] lstrlenA (lpString="*.wma") returned 5 [0057.285] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.ac3") returned 0 [0057.285] lstrlenA (lpString="*.ac3") returned 5 [0057.285] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x24c51f60, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0x24c51f60, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0x3b45dff0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x4ce, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0057.285] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.285] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InfoPathMUI.xml") returned -1 [0057.285] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InfoPathMUI.xml") returned -1 [0057.285] lstrcmpiA (lpString1="", lpString2="InfoPathMUI.xml") returned -1 [0057.285] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.msi") returned="InfoPathMUI.msi" [0057.285] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\" [0057.285] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\") returned="" [0057.285] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.285] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.285] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\", lpString2="InfoPathMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml") returned="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml" [0057.285] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.zip") returned 0 [0057.286] lstrlenA (lpString="*.zip") returned 5 [0057.286] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.rar") returned 0 [0057.286] lstrlenA (lpString="*.rar") returned 5 [0057.286] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.7z") returned 0 [0057.286] lstrlenA (lpString="*.7z") returned 4 [0057.286] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.tar") returned 0 [0057.286] lstrlenA (lpString="*.tar") returned 5 [0057.286] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.gzip") returned 0 [0057.286] lstrlenA (lpString="*.gzip") returned 6 [0057.286] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.jpg") returned 0 [0057.286] lstrlenA (lpString="*.jpg") returned 5 [0057.286] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.jpeg") returned 0 [0057.286] lstrlenA (lpString="*.jpeg") returned 6 [0057.286] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.psd") returned 0 [0057.286] lstrlenA (lpString="*.psd") returned 5 [0057.286] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.cdr") returned 0 [0057.286] lstrlenA (lpString="*.cdr") returned 5 [0057.286] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.dwg") returned 0 [0057.286] lstrlenA (lpString="*.dwg") returned 5 [0057.286] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.max") returned 0 [0057.286] lstrlenA (lpString="*.max") returned 5 [0057.286] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.bmp") returned 0 [0057.286] lstrlenA (lpString="*.bmp") returned 5 [0057.286] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.gif") returned 0 [0057.286] lstrlenA (lpString="*.gif") returned 5 [0057.286] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.png") returned 0 [0057.286] lstrlenA (lpString="*.png") returned 5 [0057.287] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.doc") returned 0 [0057.287] lstrlenA (lpString="*.doc") returned 5 [0057.287] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.docx") returned 0 [0057.287] lstrlenA (lpString="*.docx") returned 6 [0057.287] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.xls") returned 0 [0057.287] lstrlenA (lpString="*.xls") returned 5 [0057.287] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.xlsx") returned 0 [0057.287] lstrlenA (lpString="*.xlsx") returned 6 [0057.287] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.ppt") returned 0 [0057.287] lstrlenA (lpString="*.ppt") returned 5 [0057.287] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.pptx") returned 0 [0057.287] lstrlenA (lpString="*.pptx") returned 6 [0057.287] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.txt") returned 0 [0057.287] lstrlenA (lpString="*.txt") returned 5 [0057.287] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.pdf") returned 0 [0057.287] lstrlenA (lpString="*.pdf") returned 5 [0057.287] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.djvu") returned 0 [0057.287] lstrlenA (lpString="*.djvu") returned 6 [0057.287] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.htm") returned 0 [0057.287] lstrlenA (lpString="*.htm") returned 5 [0057.287] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.html") returned 0 [0057.287] lstrlenA (lpString="*.html") returned 6 [0057.287] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.mdb") returned 0 [0057.287] lstrlenA (lpString="*.mdb") returned 5 [0057.287] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.cer") returned 0 [0057.287] lstrlenA (lpString="*.cer") returned 5 [0057.287] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.p12") returned 0 [0057.288] lstrlenA (lpString="*.p12") returned 5 [0057.288] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.pfx") returned 0 [0057.288] lstrlenA (lpString="*.pfx") returned 5 [0057.288] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.kwm") returned 0 [0057.288] lstrlenA (lpString="*.kwm") returned 5 [0057.288] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.pwm") returned 0 [0057.288] lstrlenA (lpString="*.pwm") returned 5 [0057.288] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.1cd") returned 0 [0057.288] lstrlenA (lpString="*.1cd") returned 5 [0057.288] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.md") returned 0 [0057.288] lstrlenA (lpString="*.md") returned 4 [0057.288] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.mdf") returned 0 [0057.288] lstrlenA (lpString="*.mdf") returned 5 [0057.288] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.dbf") returned 0 [0057.288] lstrlenA (lpString="*.dbf") returned 5 [0057.288] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.odt") returned 0 [0057.288] lstrlenA (lpString="*.odt") returned 5 [0057.288] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.vob") returned 0 [0057.288] lstrlenA (lpString="*.vob") returned 5 [0057.288] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.ifo") returned 0 [0057.288] lstrlenA (lpString="*.ifo") returned 5 [0057.288] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.lnk") returned 0 [0057.288] lstrlenA (lpString="*.lnk") returned 5 [0057.288] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.torrent") returned 0 [0057.288] lstrlenA (lpString="*.torrent") returned 9 [0057.288] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.mov") returned 0 [0057.289] lstrlenA (lpString="*.mov") returned 5 [0057.289] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.m2v") returned 0 [0057.289] lstrlenA (lpString="*.m2v") returned 5 [0057.289] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.3gp") returned 0 [0057.289] lstrlenA (lpString="*.3gp") returned 5 [0057.289] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.mpeg") returned 0 [0057.289] lstrlenA (lpString="*.mpeg") returned 6 [0057.289] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.mpg") returned 0 [0057.289] lstrlenA (lpString="*.mpg") returned 5 [0057.289] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.flv") returned 0 [0057.289] lstrlenA (lpString="*.flv") returned 5 [0057.289] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.avi") returned 0 [0057.289] lstrlenA (lpString="*.avi") returned 5 [0057.289] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.mp4") returned 0 [0057.289] lstrlenA (lpString="*.mp4") returned 5 [0057.289] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.wmv") returned 0 [0057.289] lstrlenA (lpString="*.wmv") returned 5 [0057.289] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.divx") returned 0 [0057.289] lstrlenA (lpString="*.divx") returned 6 [0057.289] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.mkv") returned 0 [0057.289] lstrlenA (lpString="*.mkv") returned 5 [0057.289] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.mp3") returned 0 [0057.289] lstrlenA (lpString="*.mp3") returned 5 [0057.289] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.wav") returned 0 [0057.289] lstrlenA (lpString="*.wav") returned 5 [0057.289] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.flac") returned 0 [0057.289] lstrlenA (lpString="*.flac") returned 6 [0057.289] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.ape") returned 0 [0057.290] lstrlenA (lpString="*.ape") returned 5 [0057.290] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.wma") returned 0 [0057.290] lstrlenA (lpString="*.wma") returned 5 [0057.290] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.ac3") returned 0 [0057.290] lstrlenA (lpString="*.ac3") returned 5 [0057.290] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41b31680, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41b31680, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3b5681c0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x703, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.290] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.290] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.290] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.290] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.290] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml") returned="InfoPathMUI.xml" [0057.290] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\" [0057.290] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\") returned="" [0057.290] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.290] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.290] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml" [0057.290] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0 [0057.290] lstrlenA (lpString="*.zip") returned 5 [0057.290] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0 [0057.290] lstrlenA (lpString="*.rar") returned 5 [0057.290] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0 [0057.290] lstrlenA (lpString="*.7z") returned 4 [0057.290] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0 [0057.290] lstrlenA (lpString="*.tar") returned 5 [0057.291] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gzip") returned 0 [0057.291] lstrlenA (lpString="*.gzip") returned 6 [0057.291] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0 [0057.291] lstrlenA (lpString="*.jpg") returned 5 [0057.291] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0 [0057.291] lstrlenA (lpString="*.jpeg") returned 6 [0057.291] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0 [0057.291] lstrlenA (lpString="*.psd") returned 5 [0057.291] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cdr") returned 0 [0057.291] lstrlenA (lpString="*.cdr") returned 5 [0057.291] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dwg") returned 0 [0057.291] lstrlenA (lpString="*.dwg") returned 5 [0057.291] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.max") returned 0 [0057.291] lstrlenA (lpString="*.max") returned 5 [0057.291] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.bmp") returned 0 [0057.291] lstrlenA (lpString="*.bmp") returned 5 [0057.291] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gif") returned 0 [0057.291] lstrlenA (lpString="*.gif") returned 5 [0057.291] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.png") returned 0 [0057.291] lstrlenA (lpString="*.png") returned 5 [0057.291] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0 [0057.291] lstrlenA (lpString="*.doc") returned 5 [0057.291] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0 [0057.291] lstrlenA (lpString="*.docx") returned 6 [0057.291] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0 [0057.291] lstrlenA (lpString="*.xls") returned 5 [0057.291] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0 [0057.291] lstrlenA (lpString="*.xlsx") returned 6 [0057.292] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0 [0057.292] lstrlenA (lpString="*.ppt") returned 5 [0057.292] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0 [0057.292] lstrlenA (lpString="*.pptx") returned 6 [0057.292] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.txt") returned 0 [0057.292] lstrlenA (lpString="*.txt") returned 5 [0057.292] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pdf") returned 0 [0057.292] lstrlenA (lpString="*.pdf") returned 5 [0057.292] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.djvu") returned 0 [0057.292] lstrlenA (lpString="*.djvu") returned 6 [0057.292] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.htm") returned 0 [0057.292] lstrlenA (lpString="*.htm") returned 5 [0057.292] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.html") returned 0 [0057.292] lstrlenA (lpString="*.html") returned 6 [0057.292] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mdb") returned 0 [0057.292] lstrlenA (lpString="*.mdb") returned 5 [0057.292] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cer") returned 0 [0057.292] lstrlenA (lpString="*.cer") returned 5 [0057.292] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.p12") returned 0 [0057.292] lstrlenA (lpString="*.p12") returned 5 [0057.292] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pfx") returned 0 [0057.292] lstrlenA (lpString="*.pfx") returned 5 [0057.292] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.kwm") returned 0 [0057.292] lstrlenA (lpString="*.kwm") returned 5 [0057.292] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pwm") returned 0 [0057.292] lstrlenA (lpString="*.pwm") returned 5 [0057.292] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.1cd") returned 0 [0057.292] lstrlenA (lpString="*.1cd") returned 5 [0057.293] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.md") returned 0 [0057.293] lstrlenA (lpString="*.md") returned 4 [0057.293] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mdf") returned 0 [0057.293] lstrlenA (lpString="*.mdf") returned 5 [0057.293] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dbf") returned 0 [0057.293] lstrlenA (lpString="*.dbf") returned 5 [0057.293] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.odt") returned 0 [0057.293] lstrlenA (lpString="*.odt") returned 5 [0057.293] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.vob") returned 0 [0057.293] lstrlenA (lpString="*.vob") returned 5 [0057.293] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ifo") returned 0 [0057.293] lstrlenA (lpString="*.ifo") returned 5 [0057.293] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.lnk") returned 0 [0057.293] lstrlenA (lpString="*.lnk") returned 5 [0057.293] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.torrent") returned 0 [0057.293] lstrlenA (lpString="*.torrent") returned 9 [0057.293] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mov") returned 0 [0057.293] lstrlenA (lpString="*.mov") returned 5 [0057.293] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.m2v") returned 0 [0057.293] lstrlenA (lpString="*.m2v") returned 5 [0057.293] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.3gp") returned 0 [0057.293] lstrlenA (lpString="*.3gp") returned 5 [0057.293] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpeg") returned 0 [0057.293] lstrlenA (lpString="*.mpeg") returned 6 [0057.293] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpg") returned 0 [0057.293] lstrlenA (lpString="*.mpg") returned 5 [0057.293] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flv") returned 0 [0057.294] lstrlenA (lpString="*.flv") returned 5 [0057.294] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.avi") returned 0 [0057.294] lstrlenA (lpString="*.avi") returned 5 [0057.294] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp4") returned 0 [0057.294] lstrlenA (lpString="*.mp4") returned 5 [0057.294] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wmv") returned 0 [0057.294] lstrlenA (lpString="*.wmv") returned 5 [0057.294] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.divx") returned 0 [0057.294] lstrlenA (lpString="*.divx") returned 6 [0057.294] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mkv") returned 0 [0057.294] lstrlenA (lpString="*.mkv") returned 5 [0057.294] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp3") returned 0 [0057.294] lstrlenA (lpString="*.mp3") returned 5 [0057.294] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wav") returned 0 [0057.294] lstrlenA (lpString="*.wav") returned 5 [0057.294] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flac") returned 0 [0057.294] lstrlenA (lpString="*.flac") returned 6 [0057.294] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ape") returned 0 [0057.294] lstrlenA (lpString="*.ape") returned 5 [0057.294] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wma") returned 0 [0057.294] lstrlenA (lpString="*.wma") returned 5 [0057.294] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ac3") returned 0 [0057.294] lstrlenA (lpString="*.ac3") returned 5 [0057.294] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41b31680, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41b31680, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3b5681c0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x703, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.294] FindClose (in: hFindFile=0x636ab0 | out: hFindFile=0x636ab0) returned 1 [0057.295] FindNextFileA (in: hFindFile=0x636470, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3abd4582, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3abfab95, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3abfab95, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="{90160000-0090-0409-0000-0000000FF1CE}-C", cAlternateFileName="{935E4~1")) returned 1 [0057.295] lstrcmpA (lpString1=".", lpString2="{90160000-0090-0409-0000-0000000FF1CE}-C") returned -1 [0057.295] lstrcmpA (lpString1="..", lpString2="{90160000-0090-0409-0000-0000000FF1CE}-C") returned -1 [0057.295] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.295] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90160000-0090-0409-0000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C" [0057.295] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C") returned 62 [0057.295] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\*.*" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\*.*"), lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3abd4582, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3abfab95, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3abfab95, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x636430 [0057.300] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.300] FindNextFileA (in: hFindFile=0x636430, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3abd4582, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3abfab95, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3abfab95, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="..", cAlternateFileName="")) returned 1 [0057.300] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.300] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.300] FindNextFileA (in: hFindFile=0x636430, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb87a4fc0, ftCreationTime.dwHighDateTime=0x1d0cbbf, ftLastAccessTime.dwLowDateTime=0xb87a4fc0, ftLastAccessTime.dwHighDateTime=0x1d0cbbf, ftLastWriteTime.dwLowDateTime=0x3abd27f0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x9ca36, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="DCFMUI.cab", cAlternateFileName="")) returned 1 [0057.300] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.300] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DCFMUI.cab") returned 1 [0057.300] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DCFMUI.cab") returned 1 [0057.300] lstrcmpiA (lpString1="", lpString2="DCFMUI.cab") returned -1 [0057.300] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.300] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\" [0057.300] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\") returned="" [0057.301] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.301] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.301] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0057.303] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.303] WriteFile (in: hFile=0x1c8, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.304] SetFileTime (hFile=0x1c8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.304] CloseHandle (hObject=0x1c8) returned 1 [0057.305] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\", lpString2="DCFMUI.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab") returned="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab" [0057.305] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.zip") returned 0 [0057.305] lstrlenA (lpString="*.zip") returned 5 [0057.305] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.rar") returned 0 [0057.305] lstrlenA (lpString="*.rar") returned 5 [0057.305] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.7z") returned 0 [0057.305] lstrlenA (lpString="*.7z") returned 4 [0057.305] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.tar") returned 0 [0057.305] lstrlenA (lpString="*.tar") returned 5 [0057.305] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.gzip") returned 0 [0057.305] lstrlenA (lpString="*.gzip") returned 6 [0057.305] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.jpg") returned 0 [0057.305] lstrlenA (lpString="*.jpg") returned 5 [0057.305] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.jpeg") returned 0 [0057.305] lstrlenA (lpString="*.jpeg") returned 6 [0057.305] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.psd") returned 0 [0057.305] lstrlenA (lpString="*.psd") returned 5 [0057.305] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.cdr") returned 0 [0057.305] lstrlenA (lpString="*.cdr") returned 5 [0057.305] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.dwg") returned 0 [0057.305] lstrlenA (lpString="*.dwg") returned 5 [0057.305] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.max") returned 0 [0057.305] lstrlenA (lpString="*.max") returned 5 [0057.305] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.bmp") returned 0 [0057.305] lstrlenA (lpString="*.bmp") returned 5 [0057.306] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.gif") returned 0 [0057.306] lstrlenA (lpString="*.gif") returned 5 [0057.306] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.png") returned 0 [0057.306] lstrlenA (lpString="*.png") returned 5 [0057.306] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.doc") returned 0 [0057.306] lstrlenA (lpString="*.doc") returned 5 [0057.306] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.docx") returned 0 [0057.306] lstrlenA (lpString="*.docx") returned 6 [0057.306] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.xls") returned 0 [0057.306] lstrlenA (lpString="*.xls") returned 5 [0057.306] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.xlsx") returned 0 [0057.306] lstrlenA (lpString="*.xlsx") returned 6 [0057.306] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.ppt") returned 0 [0057.306] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.pptx") returned 0 [0057.306] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.txt") returned 0 [0057.306] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.pdf") returned 0 [0057.306] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.djvu") returned 0 [0057.306] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.htm") returned 0 [0057.306] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.html") returned 0 [0057.306] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.mdb") returned 0 [0057.306] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.cer") returned 0 [0057.306] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.p12") returned 0 [0057.306] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.pfx") returned 0 [0057.307] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.kwm") returned 0 [0057.307] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.pwm") returned 0 [0057.307] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.1cd") returned 0 [0057.307] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.md") returned 0 [0057.307] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.mdf") returned 0 [0057.307] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.dbf") returned 0 [0057.307] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.odt") returned 0 [0057.307] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.vob") returned 0 [0057.307] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.ifo") returned 0 [0057.307] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.lnk") returned 0 [0057.307] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.torrent") returned 0 [0057.307] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.mov") returned 0 [0057.307] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.m2v") returned 0 [0057.307] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.3gp") returned 0 [0057.307] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.mpeg") returned 0 [0057.307] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.mpg") returned 0 [0057.307] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.flv") returned 0 [0057.307] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.avi") returned 0 [0057.307] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.mp4") returned 0 [0057.308] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.wmv") returned 0 [0057.308] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.divx") returned 0 [0057.308] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.mkv") returned 0 [0057.308] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.mp3") returned 0 [0057.308] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.wav") returned 0 [0057.308] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.flac") returned 0 [0057.308] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.ape") returned 0 [0057.308] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.wma") returned 0 [0057.308] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab", pszSpec="*.ac3") returned 0 [0057.308] FindNextFileA (in: hFindFile=0x636430, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdc86a00, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0xdc86a00, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x3abd27f0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x246000, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="DCFMUI.msi", cAlternateFileName="")) returned 1 [0057.308] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.308] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DCFMUI.msi") returned 1 [0057.308] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DCFMUI.msi") returned 1 [0057.308] lstrcmpiA (lpString1="", lpString2="DCFMUI.msi") returned -1 [0057.308] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab") returned="DCFMUI.cab" [0057.308] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\" [0057.308] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\") returned="" [0057.308] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.308] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.309] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\", lpString2="DCFMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi") returned="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi" [0057.309] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.zip") returned 0 [0057.309] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.rar") returned 0 [0057.309] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.7z") returned 0 [0057.309] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.tar") returned 0 [0057.309] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.gzip") returned 0 [0057.309] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.jpg") returned 0 [0057.309] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.jpeg") returned 0 [0057.309] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.psd") returned 0 [0057.309] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.cdr") returned 0 [0057.309] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.dwg") returned 0 [0057.309] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.max") returned 0 [0057.309] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.bmp") returned 0 [0057.309] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.gif") returned 0 [0057.309] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.png") returned 0 [0057.309] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.doc") returned 0 [0057.309] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.docx") returned 0 [0057.309] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.xls") returned 0 [0057.309] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.xlsx") returned 0 [0057.309] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.ppt") returned 0 [0057.310] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.pptx") returned 0 [0057.310] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.txt") returned 0 [0057.310] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.pdf") returned 0 [0057.310] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.djvu") returned 0 [0057.310] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.htm") returned 0 [0057.310] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.html") returned 0 [0057.310] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.mdb") returned 0 [0057.310] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.cer") returned 0 [0057.310] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.p12") returned 0 [0057.310] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.pfx") returned 0 [0057.310] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.kwm") returned 0 [0057.310] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.pwm") returned 0 [0057.310] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.1cd") returned 0 [0057.310] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.md") returned 0 [0057.310] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.mdf") returned 0 [0057.310] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.dbf") returned 0 [0057.310] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.odt") returned 0 [0057.310] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.vob") returned 0 [0057.310] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.ifo") returned 0 [0057.310] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.lnk") returned 0 [0057.310] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.torrent") returned 0 [0057.311] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.mov") returned 0 [0057.311] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.m2v") returned 0 [0057.311] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.3gp") returned 0 [0057.311] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.mpeg") returned 0 [0057.311] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.mpg") returned 0 [0057.311] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.flv") returned 0 [0057.311] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.avi") returned 0 [0057.311] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.mp4") returned 0 [0057.311] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.wmv") returned 0 [0057.311] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.divx") returned 0 [0057.311] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.mkv") returned 0 [0057.311] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.mp3") returned 0 [0057.311] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.wav") returned 0 [0057.311] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.flac") returned 0 [0057.311] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.ape") returned 0 [0057.311] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.wma") returned 0 [0057.311] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi", pszSpec="*.ac3") returned 0 [0057.311] FindNextFileA (in: hFindFile=0x636430, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdf06d040, ftCreationTime.dwHighDateTime=0x1d0cbb1, ftLastAccessTime.dwLowDateTime=0xdf06d040, ftLastAccessTime.dwHighDateTime=0x1d0cbb1, ftLastWriteTime.dwLowDateTime=0x3abd27f0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="DCFMUI.xml", cAlternateFileName="")) returned 1 [0057.311] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.311] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DCFMUI.xml") returned 1 [0057.311] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DCFMUI.xml") returned 1 [0057.312] lstrcmpiA (lpString1="", lpString2="DCFMUI.xml") returned -1 [0057.312] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.msi") returned="DCFMUI.msi" [0057.312] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\" [0057.312] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\") returned="" [0057.312] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.312] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.312] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\", lpString2="DCFMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml") returned="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml" [0057.312] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.zip") returned 0 [0057.312] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.rar") returned 0 [0057.312] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.7z") returned 0 [0057.312] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.tar") returned 0 [0057.312] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.gzip") returned 0 [0057.312] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.jpg") returned 0 [0057.312] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.jpeg") returned 0 [0057.312] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.psd") returned 0 [0057.312] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.cdr") returned 0 [0057.312] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.dwg") returned 0 [0057.312] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.max") returned 0 [0057.312] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.bmp") returned 0 [0057.312] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.gif") returned 0 [0057.313] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.png") returned 0 [0057.313] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.doc") returned 0 [0057.313] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.docx") returned 0 [0057.313] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.xls") returned 0 [0057.313] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.xlsx") returned 0 [0057.313] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.ppt") returned 0 [0057.313] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.pptx") returned 0 [0057.313] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.txt") returned 0 [0057.313] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.pdf") returned 0 [0057.313] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.djvu") returned 0 [0057.313] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.htm") returned 0 [0057.313] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.html") returned 0 [0057.313] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.mdb") returned 0 [0057.313] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.cer") returned 0 [0057.313] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.p12") returned 0 [0057.313] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.pfx") returned 0 [0057.313] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.kwm") returned 0 [0057.313] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.pwm") returned 0 [0057.313] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.1cd") returned 0 [0057.314] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.md") returned 0 [0057.314] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.mdf") returned 0 [0057.314] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.dbf") returned 0 [0057.314] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.odt") returned 0 [0057.314] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.vob") returned 0 [0057.314] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.ifo") returned 0 [0057.314] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.lnk") returned 0 [0057.314] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.torrent") returned 0 [0057.314] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.mov") returned 0 [0057.314] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.m2v") returned 0 [0057.314] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.3gp") returned 0 [0057.314] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.mpeg") returned 0 [0057.314] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.mpg") returned 0 [0057.315] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.flv") returned 0 [0057.315] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.avi") returned 0 [0057.315] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.mp4") returned 0 [0057.315] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.wmv") returned 0 [0057.315] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.divx") returned 0 [0057.315] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.mkv") returned 0 [0057.315] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.mp3") returned 0 [0057.315] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.wav") returned 0 [0057.315] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.flac") returned 0 [0057.315] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.ape") returned 0 [0057.315] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.wma") returned 0 [0057.315] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml", pszSpec="*.ac3") returned 0 [0057.315] FindNextFileA (in: hFindFile=0x636430, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4198d7c0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x4198d7c0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3abf98f0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x710, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.315] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.315] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.315] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.315] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.315] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml") returned="DCFMUI.xml" [0057.315] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\" [0057.315] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\") returned="" [0057.315] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.316] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.316] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml" [0057.316] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0 [0057.316] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0 [0057.316] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0 [0057.316] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0 [0057.316] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gzip") returned 0 [0057.316] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0 [0057.316] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0 [0057.316] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0 [0057.316] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cdr") returned 0 [0057.316] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dwg") returned 0 [0057.316] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.max") returned 0 [0057.316] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.bmp") returned 0 [0057.316] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gif") returned 0 [0057.316] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.png") returned 0 [0057.316] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0 [0057.316] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0 [0057.316] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0 [0057.316] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0 [0057.317] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0 [0057.317] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0 [0057.317] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.txt") returned 0 [0057.317] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pdf") returned 0 [0057.317] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.djvu") returned 0 [0057.317] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.htm") returned 0 [0057.317] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.html") returned 0 [0057.317] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mdb") returned 0 [0057.317] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cer") returned 0 [0057.317] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.p12") returned 0 [0057.317] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pfx") returned 0 [0057.317] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.kwm") returned 0 [0057.317] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pwm") returned 0 [0057.317] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.1cd") returned 0 [0057.317] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.md") returned 0 [0057.317] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mdf") returned 0 [0057.317] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dbf") returned 0 [0057.317] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.odt") returned 0 [0057.317] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.vob") returned 0 [0057.317] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ifo") returned 0 [0057.318] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.lnk") returned 0 [0057.318] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.torrent") returned 0 [0057.318] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mov") returned 0 [0057.318] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.m2v") returned 0 [0057.318] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.3gp") returned 0 [0057.318] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpeg") returned 0 [0057.318] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpg") returned 0 [0057.318] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flv") returned 0 [0057.318] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.avi") returned 0 [0057.318] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp4") returned 0 [0057.318] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wmv") returned 0 [0057.318] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.divx") returned 0 [0057.318] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mkv") returned 0 [0057.318] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp3") returned 0 [0057.318] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wav") returned 0 [0057.318] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flac") returned 0 [0057.318] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ape") returned 0 [0057.318] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wma") returned 0 [0057.318] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ac3") returned 0 [0057.319] FindNextFileA (in: hFindFile=0x636430, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4198d7c0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x4198d7c0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3abf98f0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x710, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.319] FindClose (in: hFindFile=0x636430 | out: hFindFile=0x636430) returned 1 [0057.319] FindNextFileA (in: hFindFile=0x636470, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x39c15733, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3a7d1838, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3a7d1838, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="{90160000-00A1-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9155A~1")) returned 1 [0057.319] lstrcmpA (lpString1=".", lpString2="{90160000-00A1-0409-0000-0000000FF1CE}-C") returned -1 [0057.319] lstrcmpA (lpString1="..", lpString2="{90160000-00A1-0409-0000-0000000FF1CE}-C") returned -1 [0057.319] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.319] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90160000-00A1-0409-0000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C" [0057.319] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\*.*" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\*.*"), lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x39c15733, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3a7d1838, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3a7d1838, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x636930 [0057.327] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.327] FindNextFileA (in: hFindFile=0x636930, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x39c15733, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3a7d1838, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3a7d1838, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="..", cAlternateFileName="")) returned 1 [0057.327] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.327] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.327] FindNextFileA (in: hFindFile=0x636930, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6cdfd410, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x6cdfd410, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x39c31080, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x247000, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0057.327] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.327] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OneNoteMUI.msi") returned -1 [0057.327] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OneNoteMUI.msi") returned -1 [0057.327] lstrcmpiA (lpString1="", lpString2="OneNoteMUI.msi") returned -1 [0057.327] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.327] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\" [0057.327] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\") returned="" [0057.327] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.327] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.327] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0057.328] WriteFile (in: hFile=0x1c8, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.329] SetFileTime (hFile=0x1c8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.329] CloseHandle (hObject=0x1c8) returned 1 [0057.329] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\", lpString2="OneNoteMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.msi") returned="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.msi" [0057.329] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.zip") returned 0 [0057.330] lstrlenA (lpString="*.zip") returned 5 [0057.330] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.rar") returned 0 [0057.330] lstrlenA (lpString="*.rar") returned 5 [0057.330] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.7z") returned 0 [0057.330] lstrlenA (lpString="*.7z") returned 4 [0057.330] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.tar") returned 0 [0057.330] lstrlenA (lpString="*.tar") returned 5 [0057.330] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.gzip") returned 0 [0057.330] lstrlenA (lpString="*.gzip") returned 6 [0057.330] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.jpg") returned 0 [0057.330] lstrlenA (lpString="*.jpg") returned 5 [0057.330] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.jpeg") returned 0 [0057.330] lstrlenA (lpString="*.jpeg") returned 6 [0057.330] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.psd") returned 0 [0057.330] lstrlenA (lpString="*.psd") returned 5 [0057.330] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.cdr") returned 0 [0057.330] lstrlenA (lpString="*.cdr") returned 5 [0057.330] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.dwg") returned 0 [0057.330] lstrlenA (lpString="*.dwg") returned 5 [0057.331] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.max") returned 0 [0057.331] lstrlenA (lpString="*.max") returned 5 [0057.331] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.bmp") returned 0 [0057.331] lstrlenA (lpString="*.bmp") returned 5 [0057.331] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.gif") returned 0 [0057.331] lstrlenA (lpString="*.gif") returned 5 [0057.331] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.png") returned 0 [0057.331] lstrlenA (lpString="*.png") returned 5 [0057.331] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.doc") returned 0 [0057.331] lstrlenA (lpString="*.doc") returned 5 [0057.331] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.docx") returned 0 [0057.331] lstrlenA (lpString="*.docx") returned 6 [0057.331] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.xls") returned 0 [0057.331] lstrlenA (lpString="*.xls") returned 5 [0057.331] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.xlsx") returned 0 [0057.331] lstrlenA (lpString="*.xlsx") returned 6 [0057.331] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.ppt") returned 0 [0057.331] lstrlenA (lpString="*.ppt") returned 5 [0057.331] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.pptx") returned 0 [0057.331] lstrlenA (lpString="*.pptx") returned 6 [0057.331] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.txt") returned 0 [0057.331] lstrlenA (lpString="*.txt") returned 5 [0057.332] lstrlenA (lpString="*.pdf") returned 5 [0057.332] lstrlenA (lpString="*.djvu") returned 6 [0057.332] lstrlenA (lpString="*.htm") returned 5 [0057.332] lstrlenA (lpString="*.html") returned 6 [0057.332] lstrlenA (lpString="*.mdb") returned 5 [0057.332] lstrlenA (lpString="*.cer") returned 5 [0057.332] lstrlenA (lpString="*.p12") returned 5 [0057.332] lstrlenA (lpString="*.pfx") returned 5 [0057.332] lstrlenA (lpString="*.kwm") returned 5 [0057.332] lstrlenA (lpString="*.pwm") returned 5 [0057.332] lstrlenA (lpString="*.1cd") returned 5 [0057.332] lstrlenA (lpString="*.md") returned 4 [0057.332] lstrlenA (lpString="*.mdf") returned 5 [0057.332] lstrlenA (lpString="*.dbf") returned 5 [0057.332] lstrlenA (lpString="*.odt") returned 5 [0057.332] lstrlenA (lpString="*.vob") returned 5 [0057.332] lstrlenA (lpString="*.ifo") returned 5 [0057.332] lstrlenA (lpString="*.lnk") returned 5 [0057.332] lstrlenA (lpString="*.torrent") returned 9 [0057.332] lstrlenA (lpString="*.mov") returned 5 [0057.333] lstrlenA (lpString="*.m2v") returned 5 [0057.333] lstrlenA (lpString="*.3gp") returned 5 [0057.333] lstrlenA (lpString="*.mpeg") returned 6 [0057.333] lstrlenA (lpString="*.mpg") returned 5 [0057.333] lstrlenA (lpString="*.flv") returned 5 [0057.333] lstrlenA (lpString="*.avi") returned 5 [0057.333] lstrlenA (lpString="*.mp4") returned 5 [0057.333] lstrlenA (lpString="*.wmv") returned 5 [0057.333] lstrlenA (lpString="*.divx") returned 6 [0057.333] lstrlenA (lpString="*.mkv") returned 5 [0057.333] lstrlenA (lpString="*.mp3") returned 5 [0057.333] lstrlenA (lpString="*.wav") returned 5 [0057.333] lstrlenA (lpString="*.flac") returned 6 [0057.333] lstrlenA (lpString="*.ape") returned 5 [0057.333] lstrlenA (lpString="*.wma") returned 5 [0057.333] lstrlenA (lpString="*.ac3") returned 5 [0057.333] FindNextFileA (in: hFindFile=0x636930, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa6b80780, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0xa6b80780, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0x39c162d0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x719, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0057.333] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.333] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OneNoteMUI.xml") returned -1 [0057.333] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OneNoteMUI.xml") returned -1 [0057.333] lstrcmpiA (lpString1="", lpString2="OneNoteMUI.xml") returned -1 [0057.333] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.msi") returned="OneNoteMUI.msi" [0057.334] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\" [0057.334] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\") returned="" [0057.334] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.334] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.334] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\", lpString2="OneNoteMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml") returned="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml" [0057.334] lstrlenA (lpString="*.zip") returned 5 [0057.334] lstrlenA (lpString="*.rar") returned 5 [0057.334] lstrlenA (lpString="*.7z") returned 4 [0057.334] lstrlenA (lpString="*.tar") returned 5 [0057.334] lstrlenA (lpString="*.gzip") returned 6 [0057.334] lstrlenA (lpString="*.jpg") returned 5 [0057.334] lstrlenA (lpString="*.jpeg") returned 6 [0057.334] lstrlenA (lpString="*.psd") returned 5 [0057.334] lstrlenA (lpString="*.cdr") returned 5 [0057.334] lstrlenA (lpString="*.dwg") returned 5 [0057.334] lstrlenA (lpString="*.max") returned 5 [0057.334] lstrlenA (lpString="*.bmp") returned 5 [0057.334] lstrlenA (lpString="*.gif") returned 5 [0057.334] lstrlenA (lpString="*.png") returned 5 [0057.335] lstrlenA (lpString="*.doc") returned 5 [0057.335] lstrlenA (lpString="*.docx") returned 6 [0057.335] lstrlenA (lpString="*.xls") returned 5 [0057.335] lstrlenA (lpString="*.xlsx") returned 6 [0057.335] lstrlenA (lpString="*.ppt") returned 5 [0057.335] lstrlenA (lpString="*.pptx") returned 6 [0057.335] lstrlenA (lpString="*.txt") returned 5 [0057.335] lstrlenA (lpString="*.pdf") returned 5 [0057.335] lstrlenA (lpString="*.djvu") returned 6 [0057.335] lstrlenA (lpString="*.htm") returned 5 [0057.335] lstrlenA (lpString="*.html") returned 6 [0057.335] lstrlenA (lpString="*.mdb") returned 5 [0057.335] lstrlenA (lpString="*.cer") returned 5 [0057.335] lstrlenA (lpString="*.p12") returned 5 [0057.335] lstrlenA (lpString="*.pfx") returned 5 [0057.335] lstrlenA (lpString="*.kwm") returned 5 [0057.335] lstrlenA (lpString="*.pwm") returned 5 [0057.335] lstrlenA (lpString="*.1cd") returned 5 [0057.335] lstrlenA (lpString="*.md") returned 4 [0057.335] lstrlenA (lpString="*.mdf") returned 5 [0057.335] lstrlenA (lpString="*.dbf") returned 5 [0057.336] lstrlenA (lpString="*.odt") returned 5 [0057.336] lstrlenA (lpString="*.vob") returned 5 [0057.336] lstrlenA (lpString="*.ifo") returned 5 [0057.336] lstrlenA (lpString="*.lnk") returned 5 [0057.336] lstrlenA (lpString="*.torrent") returned 9 [0057.336] lstrlenA (lpString="*.mov") returned 5 [0057.336] lstrlenA (lpString="*.m2v") returned 5 [0057.336] lstrlenA (lpString="*.3gp") returned 5 [0057.336] lstrlenA (lpString="*.mpeg") returned 6 [0057.336] lstrlenA (lpString="*.mpg") returned 5 [0057.336] lstrlenA (lpString="*.flv") returned 5 [0057.336] lstrlenA (lpString="*.avi") returned 5 [0057.336] lstrlenA (lpString="*.mp4") returned 5 [0057.336] lstrlenA (lpString="*.wmv") returned 5 [0057.336] lstrlenA (lpString="*.divx") returned 6 [0057.336] lstrlenA (lpString="*.mkv") returned 5 [0057.336] lstrlenA (lpString="*.mp3") returned 5 [0057.336] lstrlenA (lpString="*.wav") returned 5 [0057.336] lstrlenA (lpString="*.flac") returned 6 [0057.336] lstrlenA (lpString="*.ape") returned 5 [0057.336] lstrlenA (lpString="*.wma") returned 5 [0057.337] lstrlenA (lpString="*.ac3") returned 5 [0057.337] FindNextFileA (in: hFindFile=0x636930, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85984230, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x85984230, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x39ca3c70, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0xcbc714, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0057.337] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.337] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OnoteLR.cab") returned -1 [0057.337] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OnoteLR.cab") returned -1 [0057.337] lstrcmpiA (lpString1="", lpString2="OnoteLR.cab") returned -1 [0057.337] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml") returned="OneNoteMUI.xml" [0057.337] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\" [0057.337] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\") returned="" [0057.337] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.337] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.337] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\", lpString2="OnoteLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OnoteLR.cab") returned="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OnoteLR.cab" [0057.337] lstrlenA (lpString="*.zip") returned 5 [0057.337] lstrlenA (lpString="*.rar") returned 5 [0057.337] lstrlenA (lpString="*.7z") returned 4 [0057.337] lstrlenA (lpString="*.tar") returned 5 [0057.337] lstrlenA (lpString="*.gzip") returned 6 [0057.337] lstrlenA (lpString="*.jpg") returned 5 [0057.337] lstrlenA (lpString="*.jpeg") returned 6 [0057.337] lstrlenA (lpString="*.psd") returned 5 [0057.338] lstrlenA (lpString="*.cdr") returned 5 [0057.338] lstrlenA (lpString="*.dwg") returned 5 [0057.338] lstrlenA (lpString="*.max") returned 5 [0057.338] lstrlenA (lpString="*.bmp") returned 5 [0057.338] lstrlenA (lpString="*.gif") returned 5 [0057.338] lstrlenA (lpString="*.png") returned 5 [0057.338] lstrlenA (lpString="*.doc") returned 5 [0057.338] lstrlenA (lpString="*.docx") returned 6 [0057.338] lstrlenA (lpString="*.xls") returned 5 [0057.338] lstrlenA (lpString="*.xlsx") returned 6 [0057.338] lstrlenA (lpString="*.ppt") returned 5 [0057.338] lstrlenA (lpString="*.pptx") returned 6 [0057.338] lstrlenA (lpString="*.txt") returned 5 [0057.338] lstrlenA (lpString="*.pdf") returned 5 [0057.338] lstrlenA (lpString="*.djvu") returned 6 [0057.338] lstrlenA (lpString="*.htm") returned 5 [0057.338] lstrlenA (lpString="*.html") returned 6 [0057.338] lstrlenA (lpString="*.mdb") returned 5 [0057.338] lstrlenA (lpString="*.cer") returned 5 [0057.338] lstrlenA (lpString="*.p12") returned 5 [0057.338] lstrlenA (lpString="*.pfx") returned 5 [0057.338] lstrlenA (lpString="*.kwm") returned 5 [0057.339] lstrlenA (lpString="*.pwm") returned 5 [0057.339] lstrlenA (lpString="*.1cd") returned 5 [0057.339] lstrlenA (lpString="*.md") returned 4 [0057.339] lstrlenA (lpString="*.mdf") returned 5 [0057.339] lstrlenA (lpString="*.dbf") returned 5 [0057.339] lstrlenA (lpString="*.odt") returned 5 [0057.339] lstrlenA (lpString="*.vob") returned 5 [0057.339] lstrlenA (lpString="*.ifo") returned 5 [0057.339] lstrlenA (lpString="*.lnk") returned 5 [0057.339] lstrlenA (lpString="*.torrent") returned 9 [0057.339] lstrlenA (lpString="*.mov") returned 5 [0057.339] lstrlenA (lpString="*.m2v") returned 5 [0057.339] lstrlenA (lpString="*.3gp") returned 5 [0057.339] lstrlenA (lpString="*.mpeg") returned 6 [0057.339] lstrlenA (lpString="*.mpg") returned 5 [0057.339] lstrlenA (lpString="*.flv") returned 5 [0057.339] lstrlenA (lpString="*.avi") returned 5 [0057.339] lstrlenA (lpString="*.mp4") returned 5 [0057.339] lstrlenA (lpString="*.wmv") returned 5 [0057.339] lstrlenA (lpString="*.divx") returned 6 [0057.340] lstrlenA (lpString="*.mkv") returned 5 [0057.340] lstrlenA (lpString="*.mp3") returned 5 [0057.340] lstrlenA (lpString="*.wav") returned 5 [0057.340] lstrlenA (lpString="*.flac") returned 6 [0057.340] lstrlenA (lpString="*.ape") returned 5 [0057.340] lstrlenA (lpString="*.wma") returned 5 [0057.340] lstrlenA (lpString="*.ac3") returned 5 [0057.340] FindNextFileA (in: hFindFile=0x636930, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x423b0b30, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x423b0b30, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3a7d11b0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x87f, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.340] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.340] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.340] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.340] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.340] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OnoteLR.cab") returned="OnoteLR.cab" [0057.340] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\" [0057.340] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\") returned="" [0057.340] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.340] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.340] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml" [0057.340] lstrlenA (lpString="*.zip") returned 5 [0057.340] lstrlenA (lpString="*.rar") returned 5 [0057.340] lstrlenA (lpString="*.7z") returned 4 [0057.341] lstrlenA (lpString="*.tar") returned 5 [0057.341] lstrlenA (lpString="*.gzip") returned 6 [0057.341] lstrlenA (lpString="*.jpg") returned 5 [0057.341] lstrlenA (lpString="*.jpeg") returned 6 [0057.341] lstrlenA (lpString="*.psd") returned 5 [0057.341] lstrlenA (lpString="*.cdr") returned 5 [0057.341] lstrlenA (lpString="*.dwg") returned 5 [0057.341] lstrlenA (lpString="*.max") returned 5 [0057.341] lstrlenA (lpString="*.bmp") returned 5 [0057.341] lstrlenA (lpString="*.gif") returned 5 [0057.341] lstrlenA (lpString="*.png") returned 5 [0057.341] lstrlenA (lpString="*.doc") returned 5 [0057.341] lstrlenA (lpString="*.docx") returned 6 [0057.341] lstrlenA (lpString="*.xls") returned 5 [0057.341] lstrlenA (lpString="*.xlsx") returned 6 [0057.341] lstrlenA (lpString="*.ppt") returned 5 [0057.341] lstrlenA (lpString="*.pptx") returned 6 [0057.341] lstrlenA (lpString="*.txt") returned 5 [0057.341] lstrlenA (lpString="*.pdf") returned 5 [0057.341] lstrlenA (lpString="*.djvu") returned 6 [0057.341] lstrlenA (lpString="*.htm") returned 5 [0057.342] lstrlenA (lpString="*.html") returned 6 [0057.342] lstrlenA (lpString="*.mdb") returned 5 [0057.342] lstrlenA (lpString="*.cer") returned 5 [0057.342] lstrlenA (lpString="*.p12") returned 5 [0057.342] lstrlenA (lpString="*.pfx") returned 5 [0057.342] lstrlenA (lpString="*.kwm") returned 5 [0057.342] lstrlenA (lpString="*.pwm") returned 5 [0057.342] lstrlenA (lpString="*.1cd") returned 5 [0057.342] lstrlenA (lpString="*.md") returned 4 [0057.342] lstrlenA (lpString="*.mdf") returned 5 [0057.342] lstrlenA (lpString="*.dbf") returned 5 [0057.342] lstrlenA (lpString="*.odt") returned 5 [0057.342] lstrlenA (lpString="*.vob") returned 5 [0057.342] lstrlenA (lpString="*.ifo") returned 5 [0057.342] lstrlenA (lpString="*.lnk") returned 5 [0057.342] lstrlenA (lpString="*.torrent") returned 9 [0057.342] lstrlenA (lpString="*.mov") returned 5 [0057.342] lstrlenA (lpString="*.m2v") returned 5 [0057.342] lstrlenA (lpString="*.3gp") returned 5 [0057.342] lstrlenA (lpString="*.mpeg") returned 6 [0057.342] lstrlenA (lpString="*.mpg") returned 5 [0057.343] lstrlenA (lpString="*.flv") returned 5 [0057.343] lstrlenA (lpString="*.avi") returned 5 [0057.343] lstrlenA (lpString="*.mp4") returned 5 [0057.343] lstrlenA (lpString="*.wmv") returned 5 [0057.343] lstrlenA (lpString="*.divx") returned 6 [0057.343] lstrlenA (lpString="*.mkv") returned 5 [0057.343] lstrlenA (lpString="*.mp3") returned 5 [0057.343] lstrlenA (lpString="*.wav") returned 5 [0057.343] lstrlenA (lpString="*.flac") returned 6 [0057.343] lstrlenA (lpString="*.ape") returned 5 [0057.343] lstrlenA (lpString="*.wma") returned 5 [0057.343] lstrlenA (lpString="*.ac3") returned 5 [0057.343] FindNextFileA (in: hFindFile=0x636930, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x423b0b30, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x423b0b30, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3a7d11b0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x87f, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.343] FindClose (in: hFindFile=0x636930 | out: hFindFile=0x636930) returned 1 [0057.343] FindNextFileA (in: hFindFile=0x636470, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3b3c3241, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3b4358ee, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3b4358ee, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="{90160000-00BA-0409-0000-0000000FF1CE}-C", cAlternateFileName="{97C62~1")) returned 1 [0057.343] lstrcmpA (lpString1=".", lpString2="{90160000-00BA-0409-0000-0000000FF1CE}-C") returned -1 [0057.343] lstrcmpA (lpString1="..", lpString2="{90160000-00BA-0409-0000-0000000FF1CE}-C") returned -1 [0057.344] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.344] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90160000-00BA-0409-0000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C" [0057.344] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C") returned 62 [0057.344] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\*.*" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\*.*"), lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3b3c3241, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3b4358ee, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3b4358ee, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x6366f0 [0057.349] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.349] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3b3c3241, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3b4358ee, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3b4358ee, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="..", cAlternateFileName="")) returned 1 [0057.349] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.349] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.349] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x224df1f0, ftCreationTime.dwHighDateTime=0x1d0cbbf, ftLastAccessTime.dwLowDateTime=0x224df1f0, ftLastAccessTime.dwHighDateTime=0x1d0cbbf, ftLastWriteTime.dwLowDateTime=0x3b40d6e0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0xd5202, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0057.349] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.349] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GrooveLR.cab") returned -1 [0057.349] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrooveLR.cab") returned 1 [0057.349] lstrcmpiA (lpString1="", lpString2="GrooveLR.cab") returned -1 [0057.349] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.349] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\" [0057.349] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\") returned="" [0057.350] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.350] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.350] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0057.350] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.350] WriteFile (in: hFile=0x1c8, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.351] SetFileTime (hFile=0x1c8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.352] CloseHandle (hObject=0x1c8) returned 1 [0057.352] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\", lpString2="GrooveLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab") returned="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab" [0057.352] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.zip") returned 0 [0057.352] lstrlenA (lpString="*.zip") returned 5 [0057.352] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.rar") returned 0 [0057.352] lstrlenA (lpString="*.rar") returned 5 [0057.352] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.7z") returned 0 [0057.352] lstrlenA (lpString="*.7z") returned 4 [0057.352] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.tar") returned 0 [0057.352] lstrlenA (lpString="*.tar") returned 5 [0057.352] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.gzip") returned 0 [0057.352] lstrlenA (lpString="*.gzip") returned 6 [0057.352] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.jpg") returned 0 [0057.352] lstrlenA (lpString="*.jpg") returned 5 [0057.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.jpeg") returned 0 [0057.353] lstrlenA (lpString="*.jpeg") returned 6 [0057.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.psd") returned 0 [0057.353] lstrlenA (lpString="*.psd") returned 5 [0057.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.cdr") returned 0 [0057.353] lstrlenA (lpString="*.cdr") returned 5 [0057.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.dwg") returned 0 [0057.353] lstrlenA (lpString="*.dwg") returned 5 [0057.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.max") returned 0 [0057.353] lstrlenA (lpString="*.max") returned 5 [0057.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.bmp") returned 0 [0057.353] lstrlenA (lpString="*.bmp") returned 5 [0057.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.gif") returned 0 [0057.353] lstrlenA (lpString="*.gif") returned 5 [0057.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.png") returned 0 [0057.353] lstrlenA (lpString="*.png") returned 5 [0057.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.doc") returned 0 [0057.353] lstrlenA (lpString="*.doc") returned 5 [0057.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.docx") returned 0 [0057.353] lstrlenA (lpString="*.docx") returned 6 [0057.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.xls") returned 0 [0057.353] lstrlenA (lpString="*.xls") returned 5 [0057.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.xlsx") returned 0 [0057.353] lstrlenA (lpString="*.xlsx") returned 6 [0057.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.ppt") returned 0 [0057.353] lstrlenA (lpString="*.ppt") returned 5 [0057.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.pptx") returned 0 [0057.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.txt") returned 0 [0057.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.pdf") returned 0 [0057.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.djvu") returned 0 [0057.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.htm") returned 0 [0057.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.html") returned 0 [0057.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.mdb") returned 0 [0057.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.cer") returned 0 [0057.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.p12") returned 0 [0057.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.pfx") returned 0 [0057.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.kwm") returned 0 [0057.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.pwm") returned 0 [0057.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.1cd") returned 0 [0057.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.md") returned 0 [0057.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.mdf") returned 0 [0057.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.dbf") returned 0 [0057.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.odt") returned 0 [0057.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.vob") returned 0 [0057.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.ifo") returned 0 [0057.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.lnk") returned 0 [0057.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.torrent") returned 0 [0057.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.mov") returned 0 [0057.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.m2v") returned 0 [0057.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.3gp") returned 0 [0057.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.mpeg") returned 0 [0057.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.mpg") returned 0 [0057.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.flv") returned 0 [0057.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.avi") returned 0 [0057.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.mp4") returned 0 [0057.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.wmv") returned 0 [0057.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.divx") returned 0 [0057.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.mkv") returned 0 [0057.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.mp3") returned 0 [0057.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.wav") returned 0 [0057.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.flac") returned 0 [0057.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.ape") returned 0 [0057.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.wma") returned 0 [0057.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.ac3") returned 0 [0057.356] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x125bd4d0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x125bd4d0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x3b3c1bf0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x245000, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0057.356] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.356] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GrooveMUI.msi") returned -1 [0057.356] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrooveMUI.msi") returned 1 [0057.356] lstrcmpiA (lpString1="", lpString2="GrooveMUI.msi") returned -1 [0057.356] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab") returned="GrooveLR.cab" [0057.356] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\" [0057.356] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\") returned="" [0057.356] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.356] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.356] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\", lpString2="GrooveMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi") returned="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi" [0057.356] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.zip") returned 0 [0057.356] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.rar") returned 0 [0057.356] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.7z") returned 0 [0057.356] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.tar") returned 0 [0057.356] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.gzip") returned 0 [0057.356] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.jpg") returned 0 [0057.356] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.jpeg") returned 0 [0057.356] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.psd") returned 0 [0057.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.cdr") returned 0 [0057.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.dwg") returned 0 [0057.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.max") returned 0 [0057.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.bmp") returned 0 [0057.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.gif") returned 0 [0057.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.png") returned 0 [0057.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.doc") returned 0 [0057.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.docx") returned 0 [0057.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.xls") returned 0 [0057.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.xlsx") returned 0 [0057.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.ppt") returned 0 [0057.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.pptx") returned 0 [0057.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.txt") returned 0 [0057.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.pdf") returned 0 [0057.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.djvu") returned 0 [0057.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.htm") returned 0 [0057.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.html") returned 0 [0057.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.mdb") returned 0 [0057.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.cer") returned 0 [0057.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.p12") returned 0 [0057.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.pfx") returned 0 [0057.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.kwm") returned 0 [0057.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.pwm") returned 0 [0057.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.1cd") returned 0 [0057.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.md") returned 0 [0057.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.mdf") returned 0 [0057.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.dbf") returned 0 [0057.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.odt") returned 0 [0057.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.vob") returned 0 [0057.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.ifo") returned 0 [0057.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.lnk") returned 0 [0057.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.torrent") returned 0 [0057.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.mov") returned 0 [0057.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.m2v") returned 0 [0057.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.3gp") returned 0 [0057.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.mpeg") returned 0 [0057.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.mpg") returned 0 [0057.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.flv") returned 0 [0057.359] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.avi") returned 0 [0057.359] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.mp4") returned 0 [0057.359] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.wmv") returned 0 [0057.359] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.divx") returned 0 [0057.359] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.mkv") returned 0 [0057.359] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.mp3") returned 0 [0057.359] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.wav") returned 0 [0057.359] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.flac") returned 0 [0057.359] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.ape") returned 0 [0057.359] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.wma") returned 0 [0057.359] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.ac3") returned 0 [0057.359] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa241b20, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0xa241b20, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0x3b3c1bf0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x466, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0057.359] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.359] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GrooveMUI.xml") returned -1 [0057.359] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrooveMUI.xml") returned 1 [0057.359] lstrcmpiA (lpString1="", lpString2="GrooveMUI.xml") returned -1 [0057.359] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.msi") returned="GrooveMUI.msi" [0057.359] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\" [0057.359] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\") returned="" [0057.359] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.360] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.360] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\", lpString2="GrooveMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml") returned="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml" [0057.360] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.zip") returned 0 [0057.360] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.rar") returned 0 [0057.360] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.7z") returned 0 [0057.360] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.tar") returned 0 [0057.360] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.gzip") returned 0 [0057.360] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.jpg") returned 0 [0057.360] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.jpeg") returned 0 [0057.360] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.psd") returned 0 [0057.360] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.cdr") returned 0 [0057.360] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.dwg") returned 0 [0057.360] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.max") returned 0 [0057.360] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.bmp") returned 0 [0057.360] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.gif") returned 0 [0057.360] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.png") returned 0 [0057.360] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.doc") returned 0 [0057.361] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.docx") returned 0 [0057.361] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.xls") returned 0 [0057.361] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.xlsx") returned 0 [0057.361] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.ppt") returned 0 [0057.361] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.pptx") returned 0 [0057.361] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.txt") returned 0 [0057.361] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.pdf") returned 0 [0057.361] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.djvu") returned 0 [0057.361] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.htm") returned 0 [0057.361] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.html") returned 0 [0057.361] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.mdb") returned 0 [0057.361] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.cer") returned 0 [0057.362] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.p12") returned 0 [0057.362] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.pfx") returned 0 [0057.362] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.kwm") returned 0 [0057.362] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.pwm") returned 0 [0057.362] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.1cd") returned 0 [0057.362] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.md") returned 0 [0057.362] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.mdf") returned 0 [0057.362] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.dbf") returned 0 [0057.362] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.odt") returned 0 [0057.362] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.vob") returned 0 [0057.362] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.ifo") returned 0 [0057.362] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.lnk") returned 0 [0057.362] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.torrent") returned 0 [0057.362] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.mov") returned 0 [0057.362] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.m2v") returned 0 [0057.362] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.3gp") returned 0 [0057.362] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.mpeg") returned 0 [0057.362] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.mpg") returned 0 [0057.362] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.flv") returned 0 [0057.363] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.avi") returned 0 [0057.363] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.mp4") returned 0 [0057.363] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.wmv") returned 0 [0057.363] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.divx") returned 0 [0057.363] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.mkv") returned 0 [0057.363] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.mp3") returned 0 [0057.363] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.wav") returned 0 [0057.363] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.flac") returned 0 [0057.363] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.ape") returned 0 [0057.363] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.wma") returned 0 [0057.363] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.ac3") returned 0 [0057.363] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41bf2470, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41bf2470, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3b4347e0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x668, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.363] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.363] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.363] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.363] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.363] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml") returned="GrooveMUI.xml" [0057.363] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\" [0057.363] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\") returned="" [0057.363] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.363] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.364] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml" [0057.364] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0 [0057.364] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0 [0057.364] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0 [0057.364] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0 [0057.364] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gzip") returned 0 [0057.364] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0 [0057.364] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0 [0057.364] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0 [0057.364] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cdr") returned 0 [0057.364] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dwg") returned 0 [0057.364] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.max") returned 0 [0057.364] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.bmp") returned 0 [0057.364] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gif") returned 0 [0057.364] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.png") returned 0 [0057.364] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0 [0057.364] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0 [0057.364] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0 [0057.365] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0 [0057.365] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0 [0057.365] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0 [0057.365] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.txt") returned 0 [0057.365] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pdf") returned 0 [0057.365] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.djvu") returned 0 [0057.365] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.htm") returned 0 [0057.365] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.html") returned 0 [0057.365] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mdb") returned 0 [0057.365] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cer") returned 0 [0057.365] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.p12") returned 0 [0057.365] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pfx") returned 0 [0057.365] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.kwm") returned 0 [0057.365] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pwm") returned 0 [0057.365] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.1cd") returned 0 [0057.365] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.md") returned 0 [0057.365] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mdf") returned 0 [0057.365] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dbf") returned 0 [0057.365] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.odt") returned 0 [0057.366] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.vob") returned 0 [0057.366] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ifo") returned 0 [0057.366] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.lnk") returned 0 [0057.366] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.torrent") returned 0 [0057.366] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mov") returned 0 [0057.366] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.m2v") returned 0 [0057.366] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.3gp") returned 0 [0057.366] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpeg") returned 0 [0057.366] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpg") returned 0 [0057.366] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flv") returned 0 [0057.366] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.avi") returned 0 [0057.366] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp4") returned 0 [0057.366] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wmv") returned 0 [0057.366] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.divx") returned 0 [0057.366] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mkv") returned 0 [0057.366] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp3") returned 0 [0057.366] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wav") returned 0 [0057.366] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flac") returned 0 [0057.366] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ape") returned 0 [0057.367] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wma") returned 0 [0057.367] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ac3") returned 0 [0057.367] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41bf2470, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41bf2470, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3b4347e0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x668, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.367] FindClose (in: hFindFile=0x6366f0 | out: hFindFile=0x6366f0) returned 1 [0057.367] FindNextFileA (in: hFindFile=0x636470, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3a7d1838, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3abd4582, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3abd4582, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="{90160000-00E1-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9C97F~1")) returned 1 [0057.367] lstrcmpA (lpString1=".", lpString2="{90160000-00E1-0409-0000-0000000FF1CE}-C") returned -1 [0057.367] lstrcmpA (lpString1="..", lpString2="{90160000-00E1-0409-0000-0000000FF1CE}-C") returned -1 [0057.367] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.367] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90160000-00E1-0409-0000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C" [0057.367] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\*.*" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\*.*"), lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3a7d1838, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3abd4582, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3abd4582, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x6365f0 [0057.368] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.368] FindNextFileA (in: hFindFile=0x6365f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3a7d1838, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3abd4582, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3abd4582, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="..", cAlternateFileName="")) returned 1 [0057.368] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.368] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.368] FindNextFileA (in: hFindFile=0x6365f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x923540e0, ftCreationTime.dwHighDateTime=0x1d0cbbf, ftLastAccessTime.dwLowDateTime=0x923540e0, ftLastAccessTime.dwHighDateTime=0x1d0cbbf, ftLastWriteTime.dwLowDateTime=0x3abd27f0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x41ad, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="OSMMUI.cab", cAlternateFileName="")) returned 1 [0057.368] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.368] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OSMMUI.cab") returned -1 [0057.368] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OSMMUI.cab") returned -1 [0057.368] lstrcmpiA (lpString1="", lpString2="OSMMUI.cab") returned -1 [0057.368] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.368] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\" [0057.369] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\") returned="" [0057.369] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.369] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.369] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0057.371] WriteFile (in: hFile=0x1c8, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.372] SetFileTime (hFile=0x1c8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.372] CloseHandle (hObject=0x1c8) returned 1 [0057.373] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\", lpString2="OSMMUI.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.cab") returned="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.cab" [0057.373] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.cab", pszSpec="*.zip") returned 0 [0057.373] lstrlenA (lpString="*.zip") returned 5 [0057.373] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.cab", pszSpec="*.rar") returned 0 [0057.373] lstrlenA (lpString="*.rar") returned 5 [0057.373] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.cab", pszSpec="*.7z") returned 0 [0057.373] lstrlenA (lpString="*.7z") returned 4 [0057.373] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.cab", pszSpec="*.tar") returned 0 [0057.373] lstrlenA (lpString="*.tar") returned 5 [0057.373] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.cab", pszSpec="*.gzip") returned 0 [0057.373] lstrlenA (lpString="*.gzip") returned 6 [0057.373] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.cab", pszSpec="*.jpg") returned 0 [0057.373] lstrlenA (lpString="*.jpg") returned 5 [0057.373] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.cab", pszSpec="*.jpeg") returned 0 [0057.373] lstrlenA (lpString="*.jpeg") returned 6 [0057.373] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.cab", pszSpec="*.psd") returned 0 [0057.373] lstrlenA (lpString="*.psd") returned 5 [0057.373] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.cab", pszSpec="*.cdr") returned 0 [0057.373] lstrlenA (lpString="*.cdr") returned 5 [0057.373] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.cab", pszSpec="*.dwg") returned 0 [0057.373] lstrlenA (lpString="*.dwg") returned 5 [0057.373] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.cab", pszSpec="*.max") returned 0 [0057.373] lstrlenA (lpString="*.max") returned 5 [0057.373] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.cab", pszSpec="*.bmp") returned 0 [0057.374] lstrlenA (lpString="*.bmp") returned 5 [0057.374] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.cab", pszSpec="*.gif") returned 0 [0057.374] lstrlenA (lpString="*.gif") returned 5 [0057.374] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.cab", pszSpec="*.png") returned 0 [0057.374] lstrlenA (lpString="*.png") returned 5 [0057.374] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.cab", pszSpec="*.doc") returned 0 [0057.374] lstrlenA (lpString="*.doc") returned 5 [0057.374] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.cab", pszSpec="*.docx") returned 0 [0057.374] lstrlenA (lpString="*.docx") returned 6 [0057.374] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.cab", pszSpec="*.xls") returned 0 [0057.374] lstrlenA (lpString="*.xls") returned 5 [0057.374] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.cab", pszSpec="*.xlsx") returned 0 [0057.374] lstrlenA (lpString="*.xlsx") returned 6 [0057.374] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.cab", pszSpec="*.ppt") returned 0 [0057.374] lstrlenA (lpString="*.ppt") returned 5 [0057.374] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.cab", pszSpec="*.pptx") returned 0 [0057.374] lstrlenA (lpString="*.pptx") returned 6 [0057.374] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.cab", pszSpec="*.txt") returned 0 [0057.374] lstrlenA (lpString="*.txt") returned 5 [0057.375] lstrlenA (lpString="*.pdf") returned 5 [0057.375] lstrlenA (lpString="*.djvu") returned 6 [0057.375] lstrlenA (lpString="*.htm") returned 5 [0057.375] lstrlenA (lpString="*.html") returned 6 [0057.375] lstrlenA (lpString="*.mdb") returned 5 [0057.375] lstrlenA (lpString="*.cer") returned 5 [0057.375] lstrlenA (lpString="*.p12") returned 5 [0057.375] lstrlenA (lpString="*.pfx") returned 5 [0057.375] lstrlenA (lpString="*.kwm") returned 5 [0057.375] lstrlenA (lpString="*.pwm") returned 5 [0057.375] lstrlenA (lpString="*.1cd") returned 5 [0057.375] lstrlenA (lpString="*.md") returned 4 [0057.375] lstrlenA (lpString="*.mdf") returned 5 [0057.375] lstrlenA (lpString="*.dbf") returned 5 [0057.375] lstrlenA (lpString="*.odt") returned 5 [0057.375] lstrlenA (lpString="*.vob") returned 5 [0057.375] lstrlenA (lpString="*.ifo") returned 5 [0057.375] lstrlenA (lpString="*.lnk") returned 5 [0057.375] lstrlenA (lpString="*.torrent") returned 9 [0057.375] lstrlenA (lpString="*.mov") returned 5 [0057.375] lstrlenA (lpString="*.m2v") returned 5 [0057.376] lstrlenA (lpString="*.3gp") returned 5 [0057.376] lstrlenA (lpString="*.mpeg") returned 6 [0057.376] lstrlenA (lpString="*.mpg") returned 5 [0057.376] lstrlenA (lpString="*.flv") returned 5 [0057.376] lstrlenA (lpString="*.avi") returned 5 [0057.376] lstrlenA (lpString="*.mp4") returned 5 [0057.376] lstrlenA (lpString="*.wmv") returned 5 [0057.376] lstrlenA (lpString="*.divx") returned 6 [0057.376] lstrlenA (lpString="*.mkv") returned 5 [0057.376] lstrlenA (lpString="*.mp3") returned 5 [0057.376] lstrlenA (lpString="*.wav") returned 5 [0057.376] lstrlenA (lpString="*.flac") returned 6 [0057.376] lstrlenA (lpString="*.ape") returned 5 [0057.376] lstrlenA (lpString="*.wma") returned 5 [0057.376] lstrlenA (lpString="*.ac3") returned 5 [0057.376] FindNextFileA (in: hFindFile=0x6365f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x72b275a0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x72b275a0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x3abc8bb0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x12b000, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="OSMMUI.msi", cAlternateFileName="")) returned 1 [0057.376] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.376] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OSMMUI.msi") returned -1 [0057.376] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OSMMUI.msi") returned -1 [0057.376] lstrcmpiA (lpString1="", lpString2="OSMMUI.msi") returned -1 [0057.376] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.cab") returned="OSMMUI.cab" [0057.376] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\" [0057.376] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\") returned="" [0057.377] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.377] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.377] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\", lpString2="OSMMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.msi") returned="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.msi" [0057.377] lstrlenA (lpString="*.zip") returned 5 [0057.377] lstrlenA (lpString="*.rar") returned 5 [0057.377] lstrlenA (lpString="*.7z") returned 4 [0057.377] lstrlenA (lpString="*.tar") returned 5 [0057.377] lstrlenA (lpString="*.gzip") returned 6 [0057.377] lstrlenA (lpString="*.jpg") returned 5 [0057.377] lstrlenA (lpString="*.jpeg") returned 6 [0057.378] lstrlenA (lpString="*.psd") returned 5 [0057.378] lstrlenA (lpString="*.cdr") returned 5 [0057.378] lstrlenA (lpString="*.dwg") returned 5 [0057.378] lstrlenA (lpString="*.max") returned 5 [0057.378] lstrlenA (lpString="*.bmp") returned 5 [0057.378] lstrlenA (lpString="*.gif") returned 5 [0057.378] lstrlenA (lpString="*.png") returned 5 [0057.378] lstrlenA (lpString="*.doc") returned 5 [0057.378] lstrlenA (lpString="*.docx") returned 6 [0057.378] lstrlenA (lpString="*.xls") returned 5 [0057.378] lstrlenA (lpString="*.xlsx") returned 6 [0057.378] lstrlenA (lpString="*.ppt") returned 5 [0057.378] lstrlenA (lpString="*.pptx") returned 6 [0057.378] lstrlenA (lpString="*.txt") returned 5 [0057.378] lstrlenA (lpString="*.pdf") returned 5 [0057.378] lstrlenA (lpString="*.djvu") returned 6 [0057.378] lstrlenA (lpString="*.htm") returned 5 [0057.378] lstrlenA (lpString="*.html") returned 6 [0057.378] lstrlenA (lpString="*.mdb") returned 5 [0057.378] lstrlenA (lpString="*.cer") returned 5 [0057.378] lstrlenA (lpString="*.p12") returned 5 [0057.379] lstrlenA (lpString="*.pfx") returned 5 [0057.379] lstrlenA (lpString="*.kwm") returned 5 [0057.379] lstrlenA (lpString="*.pwm") returned 5 [0057.379] lstrlenA (lpString="*.1cd") returned 5 [0057.379] lstrlenA (lpString="*.md") returned 4 [0057.379] lstrlenA (lpString="*.mdf") returned 5 [0057.379] lstrlenA (lpString="*.dbf") returned 5 [0057.379] lstrlenA (lpString="*.odt") returned 5 [0057.379] lstrlenA (lpString="*.vob") returned 5 [0057.379] lstrlenA (lpString="*.ifo") returned 5 [0057.379] lstrlenA (lpString="*.lnk") returned 5 [0057.379] lstrlenA (lpString="*.torrent") returned 9 [0057.379] lstrlenA (lpString="*.mov") returned 5 [0057.379] lstrlenA (lpString="*.m2v") returned 5 [0057.379] lstrlenA (lpString="*.3gp") returned 5 [0057.379] lstrlenA (lpString="*.mpeg") returned 6 [0057.379] lstrlenA (lpString="*.mpg") returned 5 [0057.379] lstrlenA (lpString="*.flv") returned 5 [0057.379] lstrlenA (lpString="*.avi") returned 5 [0057.379] lstrlenA (lpString="*.mp4") returned 5 [0057.380] lstrlenA (lpString="*.wmv") returned 5 [0057.380] lstrlenA (lpString="*.divx") returned 6 [0057.380] lstrlenA (lpString="*.mkv") returned 5 [0057.380] lstrlenA (lpString="*.mp3") returned 5 [0057.380] lstrlenA (lpString="*.wav") returned 5 [0057.380] lstrlenA (lpString="*.flac") returned 6 [0057.380] lstrlenA (lpString="*.ape") returned 5 [0057.380] lstrlenA (lpString="*.wma") returned 5 [0057.380] lstrlenA (lpString="*.ac3") returned 5 [0057.380] FindNextFileA (in: hFindFile=0x6365f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc1ef3140, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0xc1ef3140, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0x3a7d11b0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x463, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="OSMMUI.xml", cAlternateFileName="")) returned 1 [0057.380] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.380] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OSMMUI.xml") returned -1 [0057.380] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OSMMUI.xml") returned -1 [0057.380] lstrcmpiA (lpString1="", lpString2="OSMMUI.xml") returned -1 [0057.380] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.msi") returned="OSMMUI.msi" [0057.380] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\" [0057.380] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\") returned="" [0057.380] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.380] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.380] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\", lpString2="OSMMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.xml") returned="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.xml" [0057.381] lstrlenA (lpString="*.zip") returned 5 [0057.381] lstrlenA (lpString="*.rar") returned 5 [0057.381] lstrlenA (lpString="*.7z") returned 4 [0057.381] lstrlenA (lpString="*.tar") returned 5 [0057.381] lstrlenA (lpString="*.gzip") returned 6 [0057.381] lstrlenA (lpString="*.jpg") returned 5 [0057.381] lstrlenA (lpString="*.jpeg") returned 6 [0057.381] lstrlenA (lpString="*.psd") returned 5 [0057.381] lstrlenA (lpString="*.cdr") returned 5 [0057.381] lstrlenA (lpString="*.dwg") returned 5 [0057.381] lstrlenA (lpString="*.max") returned 5 [0057.381] lstrlenA (lpString="*.bmp") returned 5 [0057.381] lstrlenA (lpString="*.gif") returned 5 [0057.381] lstrlenA (lpString="*.png") returned 5 [0057.381] lstrlenA (lpString="*.doc") returned 5 [0057.381] lstrlenA (lpString="*.docx") returned 6 [0057.381] lstrlenA (lpString="*.xls") returned 5 [0057.381] lstrlenA (lpString="*.xlsx") returned 6 [0057.381] lstrlenA (lpString="*.ppt") returned 5 [0057.381] lstrlenA (lpString="*.pptx") returned 6 [0057.381] lstrlenA (lpString="*.txt") returned 5 [0057.382] lstrlenA (lpString="*.pdf") returned 5 [0057.382] lstrlenA (lpString="*.djvu") returned 6 [0057.382] lstrlenA (lpString="*.htm") returned 5 [0057.382] lstrlenA (lpString="*.html") returned 6 [0057.382] lstrlenA (lpString="*.mdb") returned 5 [0057.382] lstrlenA (lpString="*.cer") returned 5 [0057.382] lstrlenA (lpString="*.p12") returned 5 [0057.382] lstrlenA (lpString="*.pfx") returned 5 [0057.382] lstrlenA (lpString="*.kwm") returned 5 [0057.382] lstrlenA (lpString="*.pwm") returned 5 [0057.382] lstrlenA (lpString="*.1cd") returned 5 [0057.382] lstrlenA (lpString="*.md") returned 4 [0057.382] lstrlenA (lpString="*.mdf") returned 5 [0057.382] lstrlenA (lpString="*.dbf") returned 5 [0057.382] lstrlenA (lpString="*.odt") returned 5 [0057.382] lstrlenA (lpString="*.vob") returned 5 [0057.382] lstrlenA (lpString="*.ifo") returned 5 [0057.382] lstrlenA (lpString="*.lnk") returned 5 [0057.382] lstrlenA (lpString="*.torrent") returned 9 [0057.382] lstrlenA (lpString="*.mov") returned 5 [0057.382] lstrlenA (lpString="*.m2v") returned 5 [0057.383] lstrlenA (lpString="*.3gp") returned 5 [0057.383] lstrlenA (lpString="*.mpeg") returned 6 [0057.383] lstrlenA (lpString="*.mpg") returned 5 [0057.383] lstrlenA (lpString="*.flv") returned 5 [0057.383] lstrlenA (lpString="*.avi") returned 5 [0057.383] lstrlenA (lpString="*.mp4") returned 5 [0057.383] lstrlenA (lpString="*.wmv") returned 5 [0057.383] lstrlenA (lpString="*.divx") returned 6 [0057.383] lstrlenA (lpString="*.mkv") returned 5 [0057.383] lstrlenA (lpString="*.mp3") returned 5 [0057.383] lstrlenA (lpString="*.wav") returned 5 [0057.383] lstrlenA (lpString="*.flac") returned 6 [0057.383] lstrlenA (lpString="*.ape") returned 5 [0057.383] lstrlenA (lpString="*.wma") returned 5 [0057.383] lstrlenA (lpString="*.ac3") returned 5 [0057.383] FindNextFileA (in: hFindFile=0x6365f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4244a820, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x4244a820, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3abd27f0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x7f6, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.383] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.383] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.383] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.383] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.383] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.xml") returned="OSMMUI.xml" [0057.383] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\" [0057.384] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\") returned="" [0057.384] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.384] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.384] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\Setup.xml" [0057.384] lstrlenA (lpString="*.zip") returned 5 [0057.384] lstrlenA (lpString="*.rar") returned 5 [0057.384] lstrlenA (lpString="*.7z") returned 4 [0057.384] lstrlenA (lpString="*.tar") returned 5 [0057.384] lstrlenA (lpString="*.gzip") returned 6 [0057.384] lstrlenA (lpString="*.jpg") returned 5 [0057.384] lstrlenA (lpString="*.jpeg") returned 6 [0057.384] lstrlenA (lpString="*.psd") returned 5 [0057.384] lstrlenA (lpString="*.cdr") returned 5 [0057.384] lstrlenA (lpString="*.dwg") returned 5 [0057.384] lstrlenA (lpString="*.max") returned 5 [0057.384] lstrlenA (lpString="*.bmp") returned 5 [0057.384] lstrlenA (lpString="*.gif") returned 5 [0057.384] lstrlenA (lpString="*.png") returned 5 [0057.384] lstrlenA (lpString="*.doc") returned 5 [0057.384] lstrlenA (lpString="*.docx") returned 6 [0057.384] lstrlenA (lpString="*.xls") returned 5 [0057.385] lstrlenA (lpString="*.xlsx") returned 6 [0057.385] lstrlenA (lpString="*.ppt") returned 5 [0057.385] lstrlenA (lpString="*.pptx") returned 6 [0057.385] lstrlenA (lpString="*.txt") returned 5 [0057.385] lstrlenA (lpString="*.pdf") returned 5 [0057.385] lstrlenA (lpString="*.djvu") returned 6 [0057.385] lstrlenA (lpString="*.htm") returned 5 [0057.385] lstrlenA (lpString="*.html") returned 6 [0057.385] lstrlenA (lpString="*.mdb") returned 5 [0057.385] lstrlenA (lpString="*.cer") returned 5 [0057.385] lstrlenA (lpString="*.p12") returned 5 [0057.385] lstrlenA (lpString="*.pfx") returned 5 [0057.385] lstrlenA (lpString="*.kwm") returned 5 [0057.385] lstrlenA (lpString="*.pwm") returned 5 [0057.385] lstrlenA (lpString="*.1cd") returned 5 [0057.385] lstrlenA (lpString="*.md") returned 4 [0057.385] lstrlenA (lpString="*.mdf") returned 5 [0057.385] lstrlenA (lpString="*.dbf") returned 5 [0057.385] lstrlenA (lpString="*.odt") returned 5 [0057.385] lstrlenA (lpString="*.vob") returned 5 [0057.385] lstrlenA (lpString="*.ifo") returned 5 [0057.386] lstrlenA (lpString="*.lnk") returned 5 [0057.386] lstrlenA (lpString="*.torrent") returned 9 [0057.386] lstrlenA (lpString="*.mov") returned 5 [0057.386] lstrlenA (lpString="*.m2v") returned 5 [0057.386] lstrlenA (lpString="*.3gp") returned 5 [0057.386] lstrlenA (lpString="*.mpeg") returned 6 [0057.386] lstrlenA (lpString="*.mpg") returned 5 [0057.386] lstrlenA (lpString="*.flv") returned 5 [0057.386] lstrlenA (lpString="*.avi") returned 5 [0057.386] lstrlenA (lpString="*.mp4") returned 5 [0057.386] lstrlenA (lpString="*.wmv") returned 5 [0057.386] lstrlenA (lpString="*.divx") returned 6 [0057.386] lstrlenA (lpString="*.mkv") returned 5 [0057.386] lstrlenA (lpString="*.mp3") returned 5 [0057.386] lstrlenA (lpString="*.wav") returned 5 [0057.386] lstrlenA (lpString="*.flac") returned 6 [0057.386] lstrlenA (lpString="*.ape") returned 5 [0057.386] lstrlenA (lpString="*.wma") returned 5 [0057.386] lstrlenA (lpString="*.ac3") returned 5 [0057.386] FindNextFileA (in: hFindFile=0x6365f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4244a820, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x4244a820, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3abd27f0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x7f6, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.386] FindClose (in: hFindFile=0x6365f0 | out: hFindFile=0x6365f0) returned 1 [0057.387] FindNextFileA (in: hFindFile=0x636470, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c2ed077, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c3cf8f7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c3cf8f7, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="{90160000-00E2-0409-0000-0000000FF1CE}-C", cAlternateFileName="{97E7F~1")) returned 1 [0057.387] lstrcmpA (lpString1=".", lpString2="{90160000-00E2-0409-0000-0000000FF1CE}-C") returned -1 [0057.387] lstrcmpA (lpString1="..", lpString2="{90160000-00E2-0409-0000-0000000FF1CE}-C") returned -1 [0057.387] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.387] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90160000-00E2-0409-0000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C" [0057.387] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C") returned 62 [0057.387] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\*.*" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\*.*"), lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c2ed077, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c3cf8f7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c3cf8f7, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x6366f0 [0057.391] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.391] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c2ed077, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c3cf8f7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c3cf8f7, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="..", cAlternateFileName="")) returned 1 [0057.391] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.391] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.391] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x912ef470, ftCreationTime.dwHighDateTime=0x1d0cbbf, ftLastAccessTime.dwLowDateTime=0x912ef470, ftLastAccessTime.dwHighDateTime=0x1d0cbbf, ftLastWriteTime.dwLowDateTime=0x3c33e970, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x408e2d, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="OSMUXMUI.cab", cAlternateFileName="")) returned 1 [0057.391] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.391] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OSMUXMUI.cab") returned -1 [0057.391] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OSMUXMUI.cab") returned -1 [0057.391] lstrcmpiA (lpString1="", lpString2="OSMUXMUI.cab") returned -1 [0057.391] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.391] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\" [0057.391] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\") returned="" [0057.391] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.392] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0057.396] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.396] WriteFile (in: hFile=0x1c8, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.397] SetFileTime (hFile=0x1c8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.397] CloseHandle (hObject=0x1c8) returned 1 [0057.397] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.zip") returned 0 [0057.397] lstrlenA (lpString="*.zip") returned 5 [0057.398] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.rar") returned 0 [0057.398] lstrlenA (lpString="*.rar") returned 5 [0057.398] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.7z") returned 0 [0057.398] lstrlenA (lpString="*.7z") returned 4 [0057.398] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.tar") returned 0 [0057.398] lstrlenA (lpString="*.tar") returned 5 [0057.398] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.gzip") returned 0 [0057.398] lstrlenA (lpString="*.gzip") returned 6 [0057.398] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.jpg") returned 0 [0057.398] lstrlenA (lpString="*.jpg") returned 5 [0057.398] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.jpeg") returned 0 [0057.398] lstrlenA (lpString="*.jpeg") returned 6 [0057.398] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.psd") returned 0 [0057.398] lstrlenA (lpString="*.psd") returned 5 [0057.398] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.cdr") returned 0 [0057.398] lstrlenA (lpString="*.cdr") returned 5 [0057.398] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.dwg") returned 0 [0057.398] lstrlenA (lpString="*.dwg") returned 5 [0057.398] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.max") returned 0 [0057.398] lstrlenA (lpString="*.max") returned 5 [0057.398] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.bmp") returned 0 [0057.398] lstrlenA (lpString="*.bmp") returned 5 [0057.398] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.gif") returned 0 [0057.398] lstrlenA (lpString="*.gif") returned 5 [0057.398] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.png") returned 0 [0057.398] lstrlenA (lpString="*.png") returned 5 [0057.398] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.doc") returned 0 [0057.398] lstrlenA (lpString="*.doc") returned 5 [0057.398] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.docx") returned 0 [0057.398] lstrlenA (lpString="*.docx") returned 6 [0057.398] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.xls") returned 0 [0057.398] lstrlenA (lpString="*.xls") returned 5 [0057.398] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.xlsx") returned 0 [0057.398] lstrlenA (lpString="*.xlsx") returned 6 [0057.399] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.ppt") returned 0 [0057.399] lstrlenA (lpString="*.ppt") returned 5 [0057.399] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.pptx") returned 0 [0057.399] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.txt") returned 0 [0057.399] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.pdf") returned 0 [0057.399] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.djvu") returned 0 [0057.399] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.htm") returned 0 [0057.399] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.html") returned 0 [0057.399] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.mdb") returned 0 [0057.399] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.cer") returned 0 [0057.399] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.p12") returned 0 [0057.399] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.pfx") returned 0 [0057.399] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.kwm") returned 0 [0057.399] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.pwm") returned 0 [0057.399] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.1cd") returned 0 [0057.399] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.md") returned 0 [0057.399] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.mdf") returned 0 [0057.399] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.dbf") returned 0 [0057.399] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.odt") returned 0 [0057.399] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.vob") returned 0 [0057.399] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.ifo") returned 0 [0057.399] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.lnk") returned 0 [0057.399] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.torrent") returned 0 [0057.399] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.mov") returned 0 [0057.400] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.m2v") returned 0 [0057.400] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.3gp") returned 0 [0057.400] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.mpeg") returned 0 [0057.400] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.mpg") returned 0 [0057.400] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.flv") returned 0 [0057.400] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.avi") returned 0 [0057.400] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.mp4") returned 0 [0057.400] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.wmv") returned 0 [0057.400] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.divx") returned 0 [0057.400] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.mkv") returned 0 [0057.400] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.mp3") returned 0 [0057.400] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.wav") returned 0 [0057.400] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.flac") returned 0 [0057.400] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.ape") returned 0 [0057.400] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.wma") returned 0 [0057.400] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab", pszSpec="*.ac3") returned 0 [0057.400] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6e2413e0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x6e2413e0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x3c312a50, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x103000, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="OSMUXMUI.msi", cAlternateFileName="")) returned 1 [0057.400] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.400] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OSMUXMUI.msi") returned -1 [0057.400] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OSMUXMUI.msi") returned -1 [0057.400] lstrcmpiA (lpString1="", lpString2="OSMUXMUI.msi") returned -1 [0057.400] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab") returned="OSMUXMUI.cab" [0057.400] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\" [0057.400] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\") returned="" [0057.400] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.401] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.zip") returned 0 [0057.401] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.rar") returned 0 [0057.401] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.7z") returned 0 [0057.401] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.tar") returned 0 [0057.401] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.gzip") returned 0 [0057.401] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.jpg") returned 0 [0057.401] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.jpeg") returned 0 [0057.401] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.psd") returned 0 [0057.401] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.cdr") returned 0 [0057.401] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.dwg") returned 0 [0057.401] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.max") returned 0 [0057.401] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.bmp") returned 0 [0057.401] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.gif") returned 0 [0057.401] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.png") returned 0 [0057.401] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.doc") returned 0 [0057.401] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.docx") returned 0 [0057.401] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.xls") returned 0 [0057.401] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.xlsx") returned 0 [0057.401] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.ppt") returned 0 [0057.401] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.pptx") returned 0 [0057.401] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.txt") returned 0 [0057.401] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.pdf") returned 0 [0057.401] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.djvu") returned 0 [0057.402] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.htm") returned 0 [0057.402] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.html") returned 0 [0057.402] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.mdb") returned 0 [0057.402] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.cer") returned 0 [0057.402] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.p12") returned 0 [0057.402] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.pfx") returned 0 [0057.402] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.kwm") returned 0 [0057.402] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.pwm") returned 0 [0057.402] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.1cd") returned 0 [0057.402] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.md") returned 0 [0057.402] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.mdf") returned 0 [0057.402] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.dbf") returned 0 [0057.402] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.odt") returned 0 [0057.402] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.vob") returned 0 [0057.402] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.ifo") returned 0 [0057.402] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.lnk") returned 0 [0057.402] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.torrent") returned 0 [0057.402] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.mov") returned 0 [0057.402] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.m2v") returned 0 [0057.402] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.3gp") returned 0 [0057.402] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.mpeg") returned 0 [0057.402] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.mpg") returned 0 [0057.402] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.flv") returned 0 [0057.402] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.avi") returned 0 [0057.402] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.mp4") returned 0 [0057.403] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.wmv") returned 0 [0057.403] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.divx") returned 0 [0057.403] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.mkv") returned 0 [0057.403] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.mp3") returned 0 [0057.403] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.wav") returned 0 [0057.403] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.flac") returned 0 [0057.403] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.ape") returned 0 [0057.403] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.wma") returned 0 [0057.403] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi", pszSpec="*.ac3") returned 0 [0057.403] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdcfb7a70, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0xdcfb7a70, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0x3c2eb950, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="OSMUXMUI.xml", cAlternateFileName="")) returned 1 [0057.403] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.403] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OSMUXMUI.xml") returned -1 [0057.403] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OSMUXMUI.xml") returned -1 [0057.403] lstrcmpiA (lpString1="", lpString2="OSMUXMUI.xml") returned -1 [0057.403] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.msi") returned="OSMUXMUI.msi" [0057.403] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\" [0057.403] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\") returned="" [0057.403] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.403] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.zip") returned 0 [0057.403] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.rar") returned 0 [0057.403] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.7z") returned 0 [0057.403] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.tar") returned 0 [0057.403] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.gzip") returned 0 [0057.403] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.jpg") returned 0 [0057.403] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.jpeg") returned 0 [0057.404] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.psd") returned 0 [0057.404] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.cdr") returned 0 [0057.404] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.dwg") returned 0 [0057.404] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.max") returned 0 [0057.404] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.bmp") returned 0 [0057.404] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.gif") returned 0 [0057.404] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.png") returned 0 [0057.404] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.doc") returned 0 [0057.404] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.docx") returned 0 [0057.404] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.xls") returned 0 [0057.404] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.xlsx") returned 0 [0057.404] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.ppt") returned 0 [0057.404] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.pptx") returned 0 [0057.404] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.txt") returned 0 [0057.404] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.pdf") returned 0 [0057.404] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.djvu") returned 0 [0057.404] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.htm") returned 0 [0057.404] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.html") returned 0 [0057.404] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.mdb") returned 0 [0057.404] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.cer") returned 0 [0057.404] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.p12") returned 0 [0057.404] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.pfx") returned 0 [0057.404] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.kwm") returned 0 [0057.404] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.pwm") returned 0 [0057.405] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.1cd") returned 0 [0057.405] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.md") returned 0 [0057.405] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.mdf") returned 0 [0057.405] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.dbf") returned 0 [0057.405] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.odt") returned 0 [0057.405] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.vob") returned 0 [0057.405] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.ifo") returned 0 [0057.405] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.lnk") returned 0 [0057.405] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.torrent") returned 0 [0057.405] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.mov") returned 0 [0057.405] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.m2v") returned 0 [0057.405] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.3gp") returned 0 [0057.405] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.mpeg") returned 0 [0057.405] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.mpg") returned 0 [0057.405] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.flv") returned 0 [0057.405] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.avi") returned 0 [0057.405] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.mp4") returned 0 [0057.405] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.wmv") returned 0 [0057.405] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.divx") returned 0 [0057.405] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.mkv") returned 0 [0057.405] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.mp3") returned 0 [0057.405] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.wav") returned 0 [0057.405] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.flac") returned 0 [0057.405] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.ape") returned 0 [0057.405] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.wma") returned 0 [0057.406] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml", pszSpec="*.ac3") returned 0 [0057.406] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42508f00, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x42508f00, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3c3cea20, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x996, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.406] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.406] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.406] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.406] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.406] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml") returned="OSMUXMUI.xml" [0057.406] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\" [0057.406] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\") returned="" [0057.406] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.406] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0 [0057.406] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0 [0057.406] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0 [0057.406] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0 [0057.406] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gzip") returned 0 [0057.406] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0 [0057.406] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0 [0057.406] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0 [0057.406] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cdr") returned 0 [0057.406] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dwg") returned 0 [0057.406] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.max") returned 0 [0057.406] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.bmp") returned 0 [0057.406] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gif") returned 0 [0057.406] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.png") returned 0 [0057.407] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0 [0057.407] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0 [0057.407] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0 [0057.407] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0 [0057.407] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0 [0057.407] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0 [0057.407] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.txt") returned 0 [0057.407] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pdf") returned 0 [0057.407] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.djvu") returned 0 [0057.407] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.htm") returned 0 [0057.407] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.html") returned 0 [0057.407] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mdb") returned 0 [0057.407] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cer") returned 0 [0057.407] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.p12") returned 0 [0057.407] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pfx") returned 0 [0057.407] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.kwm") returned 0 [0057.407] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pwm") returned 0 [0057.407] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.1cd") returned 0 [0057.407] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.md") returned 0 [0057.407] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mdf") returned 0 [0057.407] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dbf") returned 0 [0057.407] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.odt") returned 0 [0057.407] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.vob") returned 0 [0057.407] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ifo") returned 0 [0057.407] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.lnk") returned 0 [0057.408] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.torrent") returned 0 [0057.408] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mov") returned 0 [0057.408] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.m2v") returned 0 [0057.408] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.3gp") returned 0 [0057.408] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpeg") returned 0 [0057.408] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpg") returned 0 [0057.408] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flv") returned 0 [0057.408] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.avi") returned 0 [0057.408] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp4") returned 0 [0057.408] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wmv") returned 0 [0057.408] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.divx") returned 0 [0057.408] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mkv") returned 0 [0057.408] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp3") returned 0 [0057.408] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wav") returned 0 [0057.408] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flac") returned 0 [0057.408] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ape") returned 0 [0057.408] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wma") returned 0 [0057.408] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ac3") returned 0 [0057.409] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42508f00, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x42508f00, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3c3cea20, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x996, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.409] FindClose (in: hFindFile=0x6366f0 | out: hFindFile=0x6366f0) returned 1 [0057.409] FindNextFileA (in: hFindFile=0x636470, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3b67ed24, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c2c6c91, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c2c6c91, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="{90160000-0115-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9AA2F~1")) returned 1 [0057.409] lstrcmpA (lpString1=".", lpString2="{90160000-0115-0409-0000-0000000FF1CE}-C") returned -1 [0057.409] lstrcmpA (lpString1="..", lpString2="{90160000-0115-0409-0000-0000000FF1CE}-C") returned -1 [0057.409] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.409] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90160000-0115-0409-0000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C" [0057.409] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\*.*" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\*.*"), lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3b67ed24, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c2c6c91, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c2c6c91, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x6369f0 [0057.412] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.412] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3b67ed24, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c2c6c91, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c2c6c91, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="..", cAlternateFileName="")) returned 1 [0057.412] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.412] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.412] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2e1e12f0, ftCreationTime.dwHighDateTime=0x1d0ca7d, ftLastAccessTime.dwLowDateTime=0x2e1e12f0, ftLastAccessTime.dwHighDateTime=0x1d0ca7d, ftLastWriteTime.dwLowDateTime=0x3c278d60, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x521b9, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0057.412] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.412] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="branding.xml") returned 1 [0057.412] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="branding.xml") returned 1 [0057.412] lstrcmpiA (lpString1="", lpString2="branding.xml") returned -1 [0057.412] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.412] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" [0057.412] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\") returned="" [0057.412] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.412] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.412] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0057.412] WriteFile (in: hFile=0x1c8, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.414] SetFileTime (hFile=0x1c8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.414] CloseHandle (hObject=0x1c8) returned 1 [0057.414] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\", lpString2="branding.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml" [0057.414] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml", pszSpec="*.zip") returned 0 [0057.414] lstrlenA (lpString="*.zip") returned 5 [0057.414] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml", pszSpec="*.rar") returned 0 [0057.414] lstrlenA (lpString="*.rar") returned 5 [0057.414] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml", pszSpec="*.7z") returned 0 [0057.414] lstrlenA (lpString="*.7z") returned 4 [0057.414] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml", pszSpec="*.tar") returned 0 [0057.414] lstrlenA (lpString="*.tar") returned 5 [0057.414] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml", pszSpec="*.gzip") returned 0 [0057.414] lstrlenA (lpString="*.gzip") returned 6 [0057.414] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml", pszSpec="*.jpg") returned 0 [0057.414] lstrlenA (lpString="*.jpg") returned 5 [0057.414] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml", pszSpec="*.jpeg") returned 0 [0057.414] lstrlenA (lpString="*.jpeg") returned 6 [0057.414] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml", pszSpec="*.psd") returned 0 [0057.414] lstrlenA (lpString="*.psd") returned 5 [0057.414] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml", pszSpec="*.cdr") returned 0 [0057.414] lstrlenA (lpString="*.cdr") returned 5 [0057.414] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml", pszSpec="*.dwg") returned 0 [0057.415] lstrlenA (lpString="*.dwg") returned 5 [0057.415] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml", pszSpec="*.max") returned 0 [0057.415] lstrlenA (lpString="*.max") returned 5 [0057.415] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml", pszSpec="*.bmp") returned 0 [0057.415] lstrlenA (lpString="*.bmp") returned 5 [0057.415] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml", pszSpec="*.gif") returned 0 [0057.415] lstrlenA (lpString="*.gif") returned 5 [0057.415] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml", pszSpec="*.png") returned 0 [0057.415] lstrlenA (lpString="*.png") returned 5 [0057.415] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml", pszSpec="*.doc") returned 0 [0057.415] lstrlenA (lpString="*.doc") returned 5 [0057.415] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml", pszSpec="*.docx") returned 0 [0057.415] lstrlenA (lpString="*.docx") returned 6 [0057.415] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml", pszSpec="*.xls") returned 0 [0057.415] lstrlenA (lpString="*.xls") returned 5 [0057.415] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml", pszSpec="*.xlsx") returned 0 [0057.415] lstrlenA (lpString="*.xlsx") returned 6 [0057.415] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml", pszSpec="*.ppt") returned 0 [0057.415] lstrlenA (lpString="*.ppt") returned 5 [0057.415] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml", pszSpec="*.pptx") returned 0 [0057.415] lstrlenA (lpString="*.pptx") returned 6 [0057.415] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml", pszSpec="*.txt") returned 0 [0057.415] lstrlenA (lpString="*.txt") returned 5 [0057.415] lstrlenA (lpString="*.pdf") returned 5 [0057.415] lstrlenA (lpString="*.djvu") returned 6 [0057.416] lstrlenA (lpString="*.htm") returned 5 [0057.416] lstrlenA (lpString="*.html") returned 6 [0057.416] lstrlenA (lpString="*.mdb") returned 5 [0057.416] lstrlenA (lpString="*.cer") returned 5 [0057.416] lstrlenA (lpString="*.p12") returned 5 [0057.416] lstrlenA (lpString="*.pfx") returned 5 [0057.416] lstrlenA (lpString="*.kwm") returned 5 [0057.416] lstrlenA (lpString="*.pwm") returned 5 [0057.416] lstrlenA (lpString="*.1cd") returned 5 [0057.416] lstrlenA (lpString="*.md") returned 4 [0057.416] lstrlenA (lpString="*.mdf") returned 5 [0057.416] lstrlenA (lpString="*.dbf") returned 5 [0057.416] lstrlenA (lpString="*.odt") returned 5 [0057.416] lstrlenA (lpString="*.vob") returned 5 [0057.416] lstrlenA (lpString="*.ifo") returned 5 [0057.416] lstrlenA (lpString="*.lnk") returned 5 [0057.416] lstrlenA (lpString="*.torrent") returned 9 [0057.416] lstrlenA (lpString="*.mov") returned 5 [0057.416] lstrlenA (lpString="*.m2v") returned 5 [0057.416] lstrlenA (lpString="*.3gp") returned 5 [0057.416] lstrlenA (lpString="*.mpeg") returned 6 [0057.416] lstrlenA (lpString="*.mpg") returned 5 [0057.416] lstrlenA (lpString="*.flv") returned 5 [0057.416] lstrlenA (lpString="*.avi") returned 5 [0057.416] lstrlenA (lpString="*.mp4") returned 5 [0057.416] lstrlenA (lpString="*.wmv") returned 5 [0057.417] lstrlenA (lpString="*.divx") returned 6 [0057.417] lstrlenA (lpString="*.mkv") returned 5 [0057.417] lstrlenA (lpString="*.mp3") returned 5 [0057.417] lstrlenA (lpString="*.wav") returned 5 [0057.417] lstrlenA (lpString="*.flac") returned 6 [0057.417] lstrlenA (lpString="*.ape") returned 5 [0057.417] lstrlenA (lpString="*.wma") returned 5 [0057.417] lstrlenA (lpString="*.ac3") returned 5 [0057.417] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39355420, ftCreationTime.dwHighDateTime=0x1d0cbc0, ftLastAccessTime.dwLowDateTime=0x39355420, ftLastAccessTime.dwHighDateTime=0x1d0cbc0, ftLastWriteTime.dwLowDateTime=0x3b7ad2a0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0xb2a1f2, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0057.417] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.417] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OfficeLR.cab") returned -1 [0057.417] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeLR.cab") returned -1 [0057.417] lstrcmpiA (lpString1="", lpString2="OfficeLR.cab") returned -1 [0057.417] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml") returned="branding.xml" [0057.417] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" [0057.417] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\") returned="" [0057.417] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.417] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.417] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\", lpString2="OfficeLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeLR.cab") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeLR.cab" [0057.417] lstrlenA (lpString="*.zip") returned 5 [0057.417] lstrlenA (lpString="*.rar") returned 5 [0057.417] lstrlenA (lpString="*.7z") returned 4 [0057.417] lstrlenA (lpString="*.tar") returned 5 [0057.417] lstrlenA (lpString="*.gzip") returned 6 [0057.417] lstrlenA (lpString="*.jpg") returned 5 [0057.417] lstrlenA (lpString="*.jpeg") returned 6 [0057.418] lstrlenA (lpString="*.psd") returned 5 [0057.418] lstrlenA (lpString="*.cdr") returned 5 [0057.418] lstrlenA (lpString="*.dwg") returned 5 [0057.418] lstrlenA (lpString="*.max") returned 5 [0057.418] lstrlenA (lpString="*.bmp") returned 5 [0057.418] lstrlenA (lpString="*.gif") returned 5 [0057.418] lstrlenA (lpString="*.png") returned 5 [0057.418] lstrlenA (lpString="*.doc") returned 5 [0057.418] lstrlenA (lpString="*.docx") returned 6 [0057.418] lstrlenA (lpString="*.xls") returned 5 [0057.418] lstrlenA (lpString="*.xlsx") returned 6 [0057.418] lstrlenA (lpString="*.ppt") returned 5 [0057.418] lstrlenA (lpString="*.pptx") returned 6 [0057.418] lstrlenA (lpString="*.txt") returned 5 [0057.418] lstrlenA (lpString="*.pdf") returned 5 [0057.418] lstrlenA (lpString="*.djvu") returned 6 [0057.418] lstrlenA (lpString="*.htm") returned 5 [0057.418] lstrlenA (lpString="*.html") returned 6 [0057.418] lstrlenA (lpString="*.mdb") returned 5 [0057.418] lstrlenA (lpString="*.cer") returned 5 [0057.418] lstrlenA (lpString="*.p12") returned 5 [0057.418] lstrlenA (lpString="*.pfx") returned 5 [0057.418] lstrlenA (lpString="*.kwm") returned 5 [0057.418] lstrlenA (lpString="*.pwm") returned 5 [0057.418] lstrlenA (lpString="*.1cd") returned 5 [0057.418] lstrlenA (lpString="*.md") returned 4 [0057.419] lstrlenA (lpString="*.mdf") returned 5 [0057.419] lstrlenA (lpString="*.dbf") returned 5 [0057.419] lstrlenA (lpString="*.odt") returned 5 [0057.419] lstrlenA (lpString="*.vob") returned 5 [0057.419] lstrlenA (lpString="*.ifo") returned 5 [0057.419] lstrlenA (lpString="*.lnk") returned 5 [0057.419] lstrlenA (lpString="*.torrent") returned 9 [0057.419] lstrlenA (lpString="*.mov") returned 5 [0057.419] lstrlenA (lpString="*.m2v") returned 5 [0057.419] lstrlenA (lpString="*.3gp") returned 5 [0057.419] lstrlenA (lpString="*.mpeg") returned 6 [0057.419] lstrlenA (lpString="*.mpg") returned 5 [0057.419] lstrlenA (lpString="*.flv") returned 5 [0057.419] lstrlenA (lpString="*.avi") returned 5 [0057.419] lstrlenA (lpString="*.mp4") returned 5 [0057.419] lstrlenA (lpString="*.wmv") returned 5 [0057.419] lstrlenA (lpString="*.divx") returned 6 [0057.419] lstrlenA (lpString="*.mkv") returned 5 [0057.419] lstrlenA (lpString="*.mp3") returned 5 [0057.419] lstrlenA (lpString="*.wav") returned 5 [0057.419] lstrlenA (lpString="*.flac") returned 6 [0057.419] lstrlenA (lpString="*.ape") returned 5 [0057.419] lstrlenA (lpString="*.wma") returned 5 [0057.419] lstrlenA (lpString="*.ac3") returned 5 [0057.419] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6cc80650, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x6cc80650, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x3b707260, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x3da000, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0057.420] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.420] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OfficeMUI.msi") returned -1 [0057.420] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeMUI.msi") returned -1 [0057.420] lstrcmpiA (lpString1="", lpString2="OfficeMUI.msi") returned -1 [0057.420] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeLR.cab") returned="OfficeLR.cab" [0057.420] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" [0057.420] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\") returned="" [0057.420] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.420] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.420] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\", lpString2="OfficeMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.msi") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.msi" [0057.420] lstrlenA (lpString="*.zip") returned 5 [0057.420] lstrlenA (lpString="*.rar") returned 5 [0057.420] lstrlenA (lpString="*.7z") returned 4 [0057.420] lstrlenA (lpString="*.tar") returned 5 [0057.420] lstrlenA (lpString="*.gzip") returned 6 [0057.420] lstrlenA (lpString="*.jpg") returned 5 [0057.420] lstrlenA (lpString="*.jpeg") returned 6 [0057.420] lstrlenA (lpString="*.psd") returned 5 [0057.420] lstrlenA (lpString="*.cdr") returned 5 [0057.420] lstrlenA (lpString="*.dwg") returned 5 [0057.420] lstrlenA (lpString="*.max") returned 5 [0057.420] lstrlenA (lpString="*.bmp") returned 5 [0057.420] lstrlenA (lpString="*.gif") returned 5 [0057.420] lstrlenA (lpString="*.png") returned 5 [0057.420] lstrlenA (lpString="*.doc") returned 5 [0057.420] lstrlenA (lpString="*.docx") returned 6 [0057.421] lstrlenA (lpString="*.xls") returned 5 [0057.421] lstrlenA (lpString="*.xlsx") returned 6 [0057.421] lstrlenA (lpString="*.ppt") returned 5 [0057.421] lstrlenA (lpString="*.pptx") returned 6 [0057.421] lstrlenA (lpString="*.txt") returned 5 [0057.421] lstrlenA (lpString="*.pdf") returned 5 [0057.421] lstrlenA (lpString="*.djvu") returned 6 [0057.421] lstrlenA (lpString="*.htm") returned 5 [0057.421] lstrlenA (lpString="*.html") returned 6 [0057.421] lstrlenA (lpString="*.mdb") returned 5 [0057.421] lstrlenA (lpString="*.cer") returned 5 [0057.421] lstrlenA (lpString="*.p12") returned 5 [0057.421] lstrlenA (lpString="*.pfx") returned 5 [0057.421] lstrlenA (lpString="*.kwm") returned 5 [0057.421] lstrlenA (lpString="*.pwm") returned 5 [0057.421] lstrlenA (lpString="*.1cd") returned 5 [0057.421] lstrlenA (lpString="*.md") returned 4 [0057.421] lstrlenA (lpString="*.mdf") returned 5 [0057.421] lstrlenA (lpString="*.dbf") returned 5 [0057.421] lstrlenA (lpString="*.odt") returned 5 [0057.421] lstrlenA (lpString="*.vob") returned 5 [0057.421] lstrlenA (lpString="*.ifo") returned 5 [0057.421] lstrlenA (lpString="*.lnk") returned 5 [0057.421] lstrlenA (lpString="*.torrent") returned 9 [0057.421] lstrlenA (lpString="*.mov") returned 5 [0057.421] lstrlenA (lpString="*.m2v") returned 5 [0057.422] lstrlenA (lpString="*.3gp") returned 5 [0057.422] lstrlenA (lpString="*.mpeg") returned 6 [0057.422] lstrlenA (lpString="*.mpg") returned 5 [0057.422] lstrlenA (lpString="*.flv") returned 5 [0057.422] lstrlenA (lpString="*.avi") returned 5 [0057.422] lstrlenA (lpString="*.mp4") returned 5 [0057.422] lstrlenA (lpString="*.wmv") returned 5 [0057.422] lstrlenA (lpString="*.divx") returned 6 [0057.422] lstrlenA (lpString="*.mkv") returned 5 [0057.422] lstrlenA (lpString="*.mp3") returned 5 [0057.422] lstrlenA (lpString="*.wav") returned 5 [0057.422] lstrlenA (lpString="*.flac") returned 6 [0057.422] lstrlenA (lpString="*.ape") returned 5 [0057.422] lstrlenA (lpString="*.wma") returned 5 [0057.422] lstrlenA (lpString="*.ac3") returned 5 [0057.422] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdbe85560, ftCreationTime.dwHighDateTime=0x1d0cbb5, ftLastAccessTime.dwLowDateTime=0xdbe85560, ftLastAccessTime.dwHighDateTime=0x1d0cbb5, ftLastWriteTime.dwLowDateTime=0x3b6ec4b0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x149b, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0057.422] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.422] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.msi") returned="OfficeMUI.msi" [0057.422] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" [0057.422] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\") returned="" [0057.422] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.422] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.422] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\", lpString2="OfficeMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml" [0057.422] lstrlenA (lpString="*.zip") returned 5 [0057.423] lstrlenA (lpString="*.rar") returned 5 [0057.423] lstrlenA (lpString="*.7z") returned 4 [0057.423] lstrlenA (lpString="*.tar") returned 5 [0057.423] lstrlenA (lpString="*.gzip") returned 6 [0057.423] lstrlenA (lpString="*.jpg") returned 5 [0057.423] lstrlenA (lpString="*.jpeg") returned 6 [0057.423] lstrlenA (lpString="*.psd") returned 5 [0057.423] lstrlenA (lpString="*.cdr") returned 5 [0057.423] lstrlenA (lpString="*.dwg") returned 5 [0057.423] lstrlenA (lpString="*.max") returned 5 [0057.423] lstrlenA (lpString="*.bmp") returned 5 [0057.423] lstrlenA (lpString="*.gif") returned 5 [0057.423] lstrlenA (lpString="*.png") returned 5 [0057.423] lstrlenA (lpString="*.doc") returned 5 [0057.423] lstrlenA (lpString="*.docx") returned 6 [0057.423] lstrlenA (lpString="*.xls") returned 5 [0057.423] lstrlenA (lpString="*.xlsx") returned 6 [0057.423] lstrlenA (lpString="*.ppt") returned 5 [0057.423] lstrlenA (lpString="*.pptx") returned 6 [0057.423] lstrlenA (lpString="*.txt") returned 5 [0057.423] lstrlenA (lpString="*.pdf") returned 5 [0057.423] lstrlenA (lpString="*.djvu") returned 6 [0057.423] lstrlenA (lpString="*.htm") returned 5 [0057.425] lstrlenA (lpString="*.html") returned 6 [0057.425] lstrlenA (lpString="*.mdb") returned 5 [0057.425] lstrlenA (lpString="*.cer") returned 5 [0057.425] lstrlenA (lpString="*.p12") returned 5 [0057.425] lstrlenA (lpString="*.pfx") returned 5 [0057.425] lstrlenA (lpString="*.kwm") returned 5 [0057.425] lstrlenA (lpString="*.pwm") returned 5 [0057.425] lstrlenA (lpString="*.1cd") returned 5 [0057.425] lstrlenA (lpString="*.md") returned 4 [0057.425] lstrlenA (lpString="*.mdf") returned 5 [0057.425] lstrlenA (lpString="*.dbf") returned 5 [0057.425] lstrlenA (lpString="*.odt") returned 5 [0057.425] lstrlenA (lpString="*.vob") returned 5 [0057.425] lstrlenA (lpString="*.ifo") returned 5 [0057.425] lstrlenA (lpString="*.lnk") returned 5 [0057.425] lstrlenA (lpString="*.torrent") returned 9 [0057.425] lstrlenA (lpString="*.mov") returned 5 [0057.425] lstrlenA (lpString="*.m2v") returned 5 [0057.425] lstrlenA (lpString="*.3gp") returned 5 [0057.425] lstrlenA (lpString="*.mpeg") returned 6 [0057.425] lstrlenA (lpString="*.mpg") returned 5 [0057.425] lstrlenA (lpString="*.flv") returned 5 [0057.425] lstrlenA (lpString="*.avi") returned 5 [0057.426] lstrlenA (lpString="*.mp4") returned 5 [0057.426] lstrlenA (lpString="*.wmv") returned 5 [0057.426] lstrlenA (lpString="*.divx") returned 6 [0057.426] lstrlenA (lpString="*.mkv") returned 5 [0057.426] lstrlenA (lpString="*.mp3") returned 5 [0057.426] lstrlenA (lpString="*.wav") returned 5 [0057.426] lstrlenA (lpString="*.flac") returned 6 [0057.426] lstrlenA (lpString="*.ape") returned 5 [0057.426] lstrlenA (lpString="*.wma") returned 5 [0057.426] lstrlenA (lpString="*.ac3") returned 5 [0057.426] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x70035b30, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x70035b30, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x3b6af420, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x103000, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0057.426] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.426] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml") returned="OfficeMUI.xml" [0057.426] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" [0057.426] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\") returned="" [0057.426] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.426] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.426] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\", lpString2="OfficeMUISet.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.msi") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.msi" [0057.426] lstrlenA (lpString="*.zip") returned 5 [0057.426] lstrlenA (lpString="*.rar") returned 5 [0057.426] lstrlenA (lpString="*.7z") returned 4 [0057.426] lstrlenA (lpString="*.tar") returned 5 [0057.426] lstrlenA (lpString="*.gzip") returned 6 [0057.426] lstrlenA (lpString="*.jpg") returned 5 [0057.426] lstrlenA (lpString="*.jpeg") returned 6 [0057.427] lstrlenA (lpString="*.psd") returned 5 [0057.427] lstrlenA (lpString="*.cdr") returned 5 [0057.427] lstrlenA (lpString="*.dwg") returned 5 [0057.427] lstrlenA (lpString="*.max") returned 5 [0057.427] lstrlenA (lpString="*.bmp") returned 5 [0057.427] lstrlenA (lpString="*.gif") returned 5 [0057.427] lstrlenA (lpString="*.png") returned 5 [0057.427] lstrlenA (lpString="*.doc") returned 5 [0057.427] lstrlenA (lpString="*.docx") returned 6 [0057.427] lstrlenA (lpString="*.xls") returned 5 [0057.427] lstrlenA (lpString="*.xlsx") returned 6 [0057.427] lstrlenA (lpString="*.ppt") returned 5 [0057.427] lstrlenA (lpString="*.pptx") returned 6 [0057.427] lstrlenA (lpString="*.txt") returned 5 [0057.427] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x740ab3a0, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0x740ab3a0, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0x3b67e6e0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x408, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0057.427] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.427] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.msi") returned="OfficeMUISet.msi" [0057.427] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" [0057.427] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\") returned="" [0057.427] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.427] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.427] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\", lpString2="OfficeMUISet.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml" [0057.427] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d804480, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x7d804480, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x3b6d6520, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="OffSetLR.cab", cAlternateFileName="")) returned 1 [0057.427] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.428] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml") returned="OfficeMUISet.xml" [0057.428] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" [0057.428] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\") returned="" [0057.428] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.428] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.428] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\", lpString2="OffSetLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OffSetLR.cab") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OffSetLR.cab" [0057.428] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bc55fd0, ftCreationTime.dwHighDateTime=0x1d0cb96, ftLastAccessTime.dwLowDateTime=0x7bc55fd0, ftLastAccessTime.dwHighDateTime=0x1d0cb96, ftLastWriteTime.dwLowDateTime=0x3c29fe60, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x32ac0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0057.428] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.428] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OffSetLR.cab") returned="OffSetLR.cab" [0057.428] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" [0057.428] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\") returned="" [0057.428] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.428] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.428] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\", lpString2="osetupui.dll" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\osetupui.dll") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\osetupui.dll" [0057.428] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7752c460, ftCreationTime.dwHighDateTime=0x1d0990a, ftLastAccessTime.dwLowDateTime=0x7752c460, ftLastAccessTime.dwHighDateTime=0x1d0990a, ftLastWriteTime.dwLowDateTime=0x3c2c4850, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x3906, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0057.428] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.428] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\osetupui.dll") returned="osetupui.dll" [0057.428] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" [0057.428] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\") returned="" [0057.428] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.428] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.428] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\", lpString2="pss10r.chm" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\pss10r.chm") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\pss10r.chm" [0057.429] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x588655b0, ftCreationTime.dwHighDateTime=0x1d0a41d, ftLastAccessTime.dwLowDateTime=0x588655b0, ftLastAccessTime.dwHighDateTime=0x1d0a41d, ftLastWriteTime.dwLowDateTime=0x3c29fe60, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x14366, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0057.429] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.429] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\pss10r.chm") returned="pss10r.chm" [0057.429] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" [0057.429] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\") returned="" [0057.429] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.429] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.429] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\", lpString2="setup.chm" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\setup.chm") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\setup.chm" [0057.429] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41e54a10, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41e54a10, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3c2c4850, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x2123, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.429] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.429] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\setup.chm") returned="setup.chm" [0057.429] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" [0057.429] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\") returned="" [0057.429] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.429] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.429] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml" [0057.429] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5746daf0, ftCreationTime.dwHighDateTime=0x1d0cba8, ftLastAccessTime.dwLowDateTime=0x5746daf0, ftLastAccessTime.dwHighDateTime=0x1d0cba8, ftLastWriteTime.dwLowDateTime=0x3c278d60, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0057.429] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.429] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml") returned="Setup.xml" [0057.429] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" [0057.429] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\") returned="" [0057.429] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.430] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.430] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\", lpString2="ShellUI.MST" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\ShellUI.MST") returned="C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\ShellUI.MST" [0057.430] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5746daf0, ftCreationTime.dwHighDateTime=0x1d0cba8, ftLastAccessTime.dwLowDateTime=0x5746daf0, ftLastAccessTime.dwHighDateTime=0x1d0cba8, ftLastWriteTime.dwLowDateTime=0x3c278d60, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="ShellUI.MST", cAlternateFileName="")) returned 0 [0057.430] FindClose (in: hFindFile=0x6369f0 | out: hFindFile=0x6369f0) returned 1 [0057.430] FindNextFileA (in: hFindFile=0x636470, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x198b0d8f, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x199fa1e7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x199fa1e7, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="{90160000-0116-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90160~1")) returned 1 [0057.430] lstrcmpA (lpString1=".", lpString2="{90160000-0116-0409-1000-0000000FF1CE}-C") returned -1 [0057.430] lstrcmpA (lpString1="..", lpString2="{90160000-0116-0409-1000-0000000FF1CE}-C") returned -1 [0057.430] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.430] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90160000-0116-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C" [0057.430] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\*.*" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\*.*"), lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x198b0d8f, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x199fa1e7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x199fa1e7, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x636870 [0057.437] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.437] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x198b0d8f, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x199fa1e7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x199fa1e7, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="..", cAlternateFileName="")) returned 1 [0057.437] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.437] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.437] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x75c7a4e0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x75c7a4e0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x19948a00, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x12b000, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Office64MUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0057.437] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.437] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.437] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\" [0057.437] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\") returned="" [0057.437] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.437] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.437] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0057.438] WriteFile (in: hFile=0x1c8, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.439] SetFileTime (hFile=0x1c8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.439] CloseHandle (hObject=0x1c8) returned 1 [0057.439] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\", lpString2="Office64MUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi") returned="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi" [0057.439] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.zip") returned 0 [0057.439] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.rar") returned 0 [0057.439] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.7z") returned 0 [0057.440] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.tar") returned 0 [0057.440] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.gzip") returned 0 [0057.440] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.jpg") returned 0 [0057.440] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.jpeg") returned 0 [0057.440] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.psd") returned 0 [0057.440] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.cdr") returned 0 [0057.440] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.dwg") returned 0 [0057.440] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.max") returned 0 [0057.440] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.bmp") returned 0 [0057.440] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.gif") returned 0 [0057.440] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.png") returned 0 [0057.440] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.doc") returned 0 [0057.440] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.docx") returned 0 [0057.440] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.xls") returned 0 [0057.440] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.xlsx") returned 0 [0057.440] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.ppt") returned 0 [0057.440] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.pptx") returned 0 [0057.440] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.txt") returned 0 [0057.440] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.pdf") returned 0 [0057.440] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.djvu") returned 0 [0057.440] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.htm") returned 0 [0057.440] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.html") returned 0 [0057.440] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.mdb") returned 0 [0057.440] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.cer") returned 0 [0057.441] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.p12") returned 0 [0057.441] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.pfx") returned 0 [0057.441] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.kwm") returned 0 [0057.441] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.pwm") returned 0 [0057.441] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.1cd") returned 0 [0057.441] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.md") returned 0 [0057.441] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.mdf") returned 0 [0057.441] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.dbf") returned 0 [0057.441] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.odt") returned 0 [0057.441] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.vob") returned 0 [0057.441] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.ifo") returned 0 [0057.441] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.lnk") returned 0 [0057.441] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.torrent") returned 0 [0057.441] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.mov") returned 0 [0057.441] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.m2v") returned 0 [0057.441] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.3gp") returned 0 [0057.441] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.mpeg") returned 0 [0057.441] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.mpg") returned 0 [0057.441] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.flv") returned 0 [0057.441] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.avi") returned 0 [0057.441] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.mp4") returned 0 [0057.441] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.wmv") returned 0 [0057.441] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.divx") returned 0 [0057.441] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.mkv") returned 0 [0057.442] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.mp3") returned 0 [0057.442] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.wav") returned 0 [0057.442] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.flac") returned 0 [0057.442] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.ape") returned 0 [0057.442] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.wma") returned 0 [0057.442] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi", pszSpec="*.ac3") returned 0 [0057.442] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51246020, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0x51246020, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0x19921900, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x776, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="Office64MUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0057.442] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.442] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Office64MUI.xml") returned -1 [0057.442] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office64MUI.xml") returned -1 [0057.442] lstrcmpiA (lpString1="", lpString2="Office64MUI.xml") returned -1 [0057.442] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.msi") returned="Office64MUI.msi" [0057.442] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\" [0057.442] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\") returned="" [0057.442] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.442] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.442] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\", lpString2="Office64MUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml") returned="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml" [0057.442] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.zip") returned 0 [0057.442] lstrlenA (lpString="*.zip") returned 5 [0057.442] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.rar") returned 0 [0057.442] lstrlenA (lpString="*.rar") returned 5 [0057.442] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.7z") returned 0 [0057.442] lstrlenA (lpString="*.7z") returned 4 [0057.442] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.tar") returned 0 [0057.442] lstrlenA (lpString="*.tar") returned 5 [0057.442] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.gzip") returned 0 [0057.442] lstrlenA (lpString="*.gzip") returned 6 [0057.443] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.jpg") returned 0 [0057.443] lstrlenA (lpString="*.jpg") returned 5 [0057.443] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.jpeg") returned 0 [0057.443] lstrlenA (lpString="*.jpeg") returned 6 [0057.443] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.psd") returned 0 [0057.443] lstrlenA (lpString="*.psd") returned 5 [0057.443] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.cdr") returned 0 [0057.443] lstrlenA (lpString="*.cdr") returned 5 [0057.443] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.dwg") returned 0 [0057.443] lstrlenA (lpString="*.dwg") returned 5 [0057.443] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.max") returned 0 [0057.443] lstrlenA (lpString="*.max") returned 5 [0057.443] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.bmp") returned 0 [0057.443] lstrlenA (lpString="*.bmp") returned 5 [0057.443] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.gif") returned 0 [0057.443] lstrlenA (lpString="*.gif") returned 5 [0057.443] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.png") returned 0 [0057.443] lstrlenA (lpString="*.png") returned 5 [0057.443] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.doc") returned 0 [0057.443] lstrlenA (lpString="*.doc") returned 5 [0057.443] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.docx") returned 0 [0057.443] lstrlenA (lpString="*.docx") returned 6 [0057.443] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.xls") returned 0 [0057.443] lstrlenA (lpString="*.xls") returned 5 [0057.443] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.xlsx") returned 0 [0057.443] lstrlenA (lpString="*.xlsx") returned 6 [0057.443] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.ppt") returned 0 [0057.443] lstrlenA (lpString="*.ppt") returned 5 [0057.443] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.pptx") returned 0 [0057.443] lstrlenA (lpString="*.pptx") returned 6 [0057.443] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.txt") returned 0 [0057.443] lstrlenA (lpString="*.txt") returned 5 [0057.443] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.pdf") returned 0 [0057.443] lstrlenA (lpString="*.pdf") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.djvu") returned 0 [0057.444] lstrlenA (lpString="*.djvu") returned 6 [0057.444] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.htm") returned 0 [0057.444] lstrlenA (lpString="*.htm") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.html") returned 0 [0057.444] lstrlenA (lpString="*.html") returned 6 [0057.444] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.mdb") returned 0 [0057.444] lstrlenA (lpString="*.mdb") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.cer") returned 0 [0057.444] lstrlenA (lpString="*.cer") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.p12") returned 0 [0057.444] lstrlenA (lpString="*.p12") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.pfx") returned 0 [0057.444] lstrlenA (lpString="*.pfx") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.kwm") returned 0 [0057.444] lstrlenA (lpString="*.kwm") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.pwm") returned 0 [0057.444] lstrlenA (lpString="*.pwm") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.1cd") returned 0 [0057.444] lstrlenA (lpString="*.1cd") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.md") returned 0 [0057.444] lstrlenA (lpString="*.md") returned 4 [0057.444] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.mdf") returned 0 [0057.444] lstrlenA (lpString="*.mdf") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.dbf") returned 0 [0057.444] lstrlenA (lpString="*.dbf") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.odt") returned 0 [0057.444] lstrlenA (lpString="*.odt") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.vob") returned 0 [0057.444] lstrlenA (lpString="*.vob") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.ifo") returned 0 [0057.444] lstrlenA (lpString="*.ifo") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.lnk") returned 0 [0057.444] lstrlenA (lpString="*.lnk") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.torrent") returned 0 [0057.445] lstrlenA (lpString="*.torrent") returned 9 [0057.445] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.mov") returned 0 [0057.445] lstrlenA (lpString="*.mov") returned 5 [0057.445] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.m2v") returned 0 [0057.445] lstrlenA (lpString="*.m2v") returned 5 [0057.445] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.3gp") returned 0 [0057.445] lstrlenA (lpString="*.3gp") returned 5 [0057.445] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.mpeg") returned 0 [0057.445] lstrlenA (lpString="*.mpeg") returned 6 [0057.445] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.mpg") returned 0 [0057.445] lstrlenA (lpString="*.mpg") returned 5 [0057.445] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.flv") returned 0 [0057.445] lstrlenA (lpString="*.flv") returned 5 [0057.445] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.avi") returned 0 [0057.445] lstrlenA (lpString="*.avi") returned 5 [0057.445] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.mp4") returned 0 [0057.445] lstrlenA (lpString="*.mp4") returned 5 [0057.446] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.wmv") returned 0 [0057.446] lstrlenA (lpString="*.wmv") returned 5 [0057.446] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.divx") returned 0 [0057.446] lstrlenA (lpString="*.divx") returned 6 [0057.446] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.mkv") returned 0 [0057.446] lstrlenA (lpString="*.mkv") returned 5 [0057.446] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.mp3") returned 0 [0057.446] lstrlenA (lpString="*.mp3") returned 5 [0057.446] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.wav") returned 0 [0057.446] lstrlenA (lpString="*.wav") returned 5 [0057.446] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.flac") returned 0 [0057.446] lstrlenA (lpString="*.flac") returned 6 [0057.446] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.ape") returned 0 [0057.446] lstrlenA (lpString="*.ape") returned 5 [0057.446] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.wma") returned 0 [0057.446] lstrlenA (lpString="*.wma") returned 5 [0057.446] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml", pszSpec="*.ac3") returned 0 [0057.446] lstrlenA (lpString="*.ac3") returned 5 [0057.446] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74e2c320, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x74e2c320, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x198fcf10, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x103000, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Office64MUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0057.446] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.446] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Office64MUISet.msi") returned -1 [0057.446] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office64MUISet.msi") returned -1 [0057.446] lstrcmpiA (lpString1="", lpString2="Office64MUISet.msi") returned -1 [0057.446] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml") returned="Office64MUI.xml" [0057.446] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\" [0057.446] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\") returned="" [0057.446] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.446] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.446] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\", lpString2="Office64MUISet.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi") returned="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi" [0057.446] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.zip") returned 0 [0057.446] lstrlenA (lpString="*.zip") returned 5 [0057.447] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.rar") returned 0 [0057.447] lstrlenA (lpString="*.rar") returned 5 [0057.447] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.7z") returned 0 [0057.447] lstrlenA (lpString="*.7z") returned 4 [0057.447] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.tar") returned 0 [0057.447] lstrlenA (lpString="*.tar") returned 5 [0057.447] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.gzip") returned 0 [0057.447] lstrlenA (lpString="*.gzip") returned 6 [0057.447] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.jpg") returned 0 [0057.447] lstrlenA (lpString="*.jpg") returned 5 [0057.447] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.jpeg") returned 0 [0057.447] lstrlenA (lpString="*.jpeg") returned 6 [0057.447] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.psd") returned 0 [0057.447] lstrlenA (lpString="*.psd") returned 5 [0057.447] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.cdr") returned 0 [0057.447] lstrlenA (lpString="*.cdr") returned 5 [0057.447] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.dwg") returned 0 [0057.447] lstrlenA (lpString="*.dwg") returned 5 [0057.447] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.max") returned 0 [0057.447] lstrlenA (lpString="*.max") returned 5 [0057.447] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.bmp") returned 0 [0057.447] lstrlenA (lpString="*.bmp") returned 5 [0057.447] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.gif") returned 0 [0057.447] lstrlenA (lpString="*.gif") returned 5 [0057.447] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.png") returned 0 [0057.447] lstrlenA (lpString="*.png") returned 5 [0057.447] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.doc") returned 0 [0057.447] lstrlenA (lpString="*.doc") returned 5 [0057.447] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.docx") returned 0 [0057.447] lstrlenA (lpString="*.docx") returned 6 [0057.447] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.xls") returned 0 [0057.447] lstrlenA (lpString="*.xls") returned 5 [0057.447] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.xlsx") returned 0 [0057.447] lstrlenA (lpString="*.xlsx") returned 6 [0057.448] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.ppt") returned 0 [0057.448] lstrlenA (lpString="*.ppt") returned 5 [0057.448] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.pptx") returned 0 [0057.448] lstrlenA (lpString="*.pptx") returned 6 [0057.448] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.txt") returned 0 [0057.448] lstrlenA (lpString="*.txt") returned 5 [0057.448] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.pdf") returned 0 [0057.448] lstrlenA (lpString="*.pdf") returned 5 [0057.448] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.djvu") returned 0 [0057.448] lstrlenA (lpString="*.djvu") returned 6 [0057.448] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.htm") returned 0 [0057.448] lstrlenA (lpString="*.htm") returned 5 [0057.448] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.html") returned 0 [0057.448] lstrlenA (lpString="*.html") returned 6 [0057.448] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.mdb") returned 0 [0057.448] lstrlenA (lpString="*.mdb") returned 5 [0057.448] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.cer") returned 0 [0057.448] lstrlenA (lpString="*.cer") returned 5 [0057.448] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.p12") returned 0 [0057.448] lstrlenA (lpString="*.p12") returned 5 [0057.448] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.pfx") returned 0 [0057.448] lstrlenA (lpString="*.pfx") returned 5 [0057.448] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.kwm") returned 0 [0057.448] lstrlenA (lpString="*.kwm") returned 5 [0057.448] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.pwm") returned 0 [0057.448] lstrlenA (lpString="*.pwm") returned 5 [0057.448] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.1cd") returned 0 [0057.448] lstrlenA (lpString="*.1cd") returned 5 [0057.448] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.md") returned 0 [0057.448] lstrlenA (lpString="*.md") returned 4 [0057.448] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.mdf") returned 0 [0057.448] lstrlenA (lpString="*.mdf") returned 5 [0057.448] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.dbf") returned 0 [0057.448] lstrlenA (lpString="*.dbf") returned 5 [0057.449] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.odt") returned 0 [0057.449] lstrlenA (lpString="*.odt") returned 5 [0057.449] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.vob") returned 0 [0057.449] lstrlenA (lpString="*.vob") returned 5 [0057.449] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.ifo") returned 0 [0057.449] lstrlenA (lpString="*.ifo") returned 5 [0057.449] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.lnk") returned 0 [0057.449] lstrlenA (lpString="*.lnk") returned 5 [0057.449] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.torrent") returned 0 [0057.449] lstrlenA (lpString="*.torrent") returned 9 [0057.449] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.mov") returned 0 [0057.449] lstrlenA (lpString="*.mov") returned 5 [0057.449] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.m2v") returned 0 [0057.449] lstrlenA (lpString="*.m2v") returned 5 [0057.449] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.3gp") returned 0 [0057.449] lstrlenA (lpString="*.3gp") returned 5 [0057.449] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.mpeg") returned 0 [0057.449] lstrlenA (lpString="*.mpeg") returned 6 [0057.449] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.mpg") returned 0 [0057.449] lstrlenA (lpString="*.mpg") returned 5 [0057.449] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.flv") returned 0 [0057.449] lstrlenA (lpString="*.flv") returned 5 [0057.449] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.avi") returned 0 [0057.449] lstrlenA (lpString="*.avi") returned 5 [0057.449] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.mp4") returned 0 [0057.449] lstrlenA (lpString="*.mp4") returned 5 [0057.449] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.wmv") returned 0 [0057.449] lstrlenA (lpString="*.wmv") returned 5 [0057.449] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.divx") returned 0 [0057.449] lstrlenA (lpString="*.divx") returned 6 [0057.449] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.mkv") returned 0 [0057.449] lstrlenA (lpString="*.mkv") returned 5 [0057.449] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.mp3") returned 0 [0057.449] lstrlenA (lpString="*.mp3") returned 5 [0057.450] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.wav") returned 0 [0057.450] lstrlenA (lpString="*.wav") returned 5 [0057.450] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.flac") returned 0 [0057.450] lstrlenA (lpString="*.flac") returned 6 [0057.450] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.ape") returned 0 [0057.450] lstrlenA (lpString="*.ape") returned 5 [0057.450] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.wma") returned 0 [0057.450] lstrlenA (lpString="*.wma") returned 5 [0057.450] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi", pszSpec="*.ac3") returned 0 [0057.450] lstrlenA (lpString="*.ac3") returned 5 [0057.450] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69bb1570, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0x69bb1570, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0x198d5e10, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x40c, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Office64MUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0057.450] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.450] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Office64MUISet.xml") returned -1 [0057.450] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office64MUISet.xml") returned -1 [0057.450] lstrcmpiA (lpString1="", lpString2="Office64MUISet.xml") returned -1 [0057.450] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.msi") returned="Office64MUISet.msi" [0057.450] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\" [0057.450] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\") returned="" [0057.450] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.450] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.450] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\", lpString2="Office64MUISet.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml") returned="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml" [0057.450] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.zip") returned 0 [0057.450] lstrlenA (lpString="*.zip") returned 5 [0057.450] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.rar") returned 0 [0057.451] lstrlenA (lpString="*.rar") returned 5 [0057.451] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.7z") returned 0 [0057.451] lstrlenA (lpString="*.7z") returned 4 [0057.451] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.tar") returned 0 [0057.451] lstrlenA (lpString="*.tar") returned 5 [0057.451] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.gzip") returned 0 [0057.451] lstrlenA (lpString="*.gzip") returned 6 [0057.451] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.jpg") returned 0 [0057.451] lstrlenA (lpString="*.jpg") returned 5 [0057.451] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.jpeg") returned 0 [0057.451] lstrlenA (lpString="*.jpeg") returned 6 [0057.451] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.psd") returned 0 [0057.451] lstrlenA (lpString="*.psd") returned 5 [0057.451] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.cdr") returned 0 [0057.451] lstrlenA (lpString="*.cdr") returned 5 [0057.451] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.dwg") returned 0 [0057.451] lstrlenA (lpString="*.dwg") returned 5 [0057.451] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.max") returned 0 [0057.451] lstrlenA (lpString="*.max") returned 5 [0057.451] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.bmp") returned 0 [0057.451] lstrlenA (lpString="*.bmp") returned 5 [0057.451] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.gif") returned 0 [0057.451] lstrlenA (lpString="*.gif") returned 5 [0057.451] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.png") returned 0 [0057.451] lstrlenA (lpString="*.png") returned 5 [0057.451] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.doc") returned 0 [0057.452] lstrlenA (lpString="*.doc") returned 5 [0057.452] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.docx") returned 0 [0057.452] lstrlenA (lpString="*.docx") returned 6 [0057.452] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.xls") returned 0 [0057.452] lstrlenA (lpString="*.xls") returned 5 [0057.452] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.xlsx") returned 0 [0057.452] lstrlenA (lpString="*.xlsx") returned 6 [0057.452] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.ppt") returned 0 [0057.452] lstrlenA (lpString="*.ppt") returned 5 [0057.452] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.pptx") returned 0 [0057.452] lstrlenA (lpString="*.pptx") returned 6 [0057.452] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.txt") returned 0 [0057.452] lstrlenA (lpString="*.txt") returned 5 [0057.452] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.pdf") returned 0 [0057.452] lstrlenA (lpString="*.pdf") returned 5 [0057.452] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.djvu") returned 0 [0057.452] lstrlenA (lpString="*.djvu") returned 6 [0057.452] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.htm") returned 0 [0057.452] lstrlenA (lpString="*.htm") returned 5 [0057.452] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.html") returned 0 [0057.452] lstrlenA (lpString="*.html") returned 6 [0057.452] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.mdb") returned 0 [0057.452] lstrlenA (lpString="*.mdb") returned 5 [0057.452] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.cer") returned 0 [0057.452] lstrlenA (lpString="*.cer") returned 5 [0057.452] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.p12") returned 0 [0057.453] lstrlenA (lpString="*.p12") returned 5 [0057.453] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.pfx") returned 0 [0057.453] lstrlenA (lpString="*.pfx") returned 5 [0057.453] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.kwm") returned 0 [0057.453] lstrlenA (lpString="*.kwm") returned 5 [0057.453] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.pwm") returned 0 [0057.453] lstrlenA (lpString="*.pwm") returned 5 [0057.453] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.1cd") returned 0 [0057.453] lstrlenA (lpString="*.1cd") returned 5 [0057.453] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.md") returned 0 [0057.453] lstrlenA (lpString="*.md") returned 4 [0057.453] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.mdf") returned 0 [0057.453] lstrlenA (lpString="*.mdf") returned 5 [0057.453] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.dbf") returned 0 [0057.453] lstrlenA (lpString="*.dbf") returned 5 [0057.453] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.odt") returned 0 [0057.453] lstrlenA (lpString="*.odt") returned 5 [0057.453] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.vob") returned 0 [0057.453] lstrlenA (lpString="*.vob") returned 5 [0057.453] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.ifo") returned 0 [0057.453] lstrlenA (lpString="*.ifo") returned 5 [0057.453] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.lnk") returned 0 [0057.453] lstrlenA (lpString="*.lnk") returned 5 [0057.453] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.torrent") returned 0 [0057.454] lstrlenA (lpString="*.torrent") returned 9 [0057.454] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.mov") returned 0 [0057.454] lstrlenA (lpString="*.mov") returned 5 [0057.454] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.m2v") returned 0 [0057.454] lstrlenA (lpString="*.m2v") returned 5 [0057.454] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.3gp") returned 0 [0057.454] lstrlenA (lpString="*.3gp") returned 5 [0057.454] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.mpeg") returned 0 [0057.454] lstrlenA (lpString="*.mpeg") returned 6 [0057.454] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.mpg") returned 0 [0057.454] lstrlenA (lpString="*.mpg") returned 5 [0057.454] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.flv") returned 0 [0057.454] lstrlenA (lpString="*.flv") returned 5 [0057.454] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.avi") returned 0 [0057.454] lstrlenA (lpString="*.avi") returned 5 [0057.454] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.mp4") returned 0 [0057.454] lstrlenA (lpString="*.mp4") returned 5 [0057.454] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.wmv") returned 0 [0057.454] lstrlenA (lpString="*.wmv") returned 5 [0057.454] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.divx") returned 0 [0057.454] lstrlenA (lpString="*.divx") returned 6 [0057.454] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.mkv") returned 0 [0057.454] lstrlenA (lpString="*.mkv") returned 5 [0057.454] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.mp3") returned 0 [0057.454] lstrlenA (lpString="*.mp3") returned 5 [0057.455] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.wav") returned 0 [0057.455] lstrlenA (lpString="*.wav") returned 5 [0057.455] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.flac") returned 0 [0057.455] lstrlenA (lpString="*.flac") returned 6 [0057.455] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.ape") returned 0 [0057.455] lstrlenA (lpString="*.ape") returned 5 [0057.455] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.wma") returned 0 [0057.455] lstrlenA (lpString="*.wma") returned 5 [0057.455] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml", pszSpec="*.ac3") returned 0 [0057.455] lstrlenA (lpString="*.ac3") returned 5 [0057.455] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3791b640, ftCreationTime.dwHighDateTime=0x1d0cbc0, ftLastAccessTime.dwLowDateTime=0x3791b640, ftLastAccessTime.dwHighDateTime=0x1d0cbc0, ftLastWriteTime.dwLowDateTime=0x199b67d0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x1f70a9, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="OWOW64LR.cab", cAlternateFileName="")) returned 1 [0057.455] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.455] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OWOW64LR.cab") returned -1 [0057.456] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OWOW64LR.cab") returned -1 [0057.456] lstrcmpiA (lpString1="", lpString2="OWOW64LR.cab") returned -1 [0057.456] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml") returned="Office64MUISet.xml" [0057.456] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\" [0057.456] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\") returned="" [0057.456] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.456] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.456] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\", lpString2="OWOW64LR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\OWOW64LR.cab") returned="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\OWOW64LR.cab" [0057.456] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\OWOW64LR.cab", pszSpec="*.zip") returned 0 [0057.456] lstrlenA (lpString="*.zip") returned 5 [0057.456] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\OWOW64LR.cab", pszSpec="*.rar") returned 0 [0057.456] lstrlenA (lpString="*.rar") returned 5 [0057.456] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\OWOW64LR.cab", pszSpec="*.7z") returned 0 [0057.456] lstrlenA (lpString="*.7z") returned 4 [0057.456] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\OWOW64LR.cab", pszSpec="*.tar") returned 0 [0057.456] lstrlenA (lpString="*.tar") returned 5 [0057.456] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\OWOW64LR.cab", pszSpec="*.gzip") returned 0 [0057.456] lstrlenA (lpString="*.gzip") returned 6 [0057.456] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\OWOW64LR.cab", pszSpec="*.jpg") returned 0 [0057.456] lstrlenA (lpString="*.jpg") returned 5 [0057.456] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\OWOW64LR.cab", pszSpec="*.jpeg") returned 0 [0057.457] lstrlenA (lpString="*.jpeg") returned 6 [0057.457] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\OWOW64LR.cab", pszSpec="*.psd") returned 0 [0057.457] lstrlenA (lpString="*.psd") returned 5 [0057.457] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\OWOW64LR.cab", pszSpec="*.cdr") returned 0 [0057.457] lstrlenA (lpString="*.cdr") returned 5 [0057.457] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\OWOW64LR.cab", pszSpec="*.dwg") returned 0 [0057.457] lstrlenA (lpString="*.dwg") returned 5 [0057.457] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\OWOW64LR.cab", pszSpec="*.max") returned 0 [0057.457] lstrlenA (lpString="*.max") returned 5 [0057.457] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\OWOW64LR.cab", pszSpec="*.bmp") returned 0 [0057.457] lstrlenA (lpString="*.bmp") returned 5 [0057.457] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\OWOW64LR.cab", pszSpec="*.gif") returned 0 [0057.457] lstrlenA (lpString="*.gif") returned 5 [0057.457] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\OWOW64LR.cab", pszSpec="*.png") returned 0 [0057.457] lstrlenA (lpString="*.png") returned 5 [0057.457] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\OWOW64LR.cab", pszSpec="*.doc") returned 0 [0057.457] lstrlenA (lpString="*.doc") returned 5 [0057.457] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\OWOW64LR.cab", pszSpec="*.docx") returned 0 [0057.457] lstrlenA (lpString="*.docx") returned 6 [0057.457] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\OWOW64LR.cab", pszSpec="*.xls") returned 0 [0057.457] lstrlenA (lpString="*.xls") returned 5 [0057.457] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\OWOW64LR.cab", pszSpec="*.xlsx") returned 0 [0057.457] lstrlenA (lpString="*.xlsx") returned 6 [0057.457] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\OWOW64LR.cab", pszSpec="*.ppt") returned 0 [0057.457] lstrlenA (lpString="*.ppt") returned 5 [0057.457] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\OWOW64LR.cab", pszSpec="*.pptx") returned 0 [0057.458] lstrlenA (lpString="*.pptx") returned 6 [0057.458] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\OWOW64LR.cab", pszSpec="*.txt") returned 0 [0057.458] lstrlenA (lpString="*.txt") returned 5 [0057.458] lstrlenA (lpString="*.pdf") returned 5 [0057.458] lstrlenA (lpString="*.djvu") returned 6 [0057.458] lstrlenA (lpString="*.htm") returned 5 [0057.458] lstrlenA (lpString="*.html") returned 6 [0057.458] lstrlenA (lpString="*.mdb") returned 5 [0057.458] lstrlenA (lpString="*.cer") returned 5 [0057.458] lstrlenA (lpString="*.p12") returned 5 [0057.458] lstrlenA (lpString="*.pfx") returned 5 [0057.458] lstrlenA (lpString="*.kwm") returned 5 [0057.459] lstrlenA (lpString="*.pwm") returned 5 [0057.459] lstrlenA (lpString="*.1cd") returned 5 [0057.459] lstrlenA (lpString="*.md") returned 4 [0057.459] lstrlenA (lpString="*.mdf") returned 5 [0057.459] lstrlenA (lpString="*.dbf") returned 5 [0057.459] lstrlenA (lpString="*.odt") returned 5 [0057.459] lstrlenA (lpString="*.vob") returned 5 [0057.459] lstrlenA (lpString="*.ifo") returned 5 [0057.459] lstrlenA (lpString="*.lnk") returned 5 [0057.459] lstrlenA (lpString="*.torrent") returned 9 [0057.459] lstrlenA (lpString="*.mov") returned 5 [0057.459] lstrlenA (lpString="*.m2v") returned 5 [0057.459] lstrlenA (lpString="*.3gp") returned 5 [0057.459] lstrlenA (lpString="*.mpeg") returned 6 [0057.459] lstrlenA (lpString="*.mpg") returned 5 [0057.459] lstrlenA (lpString="*.flv") returned 5 [0057.459] lstrlenA (lpString="*.avi") returned 5 [0057.459] lstrlenA (lpString="*.mp4") returned 5 [0057.459] lstrlenA (lpString="*.wmv") returned 5 [0057.460] lstrlenA (lpString="*.divx") returned 6 [0057.460] lstrlenA (lpString="*.mkv") returned 5 [0057.460] lstrlenA (lpString="*.mp3") returned 5 [0057.460] lstrlenA (lpString="*.wav") returned 5 [0057.460] lstrlenA (lpString="*.flac") returned 6 [0057.460] lstrlenA (lpString="*.ape") returned 5 [0057.460] lstrlenA (lpString="*.wma") returned 5 [0057.460] lstrlenA (lpString="*.ac3") returned 5 [0057.460] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42258760, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x42258760, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x199fad90, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0xc32, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.460] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.460] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.460] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.460] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.460] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\OWOW64LR.cab") returned="OWOW64LR.cab" [0057.460] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\" [0057.460] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\") returned="" [0057.460] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.460] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.460] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Setup.xml" [0057.461] lstrlenA (lpString="*.zip") returned 5 [0057.461] lstrlenA (lpString="*.rar") returned 5 [0057.461] lstrlenA (lpString="*.7z") returned 4 [0057.461] lstrlenA (lpString="*.tar") returned 5 [0057.461] lstrlenA (lpString="*.gzip") returned 6 [0057.461] lstrlenA (lpString="*.jpg") returned 5 [0057.461] lstrlenA (lpString="*.jpeg") returned 6 [0057.461] lstrlenA (lpString="*.psd") returned 5 [0057.461] lstrlenA (lpString="*.cdr") returned 5 [0057.461] lstrlenA (lpString="*.dwg") returned 5 [0057.461] lstrlenA (lpString="*.max") returned 5 [0057.461] lstrlenA (lpString="*.bmp") returned 5 [0057.461] lstrlenA (lpString="*.gif") returned 5 [0057.461] lstrlenA (lpString="*.png") returned 5 [0057.461] lstrlenA (lpString="*.doc") returned 5 [0057.461] lstrlenA (lpString="*.docx") returned 6 [0057.462] lstrlenA (lpString="*.xls") returned 5 [0057.462] lstrlenA (lpString="*.xlsx") returned 6 [0057.462] lstrlenA (lpString="*.ppt") returned 5 [0057.462] lstrlenA (lpString="*.pptx") returned 6 [0057.462] lstrlenA (lpString="*.txt") returned 5 [0057.462] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42258760, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x42258760, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x199fad90, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0xc32, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.462] FindClose (in: hFindFile=0x636870 | out: hFindFile=0x636870) returned 1 [0057.462] FindNextFileA (in: hFindFile=0x636470, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x39a5db44, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x39bff778, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x39bff778, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="{90160000-0117-0409-0000-0000000FF1CE}-C", cAlternateFileName="{90160~4")) returned 1 [0057.462] lstrcmpA (lpString1=".", lpString2="{90160000-0117-0409-0000-0000000FF1CE}-C") returned -1 [0057.462] lstrcmpA (lpString1="..", lpString2="{90160000-0117-0409-0000-0000000FF1CE}-C") returned -1 [0057.462] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.462] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90160000-0117-0409-0000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C" [0057.462] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\*.*" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\*.*"), lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x39a5db44, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x39bff778, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x39bff778, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x636730 [0057.469] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.469] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x39a5db44, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x39bff778, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x39bff778, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="..", cAlternateFileName="")) returned 1 [0057.469] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.469] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.469] lstrcmpA (lpString1=".", lpString2="Access.en-us") returned -1 [0057.469] lstrcmpA (lpString1="..", lpString2="Access.en-us") returned -1 [0057.469] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.470] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\", lpString2="Access.en-us" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us") returned="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us" [0057.485] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.485] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.485] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.485] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0057.485] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AccessMUI.msi") returned 1 [0057.485] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccessMUI.msi") returned 1 [0057.486] lstrcmpiA (lpString1="", lpString2="AccessMUI.msi") returned -1 [0057.486] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\*.*") returned="*.*" [0057.486] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\") returned="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\" [0057.486] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\") returned="" [0057.486] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" [0057.486] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\how to decrypt files.txt")) returned 0xffffffff [0057.486] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0057.489] SetFileTime (hFile=0x1cc, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.489] CloseHandle (hObject=0x1cc) returned 1 [0057.489] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\", lpString2="AccessMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" [0057.489] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0057.489] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AccessMUI.xml") returned 1 [0057.489] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccessMUI.xml") returned 1 [0057.489] lstrcmpiA (lpString1="", lpString2="AccessMUI.xml") returned -1 [0057.489] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned="AccessMUI.msi" [0057.490] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\") returned="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\" [0057.490] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\") returned="" [0057.490] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" [0057.490] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\how to decrypt files.txt")) returned 0x2020 [0057.490] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\", lpString2="AccessMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" [0057.490] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0057.490] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AccLR.cab") returned 1 [0057.490] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccLR.cab") returned 1 [0057.490] lstrcmpiA (lpString1="", lpString2="AccLR.cab") returned -1 [0057.490] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned="AccessMUI.xml" [0057.490] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\") returned="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\" [0057.490] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\") returned="" [0057.490] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" [0057.490] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\how to decrypt files.txt")) returned 0x2020 [0057.490] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\", lpString2="AccLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" [0057.491] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0057.491] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="branding.xml") returned 1 [0057.491] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="branding.xml") returned 1 [0057.491] lstrcmpiA (lpString1="", lpString2="branding.xml") returned -1 [0057.491] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned="AccLR.cab" [0057.491] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\") returned="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\" [0057.491] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\") returned="" [0057.491] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" [0057.491] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\how to decrypt files.txt")) returned 0x2020 [0057.491] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\", lpString2="branding.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\branding.xml" [0057.491] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.492] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AccessMUISet.msi") returned 1 [0057.492] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccessMUISet.msi") returned 1 [0057.492] lstrcmpiA (lpString1="", lpString2="AccessMUISet.msi") returned -1 [0057.492] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.492] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\" [0057.492] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\") returned="" [0057.492] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.492] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.492] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0057.494] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\", lpString2="AccessMUISet.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.msi") returned="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.msi" [0057.494] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.494] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AccessMUISet.xml") returned 1 [0057.494] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccessMUISet.xml") returned 1 [0057.494] lstrcmpiA (lpString1="", lpString2="AccessMUISet.xml") returned -1 [0057.494] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.msi") returned="AccessMUISet.msi" [0057.494] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\" [0057.494] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\") returned="" [0057.494] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.494] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.494] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\", lpString2="AccessMUISet.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.xml") returned="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.xml" [0057.495] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.495] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.495] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.495] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.495] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.xml") returned="AccessMUISet.xml" [0057.495] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\" [0057.495] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\") returned="" [0057.495] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.495] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.495] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Setup.xml" [0057.495] lstrcmpA (lpString1=".", lpString2="{90160000-012B-0409-0000-0000000FF1CE}-C") returned -1 [0057.495] lstrcmpA (lpString1="..", lpString2="{90160000-012B-0409-0000-0000000FF1CE}-C") returned -1 [0057.495] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.495] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90160000-012B-0409-0000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C" [0057.496] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.496] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.496] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.496] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.496] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LyncMUI.cab") returned -1 [0057.496] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LyncMUI.cab") returned -1 [0057.496] lstrcmpiA (lpString1="", lpString2="LyncMUI.cab") returned -1 [0057.496] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.496] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\" [0057.496] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\") returned="" [0057.496] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.496] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.496] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0057.500] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\", lpString2="LyncMUI.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\LyncMUI.cab") returned="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\LyncMUI.cab" [0057.500] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.500] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LyncMUI.msi") returned -1 [0057.500] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LyncMUI.msi") returned -1 [0057.500] lstrcmpiA (lpString1="", lpString2="LyncMUI.msi") returned -1 [0057.500] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\LyncMUI.cab") returned="LyncMUI.cab" [0057.500] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\" [0057.500] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\") returned="" [0057.500] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.500] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.500] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\", lpString2="LyncMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\LyncMUI.msi") returned="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\LyncMUI.msi" [0057.500] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.500] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LyncMUI.xml") returned -1 [0057.501] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LyncMUI.xml") returned -1 [0057.501] lstrcmpiA (lpString1="", lpString2="LyncMUI.xml") returned -1 [0057.501] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\LyncMUI.msi") returned="LyncMUI.msi" [0057.501] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\" [0057.501] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\") returned="" [0057.501] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.501] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.501] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\", lpString2="LyncMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\LyncMUI.xml") returned="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\LyncMUI.xml" [0057.501] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0057.501] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.501] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.501] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.501] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\LyncMUI.xml") returned="LyncMUI.xml" [0057.501] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\" [0057.501] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\") returned="" [0057.501] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.501] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.501] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml" [0057.502] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0 [0057.502] lstrlenA (lpString="*.zip") returned 5 [0057.502] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0 [0057.502] lstrlenA (lpString="*.rar") returned 5 [0057.502] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0 [0057.502] lstrlenA (lpString="*.7z") returned 4 [0057.502] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0 [0057.502] lstrlenA (lpString="*.tar") returned 5 [0057.502] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gzip") returned 0 [0057.502] lstrlenA (lpString="*.gzip") returned 6 [0057.503] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0 [0057.503] lstrlenA (lpString="*.jpg") returned 5 [0057.503] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0 [0057.503] lstrlenA (lpString="*.jpeg") returned 6 [0057.503] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0 [0057.503] lstrlenA (lpString="*.psd") returned 5 [0057.503] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cdr") returned 0 [0057.503] lstrlenA (lpString="*.cdr") returned 5 [0057.503] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dwg") returned 0 [0057.503] lstrlenA (lpString="*.dwg") returned 5 [0057.503] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.max") returned 0 [0057.503] lstrlenA (lpString="*.max") returned 5 [0057.503] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.bmp") returned 0 [0057.503] lstrlenA (lpString="*.bmp") returned 5 [0057.503] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gif") returned 0 [0057.503] lstrlenA (lpString="*.gif") returned 5 [0057.503] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.png") returned 0 [0057.503] lstrlenA (lpString="*.png") returned 5 [0057.503] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0 [0057.503] lstrlenA (lpString="*.doc") returned 5 [0057.503] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0 [0057.503] lstrlenA (lpString="*.docx") returned 6 [0057.503] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0 [0057.503] lstrlenA (lpString="*.xls") returned 5 [0057.503] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0 [0057.503] lstrlenA (lpString="*.xlsx") returned 6 [0057.503] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0 [0057.504] lstrlenA (lpString="*.ppt") returned 5 [0057.504] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0 [0057.504] lstrlenA (lpString="*.pptx") returned 6 [0057.504] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.txt") returned 0 [0057.504] lstrlenA (lpString="*.txt") returned 5 [0057.504] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pdf") returned 0 [0057.504] lstrlenA (lpString="*.pdf") returned 5 [0057.504] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.djvu") returned 0 [0057.504] lstrlenA (lpString="*.djvu") returned 6 [0057.504] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.htm") returned 0 [0057.504] lstrlenA (lpString="*.htm") returned 5 [0057.504] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.html") returned 0 [0057.504] lstrlenA (lpString="*.html") returned 6 [0057.504] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mdb") returned 0 [0057.504] lstrlenA (lpString="*.mdb") returned 5 [0057.504] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cer") returned 0 [0057.504] lstrlenA (lpString="*.cer") returned 5 [0057.504] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.p12") returned 0 [0057.504] lstrlenA (lpString="*.p12") returned 5 [0057.504] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pfx") returned 0 [0057.504] lstrlenA (lpString="*.pfx") returned 5 [0057.504] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.kwm") returned 0 [0057.504] lstrlenA (lpString="*.kwm") returned 5 [0057.504] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pwm") returned 0 [0057.504] lstrlenA (lpString="*.pwm") returned 5 [0057.504] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.1cd") returned 0 [0057.504] lstrlenA (lpString="*.1cd") returned 5 [0057.504] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.md") returned 0 [0057.505] lstrlenA (lpString="*.md") returned 4 [0057.505] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mdf") returned 0 [0057.505] lstrlenA (lpString="*.mdf") returned 5 [0057.505] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dbf") returned 0 [0057.505] lstrlenA (lpString="*.dbf") returned 5 [0057.505] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.odt") returned 0 [0057.505] lstrlenA (lpString="*.odt") returned 5 [0057.505] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.vob") returned 0 [0057.505] lstrlenA (lpString="*.vob") returned 5 [0057.505] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ifo") returned 0 [0057.505] lstrlenA (lpString="*.ifo") returned 5 [0057.505] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.lnk") returned 0 [0057.505] lstrlenA (lpString="*.lnk") returned 5 [0057.505] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.torrent") returned 0 [0057.505] lstrlenA (lpString="*.torrent") returned 9 [0057.505] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mov") returned 0 [0057.505] lstrlenA (lpString="*.mov") returned 5 [0057.505] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.m2v") returned 0 [0057.505] lstrlenA (lpString="*.m2v") returned 5 [0057.505] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.3gp") returned 0 [0057.505] lstrlenA (lpString="*.3gp") returned 5 [0057.505] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpeg") returned 0 [0057.505] lstrlenA (lpString="*.mpeg") returned 6 [0057.505] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpg") returned 0 [0057.505] lstrlenA (lpString="*.mpg") returned 5 [0057.506] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flv") returned 0 [0057.506] lstrlenA (lpString="*.flv") returned 5 [0057.506] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.avi") returned 0 [0057.506] lstrlenA (lpString="*.avi") returned 5 [0057.506] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp4") returned 0 [0057.506] lstrlenA (lpString="*.mp4") returned 5 [0057.506] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wmv") returned 0 [0057.506] lstrlenA (lpString="*.wmv") returned 5 [0057.506] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.divx") returned 0 [0057.506] lstrlenA (lpString="*.divx") returned 6 [0057.506] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mkv") returned 0 [0057.506] lstrlenA (lpString="*.mkv") returned 5 [0057.506] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp3") returned 0 [0057.506] lstrlenA (lpString="*.mp3") returned 5 [0057.506] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wav") returned 0 [0057.506] lstrlenA (lpString="*.wav") returned 5 [0057.506] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flac") returned 0 [0057.506] lstrlenA (lpString="*.flac") returned 6 [0057.506] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ape") returned 0 [0057.506] lstrlenA (lpString="*.ape") returned 5 [0057.506] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wma") returned 0 [0057.506] lstrlenA (lpString="*.wma") returned 5 [0057.506] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ac3") returned 0 [0057.506] lstrlenA (lpString="*.ac3") returned 5 [0057.507] PeekMessageA (in: lpMsg=0x19fe0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fe0c) returned 0 [0057.507] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pagefile.sys") returned -1 [0057.507] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pagefile.sys") returned -1 [0057.507] lstrcmpiA (lpString1="", lpString2="pagefile.sys") returned -1 [0057.507] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0057.507] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0057.507] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0057.507] lstrcatA (in: lpString1="C:\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\HOW TO DECRYPT FILES.txt") returned="C:\\HOW TO DECRYPT FILES.txt" [0057.507] GetFileAttributesA (lpFileName="C:\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\how to decrypt files.txt")) returned 0x20 [0057.507] lstrcatA (in: lpString1="C:\\", lpString2="pagefile.sys" | out: lpString1="C:\\pagefile.sys") returned="C:\\pagefile.sys" [0057.507] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.zip") returned 0 [0057.507] lstrlenA (lpString="*.zip") returned 5 [0057.507] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.rar") returned 0 [0057.507] lstrlenA (lpString="*.rar") returned 5 [0057.507] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.7z") returned 0 [0057.507] lstrlenA (lpString="*.7z") returned 4 [0057.507] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.tar") returned 0 [0057.508] lstrlenA (lpString="*.tar") returned 5 [0057.508] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.gzip") returned 0 [0057.508] lstrlenA (lpString="*.gzip") returned 6 [0057.508] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.jpg") returned 0 [0057.508] lstrlenA (lpString="*.jpg") returned 5 [0057.508] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.jpeg") returned 0 [0057.508] lstrlenA (lpString="*.jpeg") returned 6 [0057.508] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.psd") returned 0 [0057.508] lstrlenA (lpString="*.psd") returned 5 [0057.508] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.cdr") returned 0 [0057.508] lstrlenA (lpString="*.cdr") returned 5 [0057.508] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.dwg") returned 0 [0057.508] lstrlenA (lpString="*.dwg") returned 5 [0057.508] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.max") returned 0 [0057.508] lstrlenA (lpString="*.max") returned 5 [0057.508] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.bmp") returned 0 [0057.508] lstrlenA (lpString="*.bmp") returned 5 [0057.508] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.gif") returned 0 [0057.508] lstrlenA (lpString="*.gif") returned 5 [0057.508] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.png") returned 0 [0057.508] lstrlenA (lpString="*.png") returned 5 [0057.508] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.doc") returned 0 [0057.508] lstrlenA (lpString="*.doc") returned 5 [0057.508] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.docx") returned 0 [0057.508] lstrlenA (lpString="*.docx") returned 6 [0057.508] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.xls") returned 0 [0057.508] lstrlenA (lpString="*.xls") returned 5 [0057.509] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.xlsx") returned 0 [0057.509] lstrlenA (lpString="*.xlsx") returned 6 [0057.509] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.ppt") returned 0 [0057.509] lstrlenA (lpString="*.ppt") returned 5 [0057.509] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.pptx") returned 0 [0057.509] lstrlenA (lpString="*.pptx") returned 6 [0057.509] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.txt") returned 0 [0057.509] lstrlenA (lpString="*.txt") returned 5 [0057.509] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.pdf") returned 0 [0057.509] lstrlenA (lpString="*.pdf") returned 5 [0057.509] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.djvu") returned 0 [0057.509] lstrlenA (lpString="*.djvu") returned 6 [0057.509] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.htm") returned 0 [0057.509] lstrlenA (lpString="*.htm") returned 5 [0057.509] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.html") returned 0 [0057.509] lstrlenA (lpString="*.html") returned 6 [0057.509] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.mdb") returned 0 [0057.509] lstrlenA (lpString="*.mdb") returned 5 [0057.509] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.cer") returned 0 [0057.509] lstrlenA (lpString="*.cer") returned 5 [0057.509] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.p12") returned 0 [0057.509] lstrlenA (lpString="*.p12") returned 5 [0057.509] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.pfx") returned 0 [0057.509] lstrlenA (lpString="*.pfx") returned 5 [0057.509] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.kwm") returned 0 [0057.510] lstrlenA (lpString="*.kwm") returned 5 [0057.510] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.pwm") returned 0 [0057.510] lstrlenA (lpString="*.pwm") returned 5 [0057.510] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.1cd") returned 0 [0057.510] lstrlenA (lpString="*.1cd") returned 5 [0057.510] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.md") returned 0 [0057.510] lstrlenA (lpString="*.md") returned 4 [0057.510] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.mdf") returned 0 [0057.510] lstrlenA (lpString="*.mdf") returned 5 [0057.510] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.dbf") returned 0 [0057.510] lstrlenA (lpString="*.dbf") returned 5 [0057.510] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.odt") returned 0 [0057.510] lstrlenA (lpString="*.odt") returned 5 [0057.510] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.vob") returned 0 [0057.510] lstrlenA (lpString="*.vob") returned 5 [0057.510] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.ifo") returned 0 [0057.510] lstrlenA (lpString="*.ifo") returned 5 [0057.510] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.lnk") returned 0 [0057.510] lstrlenA (lpString="*.lnk") returned 5 [0057.510] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.torrent") returned 0 [0057.510] lstrlenA (lpString="*.torrent") returned 9 [0057.510] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.mov") returned 0 [0057.510] lstrlenA (lpString="*.mov") returned 5 [0057.510] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.m2v") returned 0 [0057.510] lstrlenA (lpString="*.m2v") returned 5 [0057.510] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.3gp") returned 0 [0057.510] lstrlenA (lpString="*.3gp") returned 5 [0057.511] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.mpeg") returned 0 [0057.511] lstrlenA (lpString="*.mpeg") returned 6 [0057.511] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.mpg") returned 0 [0057.511] lstrlenA (lpString="*.mpg") returned 5 [0057.511] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.flv") returned 0 [0057.511] lstrlenA (lpString="*.flv") returned 5 [0057.511] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.avi") returned 0 [0057.511] lstrlenA (lpString="*.avi") returned 5 [0057.511] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.mp4") returned 0 [0057.511] lstrlenA (lpString="*.mp4") returned 5 [0057.511] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.wmv") returned 0 [0057.511] lstrlenA (lpString="*.wmv") returned 5 [0057.511] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.divx") returned 0 [0057.511] lstrlenA (lpString="*.divx") returned 6 [0057.511] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.mkv") returned 0 [0057.511] lstrlenA (lpString="*.mkv") returned 5 [0057.511] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.mp3") returned 0 [0057.511] lstrlenA (lpString="*.mp3") returned 5 [0057.511] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.wav") returned 0 [0057.511] lstrlenA (lpString="*.wav") returned 5 [0057.511] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.flac") returned 0 [0057.511] lstrlenA (lpString="*.flac") returned 6 [0057.511] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.ape") returned 0 [0057.511] lstrlenA (lpString="*.ape") returned 5 [0057.511] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.wma") returned 0 [0057.511] lstrlenA (lpString="*.wma") returned 5 [0057.511] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.ac3") returned 0 [0057.512] lstrlenA (lpString="*.ac3") returned 5 [0057.512] lstrcmpA (lpString1=".", lpString2="PerfLogs") returned -1 [0057.512] lstrcmpA (lpString1="..", lpString2="PerfLogs") returned -1 [0057.512] PathFindFileNameA (pszPath="C:\\pagefile.sys") returned="pagefile.sys" [0057.512] lstrcatA (in: lpString1="C:\\", lpString2="PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0057.512] lstrlenA (lpString="C:\\PerfLogs") returned 11 [0057.512] FindFirstFileA (in: lpFileName="C:\\PerfLogs\\*.*" (normalized: "c:\\perflogs\\*.*"), lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0x40, cFileName=".", cAlternateFileName="")) returned 0x636930 [0057.512] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.512] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.512] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.512] lstrcmpA (lpString1=".", lpString2="Program Files") returned -1 [0057.512] lstrcmpA (lpString1="..", lpString2="Program Files") returned -1 [0057.512] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0057.513] lstrcatA (in: lpString1="C:\\", lpString2="Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0057.513] lstrlenA (lpString="C:\\Program Files") returned 16 [0057.513] FindFirstFileA (in: lpFileName="C:\\Program Files\\*.*" (normalized: "c:\\program files\\*.*"), lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x791110ff, ftLastAccessTime.dwHighDateTime=0x1d8c12e, ftLastWriteTime.dwLowDateTime=0x791110ff, ftLastWriteTime.dwHighDateTime=0x1d8c12e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0x40, cFileName=".", cAlternateFileName="")) returned 0x636770 [0057.513] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.513] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.513] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.513] lstrcmpA (lpString1=".", lpString2="Common Files") returned -1 [0057.513] lstrcmpA (lpString1="..", lpString2="Common Files") returned -1 [0057.513] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*" [0057.513] lstrcatA (in: lpString1="C:\\Program Files\\", lpString2="Common Files" | out: lpString1="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0057.513] lstrlenA (lpString="C:\\Program Files\\Common Files") returned 29 [0057.513] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\*.*" (normalized: "c:\\program files\\common files\\*.*"), lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x6e7d0b13, ftLastAccessTime.dwHighDateTime=0x1d8c12e, ftLastWriteTime.dwLowDateTime=0x6e7d0b13, ftLastWriteTime.dwHighDateTime=0x1d8c12e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63f868, dwReserved1=0x63f860, cFileName=".", cAlternateFileName="")) returned 0x636630 [0057.513] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.514] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.514] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.514] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0057.514] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="7sWoUdl2wk.gif") returned 1 [0057.514] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7sWoUdl2wk.gif") returned 1 [0057.514] lstrcmpiA (lpString1="", lpString2="7sWoUdl2wk.gif") returned -1 [0057.514] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\*.*") returned="*.*" [0057.514] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\" | out: lpString1="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0057.514] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\" | out: pszPath="C:\\Program Files\\Common Files\\") returned="" [0057.514] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\HOW TO DECRYPT FILES.txt" [0057.514] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\how to decrypt files.txt")) returned 0xffffffff [0057.514] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0057.514] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.515] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.516] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.516] CloseHandle (hObject=0x1c4) returned 1 [0057.516] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\", lpString2="7sWoUdl2wk.gif" | out: lpString1="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif") returned="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif" [0057.516] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif", pszSpec="*.zip") returned 0 [0057.517] lstrlenA (lpString="*.zip") returned 5 [0057.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif", pszSpec="*.rar") returned 0 [0057.517] lstrlenA (lpString="*.rar") returned 5 [0057.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif", pszSpec="*.7z") returned 0 [0057.517] lstrlenA (lpString="*.7z") returned 4 [0057.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif", pszSpec="*.tar") returned 0 [0057.517] lstrlenA (lpString="*.tar") returned 5 [0057.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif", pszSpec="*.gzip") returned 0 [0057.517] lstrlenA (lpString="*.gzip") returned 6 [0057.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif", pszSpec="*.jpg") returned 0 [0057.517] lstrlenA (lpString="*.jpg") returned 5 [0057.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif", pszSpec="*.jpeg") returned 0 [0057.517] lstrlenA (lpString="*.jpeg") returned 6 [0057.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif", pszSpec="*.psd") returned 0 [0057.517] lstrlenA (lpString="*.psd") returned 5 [0057.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif", pszSpec="*.cdr") returned 0 [0057.517] lstrlenA (lpString="*.cdr") returned 5 [0057.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif", pszSpec="*.dwg") returned 0 [0057.518] lstrlenA (lpString="*.dwg") returned 5 [0057.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif", pszSpec="*.max") returned 0 [0057.518] lstrlenA (lpString="*.max") returned 5 [0057.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif", pszSpec="*.bmp") returned 0 [0057.518] lstrlenA (lpString="*.bmp") returned 5 [0057.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif", pszSpec="*.gif") returned 1 [0057.518] lstrlenA (lpString="*.gif") returned 5 [0057.518] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif" | out: lpString1="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif") returned="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif" [0057.518] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif" | out: lpString1="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif") returned="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif" [0057.518] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif.") returned="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif." [0057.518] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif.", lpString2="BD" | out: lpString1="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif.BD") returned="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif.BD" [0057.518] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif" (normalized: "c:\\program files\\common files\\7swoudl2wk.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0057.518] GetFileSize (in: hFile=0x1c4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1035e [0057.518] GetFileTime (in: hFile=0x1c4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bd64020, dwHighDateTime=0x1d8b986), lpLastAccessTime=0x407536*(dwLowDateTime=0x49b40160, dwHighDateTime=0x1d8bb24), lpLastWriteTime=0x40753e*(dwLowDateTime=0x49b40160, dwHighDateTime=0x1d8bb24)) returned 1 [0057.519] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0057.519] ReadFile (in: hFile=0x1c4, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x10302, lpOverlapped=0x0) returned 1 [0057.558] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif") returned="7sWoUdl2wk.gif" [0057.560] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0057.560] WriteFile (in: hFile=0x1c4, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x10302, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x10302, lpOverlapped=0x0) returned 1 [0057.561] SetFileTime (hFile=0x1c4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0057.561] CloseHandle (hObject=0x1c4) returned 1 [0057.564] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif" (normalized: "c:\\program files\\common files\\7swoudl2wk.gif"), lpNewFileName="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif.BD" (normalized: "c:\\program files\\common files\\7swoudl2wk.gif.bd")) returned 1 [0057.565] FindNextFileA (in: hFindFile=0x636630, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99be4890, ftCreationTime.dwHighDateTime=0x1d8c02f, ftLastAccessTime.dwLowDateTime=0xee4b1530, ftLastAccessTime.dwHighDateTime=0x1d8c059, ftLastWriteTime.dwLowDateTime=0xee4b1530, ftLastWriteTime.dwHighDateTime=0x1d8c059, nFileSizeHigh=0x0, nFileSizeLow=0x11848, dwReserved0=0x0, dwReserved1=0x0, cFileName="8FKeQdlN0Z.gif", cAlternateFileName="8FKEQD~1.GIF")) returned 1 [0057.565] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0057.565] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="8FKeQdlN0Z.gif") returned 1 [0057.565] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8FKeQdlN0Z.gif") returned 1 [0057.565] lstrcmpiA (lpString1="", lpString2="8FKeQdlN0Z.gif") returned -1 [0057.566] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\7sWoUdl2wk.gif") returned="7sWoUdl2wk.gif" [0057.566] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\" | out: lpString1="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0057.566] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\" | out: pszPath="C:\\Program Files\\Common Files\\") returned="" [0057.566] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\HOW TO DECRYPT FILES.txt" [0057.566] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\how to decrypt files.txt")) returned 0x20 [0057.566] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\", lpString2="8FKeQdlN0Z.gif" | out: lpString1="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif") returned="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif" [0057.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif", pszSpec="*.zip") returned 0 [0057.566] lstrlenA (lpString="*.zip") returned 5 [0057.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif", pszSpec="*.rar") returned 0 [0057.566] lstrlenA (lpString="*.rar") returned 5 [0057.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif", pszSpec="*.7z") returned 0 [0057.566] lstrlenA (lpString="*.7z") returned 4 [0057.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif", pszSpec="*.tar") returned 0 [0057.566] lstrlenA (lpString="*.tar") returned 5 [0057.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif", pszSpec="*.gzip") returned 0 [0057.566] lstrlenA (lpString="*.gzip") returned 6 [0057.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif", pszSpec="*.jpg") returned 0 [0057.566] lstrlenA (lpString="*.jpg") returned 5 [0057.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif", pszSpec="*.jpeg") returned 0 [0057.566] lstrlenA (lpString="*.jpeg") returned 6 [0057.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif", pszSpec="*.psd") returned 0 [0057.566] lstrlenA (lpString="*.psd") returned 5 [0057.567] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif", pszSpec="*.cdr") returned 0 [0057.567] lstrlenA (lpString="*.cdr") returned 5 [0057.567] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif", pszSpec="*.dwg") returned 0 [0057.567] lstrlenA (lpString="*.dwg") returned 5 [0057.567] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif", pszSpec="*.max") returned 0 [0057.567] lstrlenA (lpString="*.max") returned 5 [0057.567] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif", pszSpec="*.bmp") returned 0 [0057.567] lstrlenA (lpString="*.bmp") returned 5 [0057.567] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif", pszSpec="*.gif") returned 1 [0057.567] lstrlenA (lpString="*.gif") returned 5 [0057.567] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif" | out: lpString1="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif") returned="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif" [0057.567] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif" | out: lpString1="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif") returned="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif" [0057.567] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif.") returned="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif." [0057.567] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif.", lpString2="BD" | out: lpString1="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif.BD") returned="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif.BD" [0057.567] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif" (normalized: "c:\\program files\\common files\\8fkeqdln0z.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0057.567] GetFileSize (in: hFile=0x1c4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11848 [0057.567] GetFileTime (in: hFile=0x1c4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x99be4890, dwHighDateTime=0x1d8c02f), lpLastAccessTime=0x407536*(dwLowDateTime=0xee4b1530, dwHighDateTime=0x1d8c059), lpLastWriteTime=0x40753e*(dwLowDateTime=0xee4b1530, dwHighDateTime=0x1d8c059)) returned 1 [0057.567] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0057.567] ReadFile (in: hFile=0x1c4, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x117ec, lpOverlapped=0x0) returned 1 [0057.568] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif") returned="8FKeQdlN0Z.gif" [0057.571] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0057.571] WriteFile (in: hFile=0x1c4, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x117ec, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x117ec, lpOverlapped=0x0) returned 1 [0057.571] SetFileTime (hFile=0x1c4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0057.571] CloseHandle (hObject=0x1c4) returned 1 [0057.574] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif" (normalized: "c:\\program files\\common files\\8fkeqdln0z.gif"), lpNewFileName="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif.BD" (normalized: "c:\\program files\\common files\\8fkeqdln0z.gif.bd")) returned 1 [0057.575] FindNextFileA (in: hFindFile=0x636630, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x44f868e4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x44f868e4, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0057.575] lstrcmpA (lpString1=".", lpString2="microsoft shared") returned -1 [0057.575] lstrcmpA (lpString1="..", lpString2="microsoft shared") returned -1 [0057.575] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\8FKeQdlN0Z.gif") returned="8FKeQdlN0Z.gif" [0057.575] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\", lpString2="microsoft shared" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared") returned="C:\\Program Files\\Common Files\\microsoft shared" [0057.575] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared") returned 46 [0057.575] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\*.*"), lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x44f868e4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x44f868e4, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20006e, dwReserved1=0x690046, cFileName=".", cAlternateFileName="")) returned 0x6366f0 [0057.576] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.576] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x44f868e4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x44f868e4, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20006e, dwReserved1=0x690046, cFileName="..", cAlternateFileName="")) returned 1 [0057.576] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.576] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.576] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1978a8ad, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xfdd338a3, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xfdd338a3, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20006e, dwReserved1=0x690046, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0057.576] lstrcmpA (lpString1=".", lpString2="ClickToRun") returned -1 [0057.576] lstrcmpA (lpString1="..", lpString2="ClickToRun") returned -1 [0057.576] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\*.*") returned="*.*" [0057.576] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\", lpString2="ClickToRun" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun" [0057.576] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun") returned 57 [0057.576] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\*.*"), lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1978a8ad, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xfdd338a3, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xfdd338a3, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x641878, dwReserved1=0x641870, cFileName=".", cAlternateFileName="")) returned 0x636ab0 [0057.576] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.576] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1978a8ad, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xfdd338a3, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xfdd338a3, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x641878, dwReserved1=0x641870, cFileName="..", cAlternateFileName="")) returned 1 [0057.577] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.577] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.577] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1978a8ad, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xfdd338a3, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xfdd338a3, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x641878, dwReserved1=0x641870, cFileName="..", cAlternateFileName="")) returned 0 [0057.577] FindClose (in: hFindFile=0x636ab0 | out: hFindFile=0x636ab0) returned 1 [0057.577] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44f868e4, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x45413013, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x45413013, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20006e, dwReserved1=0x690046, cFileName="Filters", cAlternateFileName="")) returned 1 [0057.577] lstrcmpA (lpString1=".", lpString2="Filters") returned -1 [0057.577] lstrcmpA (lpString1="..", lpString2="Filters") returned -1 [0057.577] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\*.*") returned="*.*" [0057.577] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\", lpString2="Filters" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Filters") returned="C:\\Program Files\\Common Files\\microsoft shared\\Filters" [0057.577] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Filters") returned 54 [0057.577] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\*.*"), lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44f868e4, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x45413013, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x4554e7c7, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x641878, dwReserved1=0x641870, cFileName=".", cAlternateFileName="")) returned 0x636b30 [0057.586] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.586] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44f868e4, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x45413013, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x4554e7c7, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x641878, dwReserved1=0x641870, cFileName="..", cAlternateFileName="")) returned 1 [0057.586] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.586] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.586] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x261ab200, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x45079efa, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x261ab200, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0xa6b8, dwReserved0=0x641878, dwReserved1=0x641870, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0057.586] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0057.586] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msgfilt.dll") returned -1 [0057.586] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msgfilt.dll") returned -1 [0057.586] lstrcmpiA (lpString1="", lpString2="msgfilt.dll") returned -1 [0057.586] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\*.*") returned="*.*" [0057.586] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\" [0057.586] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\") returned="" [0057.586] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\HOW TO DECRYPT FILES.txt" [0057.586] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\how to decrypt files.txt")) returned 0xffffffff [0057.586] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0057.587] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.587] WriteFile (in: hFile=0x1cc, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.588] SetFileTime (hFile=0x1cc, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.588] CloseHandle (hObject=0x1cc) returned 1 [0057.589] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\", lpString2="msgfilt.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll" [0057.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.zip") returned 0 [0057.589] lstrlenA (lpString="*.zip") returned 5 [0057.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.rar") returned 0 [0057.589] lstrlenA (lpString="*.rar") returned 5 [0057.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.7z") returned 0 [0057.589] lstrlenA (lpString="*.7z") returned 4 [0057.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.tar") returned 0 [0057.589] lstrlenA (lpString="*.tar") returned 5 [0057.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.gzip") returned 0 [0057.589] lstrlenA (lpString="*.gzip") returned 6 [0057.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.jpg") returned 0 [0057.589] lstrlenA (lpString="*.jpg") returned 5 [0057.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.jpeg") returned 0 [0057.589] lstrlenA (lpString="*.jpeg") returned 6 [0057.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.psd") returned 0 [0057.589] lstrlenA (lpString="*.psd") returned 5 [0057.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.cdr") returned 0 [0057.589] lstrlenA (lpString="*.cdr") returned 5 [0057.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.dwg") returned 0 [0057.589] lstrlenA (lpString="*.dwg") returned 5 [0057.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.max") returned 0 [0057.589] lstrlenA (lpString="*.max") returned 5 [0057.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.bmp") returned 0 [0057.590] lstrlenA (lpString="*.bmp") returned 5 [0057.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.gif") returned 0 [0057.590] lstrlenA (lpString="*.gif") returned 5 [0057.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.png") returned 0 [0057.590] lstrlenA (lpString="*.png") returned 5 [0057.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.doc") returned 0 [0057.590] lstrlenA (lpString="*.doc") returned 5 [0057.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.docx") returned 0 [0057.590] lstrlenA (lpString="*.docx") returned 6 [0057.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.xls") returned 0 [0057.590] lstrlenA (lpString="*.xls") returned 5 [0057.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.xlsx") returned 0 [0057.590] lstrlenA (lpString="*.xlsx") returned 6 [0057.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.ppt") returned 0 [0057.590] lstrlenA (lpString="*.ppt") returned 5 [0057.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.pptx") returned 0 [0057.590] lstrlenA (lpString="*.pptx") returned 6 [0057.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.txt") returned 0 [0057.590] lstrlenA (lpString="*.txt") returned 5 [0057.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.pdf") returned 0 [0057.590] lstrlenA (lpString="*.pdf") returned 5 [0057.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.djvu") returned 0 [0057.590] lstrlenA (lpString="*.djvu") returned 6 [0057.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.htm") returned 0 [0057.590] lstrlenA (lpString="*.htm") returned 5 [0057.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.html") returned 0 [0057.591] lstrlenA (lpString="*.html") returned 6 [0057.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.mdb") returned 0 [0057.591] lstrlenA (lpString="*.mdb") returned 5 [0057.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.cer") returned 0 [0057.591] lstrlenA (lpString="*.cer") returned 5 [0057.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.p12") returned 0 [0057.591] lstrlenA (lpString="*.p12") returned 5 [0057.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.pfx") returned 0 [0057.591] lstrlenA (lpString="*.pfx") returned 5 [0057.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.kwm") returned 0 [0057.591] lstrlenA (lpString="*.kwm") returned 5 [0057.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.pwm") returned 0 [0057.591] lstrlenA (lpString="*.pwm") returned 5 [0057.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.1cd") returned 0 [0057.591] lstrlenA (lpString="*.1cd") returned 5 [0057.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.md") returned 0 [0057.591] lstrlenA (lpString="*.md") returned 4 [0057.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.mdf") returned 0 [0057.591] lstrlenA (lpString="*.mdf") returned 5 [0057.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.dbf") returned 0 [0057.591] lstrlenA (lpString="*.dbf") returned 5 [0057.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.odt") returned 0 [0057.591] lstrlenA (lpString="*.odt") returned 5 [0057.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.vob") returned 0 [0057.591] lstrlenA (lpString="*.vob") returned 5 [0057.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.ifo") returned 0 [0057.592] lstrlenA (lpString="*.ifo") returned 5 [0057.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.lnk") returned 0 [0057.592] lstrlenA (lpString="*.lnk") returned 5 [0057.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.torrent") returned 0 [0057.592] lstrlenA (lpString="*.torrent") returned 9 [0057.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.mov") returned 0 [0057.592] lstrlenA (lpString="*.mov") returned 5 [0057.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.m2v") returned 0 [0057.592] lstrlenA (lpString="*.m2v") returned 5 [0057.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.3gp") returned 0 [0057.592] lstrlenA (lpString="*.3gp") returned 5 [0057.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.mpeg") returned 0 [0057.592] lstrlenA (lpString="*.mpeg") returned 6 [0057.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.mpg") returned 0 [0057.592] lstrlenA (lpString="*.mpg") returned 5 [0057.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.flv") returned 0 [0057.592] lstrlenA (lpString="*.flv") returned 5 [0057.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.avi") returned 0 [0057.592] lstrlenA (lpString="*.avi") returned 5 [0057.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.mp4") returned 0 [0057.592] lstrlenA (lpString="*.mp4") returned 5 [0057.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.wmv") returned 0 [0057.592] lstrlenA (lpString="*.wmv") returned 5 [0057.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.divx") returned 0 [0057.592] lstrlenA (lpString="*.divx") returned 6 [0057.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.mkv") returned 0 [0057.592] lstrlenA (lpString="*.mkv") returned 5 [0057.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.mp3") returned 0 [0057.593] lstrlenA (lpString="*.mp3") returned 5 [0057.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.wav") returned 0 [0057.593] lstrlenA (lpString="*.wav") returned 5 [0057.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.flac") returned 0 [0057.593] lstrlenA (lpString="*.flac") returned 6 [0057.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.ape") returned 0 [0057.593] lstrlenA (lpString="*.ape") returned 5 [0057.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.wma") returned 0 [0057.593] lstrlenA (lpString="*.wma") returned 5 [0057.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll", pszSpec="*.ac3") returned 0 [0057.593] lstrlenA (lpString="*.ac3") returned 5 [0057.593] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x261ab200, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x4540e200, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x261ab200, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x13aed8, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0057.593] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0057.593] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="odffilt.dll") returned -1 [0057.593] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="odffilt.dll") returned -1 [0057.593] lstrcmpiA (lpString1="", lpString2="odffilt.dll") returned -1 [0057.593] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\msgfilt.dll") returned="msgfilt.dll" [0057.593] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\" [0057.593] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\") returned="" [0057.593] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\HOW TO DECRYPT FILES.txt" [0057.593] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\how to decrypt files.txt")) returned 0x20 [0057.593] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\", lpString2="odffilt.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll" [0057.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.zip") returned 0 [0057.594] lstrlenA (lpString="*.zip") returned 5 [0057.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.rar") returned 0 [0057.594] lstrlenA (lpString="*.rar") returned 5 [0057.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.7z") returned 0 [0057.594] lstrlenA (lpString="*.7z") returned 4 [0057.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.tar") returned 0 [0057.594] lstrlenA (lpString="*.tar") returned 5 [0057.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.gzip") returned 0 [0057.594] lstrlenA (lpString="*.gzip") returned 6 [0057.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.jpg") returned 0 [0057.594] lstrlenA (lpString="*.jpg") returned 5 [0057.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.jpeg") returned 0 [0057.594] lstrlenA (lpString="*.jpeg") returned 6 [0057.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.psd") returned 0 [0057.594] lstrlenA (lpString="*.psd") returned 5 [0057.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.cdr") returned 0 [0057.594] lstrlenA (lpString="*.cdr") returned 5 [0057.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.dwg") returned 0 [0057.594] lstrlenA (lpString="*.dwg") returned 5 [0057.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.max") returned 0 [0057.594] lstrlenA (lpString="*.max") returned 5 [0057.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.bmp") returned 0 [0057.594] lstrlenA (lpString="*.bmp") returned 5 [0057.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.gif") returned 0 [0057.594] lstrlenA (lpString="*.gif") returned 5 [0057.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.png") returned 0 [0057.594] lstrlenA (lpString="*.png") returned 5 [0057.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.doc") returned 0 [0057.595] lstrlenA (lpString="*.doc") returned 5 [0057.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.docx") returned 0 [0057.595] lstrlenA (lpString="*.docx") returned 6 [0057.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.xls") returned 0 [0057.595] lstrlenA (lpString="*.xls") returned 5 [0057.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.xlsx") returned 0 [0057.595] lstrlenA (lpString="*.xlsx") returned 6 [0057.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.ppt") returned 0 [0057.595] lstrlenA (lpString="*.ppt") returned 5 [0057.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.pptx") returned 0 [0057.595] lstrlenA (lpString="*.pptx") returned 6 [0057.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.txt") returned 0 [0057.595] lstrlenA (lpString="*.txt") returned 5 [0057.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.pdf") returned 0 [0057.595] lstrlenA (lpString="*.pdf") returned 5 [0057.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.djvu") returned 0 [0057.595] lstrlenA (lpString="*.djvu") returned 6 [0057.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.htm") returned 0 [0057.595] lstrlenA (lpString="*.htm") returned 5 [0057.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.html") returned 0 [0057.599] lstrlenA (lpString="*.html") returned 6 [0057.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.mdb") returned 0 [0057.599] lstrlenA (lpString="*.mdb") returned 5 [0057.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.cer") returned 0 [0057.599] lstrlenA (lpString="*.cer") returned 5 [0057.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.p12") returned 0 [0057.599] lstrlenA (lpString="*.p12") returned 5 [0057.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.pfx") returned 0 [0057.599] lstrlenA (lpString="*.pfx") returned 5 [0057.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.kwm") returned 0 [0057.599] lstrlenA (lpString="*.kwm") returned 5 [0057.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.pwm") returned 0 [0057.599] lstrlenA (lpString="*.pwm") returned 5 [0057.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.1cd") returned 0 [0057.599] lstrlenA (lpString="*.1cd") returned 5 [0057.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.md") returned 0 [0057.599] lstrlenA (lpString="*.md") returned 4 [0057.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.mdf") returned 0 [0057.599] lstrlenA (lpString="*.mdf") returned 5 [0057.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.dbf") returned 0 [0057.600] lstrlenA (lpString="*.dbf") returned 5 [0057.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.odt") returned 0 [0057.600] lstrlenA (lpString="*.odt") returned 5 [0057.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.vob") returned 0 [0057.600] lstrlenA (lpString="*.vob") returned 5 [0057.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.ifo") returned 0 [0057.600] lstrlenA (lpString="*.ifo") returned 5 [0057.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.lnk") returned 0 [0057.600] lstrlenA (lpString="*.lnk") returned 5 [0057.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.torrent") returned 0 [0057.600] lstrlenA (lpString="*.torrent") returned 9 [0057.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.mov") returned 0 [0057.600] lstrlenA (lpString="*.mov") returned 5 [0057.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.m2v") returned 0 [0057.600] lstrlenA (lpString="*.m2v") returned 5 [0057.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.3gp") returned 0 [0057.600] lstrlenA (lpString="*.3gp") returned 5 [0057.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.mpeg") returned 0 [0057.600] lstrlenA (lpString="*.mpeg") returned 6 [0057.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.mpg") returned 0 [0057.600] lstrlenA (lpString="*.mpg") returned 5 [0057.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.flv") returned 0 [0057.600] lstrlenA (lpString="*.flv") returned 5 [0057.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.avi") returned 0 [0057.600] lstrlenA (lpString="*.avi") returned 5 [0057.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.mp4") returned 0 [0057.601] lstrlenA (lpString="*.mp4") returned 5 [0057.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.wmv") returned 0 [0057.601] lstrlenA (lpString="*.wmv") returned 5 [0057.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.divx") returned 0 [0057.601] lstrlenA (lpString="*.divx") returned 6 [0057.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.mkv") returned 0 [0057.601] lstrlenA (lpString="*.mkv") returned 5 [0057.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.mp3") returned 0 [0057.601] lstrlenA (lpString="*.mp3") returned 5 [0057.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.wav") returned 0 [0057.601] lstrlenA (lpString="*.wav") returned 5 [0057.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.flac") returned 0 [0057.601] lstrlenA (lpString="*.flac") returned 6 [0057.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.ape") returned 0 [0057.601] lstrlenA (lpString="*.ape") returned 5 [0057.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.wma") returned 0 [0057.601] lstrlenA (lpString="*.wma") returned 5 [0057.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll", pszSpec="*.ac3") returned 0 [0057.601] lstrlenA (lpString="*.ac3") returned 5 [0057.601] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x261ab200, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x4542f17e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x261ab200, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x187ed8, dwReserved0=0x0, dwReserved1=0x0, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0057.601] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0057.604] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="offfiltx.dll") returned -1 [0057.604] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="offfiltx.dll") returned -1 [0057.604] lstrcmpiA (lpString1="", lpString2="offfiltx.dll") returned -1 [0057.604] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\odffilt.dll") returned="odffilt.dll" [0057.604] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\" [0057.604] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\") returned="" [0057.604] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\HOW TO DECRYPT FILES.txt" [0057.604] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\how to decrypt files.txt")) returned 0x20 [0057.604] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\", lpString2="offfiltx.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll" [0057.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.zip") returned 0 [0057.604] lstrlenA (lpString="*.zip") returned 5 [0057.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.rar") returned 0 [0057.604] lstrlenA (lpString="*.rar") returned 5 [0057.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.7z") returned 0 [0057.604] lstrlenA (lpString="*.7z") returned 4 [0057.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.tar") returned 0 [0057.604] lstrlenA (lpString="*.tar") returned 5 [0057.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.gzip") returned 0 [0057.604] lstrlenA (lpString="*.gzip") returned 6 [0057.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.jpg") returned 0 [0057.605] lstrlenA (lpString="*.jpg") returned 5 [0057.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.jpeg") returned 0 [0057.605] lstrlenA (lpString="*.jpeg") returned 6 [0057.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.psd") returned 0 [0057.605] lstrlenA (lpString="*.psd") returned 5 [0057.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.cdr") returned 0 [0057.605] lstrlenA (lpString="*.cdr") returned 5 [0057.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.dwg") returned 0 [0057.605] lstrlenA (lpString="*.dwg") returned 5 [0057.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.max") returned 0 [0057.605] lstrlenA (lpString="*.max") returned 5 [0057.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.bmp") returned 0 [0057.605] lstrlenA (lpString="*.bmp") returned 5 [0057.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.gif") returned 0 [0057.605] lstrlenA (lpString="*.gif") returned 5 [0057.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.png") returned 0 [0057.605] lstrlenA (lpString="*.png") returned 5 [0057.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.doc") returned 0 [0057.605] lstrlenA (lpString="*.doc") returned 5 [0057.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.docx") returned 0 [0057.605] lstrlenA (lpString="*.docx") returned 6 [0057.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.xls") returned 0 [0057.605] lstrlenA (lpString="*.xls") returned 5 [0057.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.xlsx") returned 0 [0057.606] lstrlenA (lpString="*.xlsx") returned 6 [0057.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.ppt") returned 0 [0057.606] lstrlenA (lpString="*.ppt") returned 5 [0057.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.pptx") returned 0 [0057.606] lstrlenA (lpString="*.pptx") returned 6 [0057.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.txt") returned 0 [0057.606] lstrlenA (lpString="*.txt") returned 5 [0057.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.pdf") returned 0 [0057.606] lstrlenA (lpString="*.pdf") returned 5 [0057.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.djvu") returned 0 [0057.606] lstrlenA (lpString="*.djvu") returned 6 [0057.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.htm") returned 0 [0057.606] lstrlenA (lpString="*.htm") returned 5 [0057.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.html") returned 0 [0057.606] lstrlenA (lpString="*.html") returned 6 [0057.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.mdb") returned 0 [0057.606] lstrlenA (lpString="*.mdb") returned 5 [0057.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.cer") returned 0 [0057.606] lstrlenA (lpString="*.cer") returned 5 [0057.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.p12") returned 0 [0057.606] lstrlenA (lpString="*.p12") returned 5 [0057.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.pfx") returned 0 [0057.606] lstrlenA (lpString="*.pfx") returned 5 [0057.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.kwm") returned 0 [0057.606] lstrlenA (lpString="*.kwm") returned 5 [0057.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.pwm") returned 0 [0057.607] lstrlenA (lpString="*.pwm") returned 5 [0057.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.1cd") returned 0 [0057.607] lstrlenA (lpString="*.1cd") returned 5 [0057.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.md") returned 0 [0057.607] lstrlenA (lpString="*.md") returned 4 [0057.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.mdf") returned 0 [0057.607] lstrlenA (lpString="*.mdf") returned 5 [0057.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.dbf") returned 0 [0057.607] lstrlenA (lpString="*.dbf") returned 5 [0057.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.odt") returned 0 [0057.607] lstrlenA (lpString="*.odt") returned 5 [0057.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.vob") returned 0 [0057.607] lstrlenA (lpString="*.vob") returned 5 [0057.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.ifo") returned 0 [0057.607] lstrlenA (lpString="*.ifo") returned 5 [0057.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.lnk") returned 0 [0057.607] lstrlenA (lpString="*.lnk") returned 5 [0057.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.torrent") returned 0 [0057.607] lstrlenA (lpString="*.torrent") returned 9 [0057.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.mov") returned 0 [0057.607] lstrlenA (lpString="*.mov") returned 5 [0057.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.m2v") returned 0 [0057.607] lstrlenA (lpString="*.m2v") returned 5 [0057.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.3gp") returned 0 [0057.607] lstrlenA (lpString="*.3gp") returned 5 [0057.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.mpeg") returned 0 [0057.608] lstrlenA (lpString="*.mpeg") returned 6 [0057.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.mpg") returned 0 [0057.608] lstrlenA (lpString="*.mpg") returned 5 [0057.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.flv") returned 0 [0057.608] lstrlenA (lpString="*.flv") returned 5 [0057.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.avi") returned 0 [0057.608] lstrlenA (lpString="*.avi") returned 5 [0057.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.mp4") returned 0 [0057.608] lstrlenA (lpString="*.mp4") returned 5 [0057.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.wmv") returned 0 [0057.608] lstrlenA (lpString="*.wmv") returned 5 [0057.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.divx") returned 0 [0057.608] lstrlenA (lpString="*.divx") returned 6 [0057.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.mkv") returned 0 [0057.608] lstrlenA (lpString="*.mkv") returned 5 [0057.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.mp3") returned 0 [0057.608] lstrlenA (lpString="*.mp3") returned 5 [0057.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.wav") returned 0 [0057.608] lstrlenA (lpString="*.wav") returned 5 [0057.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.flac") returned 0 [0057.608] lstrlenA (lpString="*.flac") returned 6 [0057.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.ape") returned 0 [0057.608] lstrlenA (lpString="*.ape") returned 5 [0057.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.wma") returned 0 [0057.608] lstrlenA (lpString="*.wma") returned 5 [0057.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll", pszSpec="*.ac3") returned 0 [0057.608] lstrlenA (lpString="*.ac3") returned 5 [0057.609] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x261ab200, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x456b2f65, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x261ab200, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x5d12c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0057.609] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0057.609] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISFILT.DLL") returned -1 [0057.609] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISFILT.DLL") returned -1 [0057.609] lstrcmpiA (lpString1="", lpString2="VISFILT.DLL") returned -1 [0057.609] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\offfiltx.dll") returned="offfiltx.dll" [0057.609] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\" [0057.609] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\") returned="" [0057.609] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\HOW TO DECRYPT FILES.txt" [0057.609] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\how to decrypt files.txt")) returned 0x20 [0057.609] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\", lpString2="VISFILT.DLL" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL") returned="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL" [0057.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.zip") returned 0 [0057.609] lstrlenA (lpString="*.zip") returned 5 [0057.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.rar") returned 0 [0057.609] lstrlenA (lpString="*.rar") returned 5 [0057.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.7z") returned 0 [0057.609] lstrlenA (lpString="*.7z") returned 4 [0057.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.tar") returned 0 [0057.609] lstrlenA (lpString="*.tar") returned 5 [0057.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.gzip") returned 0 [0057.609] lstrlenA (lpString="*.gzip") returned 6 [0057.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.jpg") returned 0 [0057.610] lstrlenA (lpString="*.jpg") returned 5 [0057.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.jpeg") returned 0 [0057.610] lstrlenA (lpString="*.jpeg") returned 6 [0057.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.psd") returned 0 [0057.610] lstrlenA (lpString="*.psd") returned 5 [0057.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.cdr") returned 0 [0057.610] lstrlenA (lpString="*.cdr") returned 5 [0057.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.dwg") returned 0 [0057.610] lstrlenA (lpString="*.dwg") returned 5 [0057.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.max") returned 0 [0057.610] lstrlenA (lpString="*.max") returned 5 [0057.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.bmp") returned 0 [0057.610] lstrlenA (lpString="*.bmp") returned 5 [0057.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.gif") returned 0 [0057.610] lstrlenA (lpString="*.gif") returned 5 [0057.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.png") returned 0 [0057.610] lstrlenA (lpString="*.png") returned 5 [0057.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.doc") returned 0 [0057.610] lstrlenA (lpString="*.doc") returned 5 [0057.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.docx") returned 0 [0057.610] lstrlenA (lpString="*.docx") returned 6 [0057.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.xls") returned 0 [0057.611] lstrlenA (lpString="*.xls") returned 5 [0057.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.xlsx") returned 0 [0057.611] lstrlenA (lpString="*.xlsx") returned 6 [0057.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.ppt") returned 0 [0057.611] lstrlenA (lpString="*.ppt") returned 5 [0057.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.pptx") returned 0 [0057.611] lstrlenA (lpString="*.pptx") returned 6 [0057.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.txt") returned 0 [0057.611] lstrlenA (lpString="*.txt") returned 5 [0057.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.pdf") returned 0 [0057.611] lstrlenA (lpString="*.pdf") returned 5 [0057.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.djvu") returned 0 [0057.615] lstrlenA (lpString="*.djvu") returned 6 [0057.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.htm") returned 0 [0057.615] lstrlenA (lpString="*.htm") returned 5 [0057.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.html") returned 0 [0057.615] lstrlenA (lpString="*.html") returned 6 [0057.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.mdb") returned 0 [0057.615] lstrlenA (lpString="*.mdb") returned 5 [0057.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.cer") returned 0 [0057.615] lstrlenA (lpString="*.cer") returned 5 [0057.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.p12") returned 0 [0057.616] lstrlenA (lpString="*.p12") returned 5 [0057.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.pfx") returned 0 [0057.616] lstrlenA (lpString="*.pfx") returned 5 [0057.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.kwm") returned 0 [0057.616] lstrlenA (lpString="*.kwm") returned 5 [0057.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.pwm") returned 0 [0057.616] lstrlenA (lpString="*.pwm") returned 5 [0057.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.1cd") returned 0 [0057.616] lstrlenA (lpString="*.1cd") returned 5 [0057.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.md") returned 0 [0057.616] lstrlenA (lpString="*.md") returned 4 [0057.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.mdf") returned 0 [0057.616] lstrlenA (lpString="*.mdf") returned 5 [0057.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.dbf") returned 0 [0057.616] lstrlenA (lpString="*.dbf") returned 5 [0057.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.odt") returned 0 [0057.616] lstrlenA (lpString="*.odt") returned 5 [0057.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.vob") returned 0 [0057.616] lstrlenA (lpString="*.vob") returned 5 [0057.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.ifo") returned 0 [0057.616] lstrlenA (lpString="*.ifo") returned 5 [0057.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.lnk") returned 0 [0057.616] lstrlenA (lpString="*.lnk") returned 5 [0057.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.torrent") returned 0 [0057.617] lstrlenA (lpString="*.torrent") returned 9 [0057.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.mov") returned 0 [0057.617] lstrlenA (lpString="*.mov") returned 5 [0057.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.m2v") returned 0 [0057.617] lstrlenA (lpString="*.m2v") returned 5 [0057.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.3gp") returned 0 [0057.617] lstrlenA (lpString="*.3gp") returned 5 [0057.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.mpeg") returned 0 [0057.617] lstrlenA (lpString="*.mpeg") returned 6 [0057.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.mpg") returned 0 [0057.617] lstrlenA (lpString="*.mpg") returned 5 [0057.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.flv") returned 0 [0057.617] lstrlenA (lpString="*.flv") returned 5 [0057.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.avi") returned 0 [0057.617] lstrlenA (lpString="*.avi") returned 5 [0057.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.mp4") returned 0 [0057.617] lstrlenA (lpString="*.mp4") returned 5 [0057.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.wmv") returned 0 [0057.617] lstrlenA (lpString="*.wmv") returned 5 [0057.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.divx") returned 0 [0057.617] lstrlenA (lpString="*.divx") returned 6 [0057.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.mkv") returned 0 [0057.617] lstrlenA (lpString="*.mkv") returned 5 [0057.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.mp3") returned 0 [0057.617] lstrlenA (lpString="*.mp3") returned 5 [0057.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.wav") returned 0 [0057.617] lstrlenA (lpString="*.wav") returned 5 [0057.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.flac") returned 0 [0057.618] lstrlenA (lpString="*.flac") returned 6 [0057.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.ape") returned 0 [0057.618] lstrlenA (lpString="*.ape") returned 5 [0057.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.wma") returned 0 [0057.618] lstrlenA (lpString="*.wma") returned 5 [0057.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL", pszSpec="*.ac3") returned 0 [0057.618] lstrlenA (lpString="*.ac3") returned 5 [0057.618] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x261ab200, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x456b2f65, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x261ab200, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x5d12c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0 [0057.618] FindClose (in: hFindFile=0x636b30 | out: hFindFile=0x636b30) returned 1 [0057.618] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="ink", cAlternateFileName="")) returned 1 [0057.618] lstrcmpA (lpString1=".", lpString2="ink") returned -1 [0057.618] lstrcmpA (lpString1="..", lpString2="ink") returned -1 [0057.618] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\*.*") returned="*.*" [0057.618] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\", lpString2="ink" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink" [0057.618] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink") returned 50 [0057.618] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\*.*"), lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6365b0 [0057.619] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.619] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.620] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.620] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.620] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x691089ac, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6912ebfc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xc137d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0057.620] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0057.620] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Alphabet.xml") returned 1 [0057.620] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Alphabet.xml") returned 1 [0057.620] lstrcmpiA (lpString1="", lpString2="Alphabet.xml") returned -1 [0057.620] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0057.620] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0057.620] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0057.620] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0057.620] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0xffffffff [0057.620] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0057.621] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.621] WriteFile (in: hFile=0x1cc, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.622] SetFileTime (hFile=0x1cc, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.622] CloseHandle (hObject=0x1cc) returned 1 [0057.622] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="Alphabet.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.zip") returned 0 [0057.623] lstrlenA (lpString="*.zip") returned 5 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.rar") returned 0 [0057.623] lstrlenA (lpString="*.rar") returned 5 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.7z") returned 0 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.tar") returned 0 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.gzip") returned 0 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.jpg") returned 0 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.jpeg") returned 0 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.psd") returned 0 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.cdr") returned 0 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.dwg") returned 0 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.max") returned 0 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.bmp") returned 0 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.gif") returned 0 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.png") returned 0 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.doc") returned 0 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.docx") returned 0 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.xls") returned 0 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.xlsx") returned 0 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.ppt") returned 0 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.pptx") returned 0 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.txt") returned 0 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.pdf") returned 0 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.djvu") returned 0 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.htm") returned 0 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.html") returned 0 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.mdb") returned 0 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.cer") returned 0 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.p12") returned 0 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.pfx") returned 0 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.kwm") returned 0 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.pwm") returned 0 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.1cd") returned 0 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.md") returned 0 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.mdf") returned 0 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.dbf") returned 0 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.odt") returned 0 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.vob") returned 0 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.ifo") returned 0 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.lnk") returned 0 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.torrent") returned 0 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.mov") returned 0 [0057.625] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.m2v") returned 0 [0057.625] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.3gp") returned 0 [0057.625] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.mpeg") returned 0 [0057.625] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.mpg") returned 0 [0057.625] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.flv") returned 0 [0057.625] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.avi") returned 0 [0057.625] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.mp4") returned 0 [0057.625] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.wmv") returned 0 [0057.625] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.divx") returned 0 [0057.625] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.mkv") returned 0 [0057.625] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.mp3") returned 0 [0057.625] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.wav") returned 0 [0057.625] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.flac") returned 0 [0057.625] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.ape") returned 0 [0057.625] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.wma") returned 0 [0057.625] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.ac3") returned 0 [0057.625] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0057.625] lstrcmpA (lpString1=".", lpString2="ar-SA") returned -1 [0057.625] lstrcmpA (lpString1="..", lpString2="ar-SA") returned -1 [0057.625] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned="Alphabet.xml" [0057.625] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ar-SA" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA" [0057.626] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f818, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636970 [0057.626] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.626] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f818, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.626] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.626] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.626] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167c11f8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167c11f8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167c11f8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x19f818, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0057.626] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.626] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0057.626] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0057.626] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0057.626] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\*.*") returned="*.*" [0057.626] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\" [0057.626] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\") returned="" [0057.626] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\HOW TO DECRYPT FILES.txt" [0057.626] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\how to decrypt files.txt")) returned 0xffffffff [0057.626] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.627] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.628] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.628] CloseHandle (hObject=0x1d0) returned 1 [0057.629] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" [0057.629] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0057.629] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0057.629] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0057.629] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0057.629] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0057.629] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0057.629] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0057.629] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0057.629] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0057.629] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0057.629] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0057.629] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0057.629] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0057.629] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0057.629] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0057.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0057.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0057.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0057.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0057.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0057.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0057.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0057.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0057.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0057.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0057.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0057.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0057.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0057.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0057.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0057.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0057.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0057.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0057.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0057.631] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0057.631] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0057.631] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0057.631] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0057.631] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0057.631] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0057.631] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0057.631] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0057.631] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0057.631] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0057.631] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0057.631] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0057.631] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0057.631] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0057.631] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0057.631] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0057.631] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0057.631] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0057.631] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0057.632] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0057.632] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0057.632] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0057.632] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0057.632] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167c11f8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167c11f8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167c11f8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x19f818, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0057.632] FindClose (in: hFindFile=0x636970 | out: hFindFile=0x636970) returned 1 [0057.632] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0057.632] lstrcmpA (lpString1=".", lpString2="bg-BG") returned -1 [0057.632] lstrcmpA (lpString1="..", lpString2="bg-BG") returned -1 [0057.632] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0057.632] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="bg-BG" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG" [0057.632] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG") returned 56 [0057.632] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName=".", cAlternateFileName="")) returned 0x636430 [0057.632] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.632] FindNextFileA (in: hFindFile=0x636430, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="..", cAlternateFileName="")) returned 1 [0057.632] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.633] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.633] FindNextFileA (in: hFindFile=0x636430, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1679af9e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1679af9e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1679af9e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0057.633] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.633] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0057.633] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0057.633] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0057.633] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\*.*") returned="*.*" [0057.633] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\" [0057.633] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\") returned="" [0057.633] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\HOW TO DECRYPT FILES.txt" [0057.633] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\how to decrypt files.txt")) returned 0xffffffff [0057.633] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.633] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.633] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.635] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.635] CloseHandle (hObject=0x1d0) returned 1 [0057.635] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" [0057.635] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0057.635] lstrlenA (lpString="*.zip") returned 5 [0057.635] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0057.635] lstrlenA (lpString="*.rar") returned 5 [0057.635] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0057.635] lstrlenA (lpString="*.7z") returned 4 [0057.635] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0057.635] lstrlenA (lpString="*.tar") returned 5 [0057.635] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0057.635] lstrlenA (lpString="*.gzip") returned 6 [0057.635] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0057.636] lstrlenA (lpString="*.jpg") returned 5 [0057.636] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0057.636] lstrlenA (lpString="*.jpeg") returned 6 [0057.636] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0057.636] lstrlenA (lpString="*.psd") returned 5 [0057.636] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0057.636] lstrlenA (lpString="*.cdr") returned 5 [0057.636] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0057.636] lstrlenA (lpString="*.dwg") returned 5 [0057.636] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0057.636] lstrlenA (lpString="*.max") returned 5 [0057.636] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0057.636] lstrlenA (lpString="*.bmp") returned 5 [0057.636] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0057.636] lstrlenA (lpString="*.gif") returned 5 [0057.636] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0057.636] lstrlenA (lpString="*.png") returned 5 [0057.636] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0057.636] lstrlenA (lpString="*.doc") returned 5 [0057.636] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0057.636] lstrlenA (lpString="*.docx") returned 6 [0057.636] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0057.636] lstrlenA (lpString="*.xls") returned 5 [0057.636] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0057.636] lstrlenA (lpString="*.xlsx") returned 6 [0057.636] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0057.636] lstrlenA (lpString="*.ppt") returned 5 [0057.636] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0057.637] lstrlenA (lpString="*.pptx") returned 6 [0057.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0057.637] lstrlenA (lpString="*.txt") returned 5 [0057.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0057.637] lstrlenA (lpString="*.pdf") returned 5 [0057.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0057.637] lstrlenA (lpString="*.djvu") returned 6 [0057.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0057.637] lstrlenA (lpString="*.htm") returned 5 [0057.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0057.637] lstrlenA (lpString="*.html") returned 6 [0057.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0057.637] lstrlenA (lpString="*.mdb") returned 5 [0057.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0057.637] lstrlenA (lpString="*.cer") returned 5 [0057.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0057.637] lstrlenA (lpString="*.p12") returned 5 [0057.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0057.637] lstrlenA (lpString="*.pfx") returned 5 [0057.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0057.637] lstrlenA (lpString="*.kwm") returned 5 [0057.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0057.637] lstrlenA (lpString="*.pwm") returned 5 [0057.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0057.637] lstrlenA (lpString="*.1cd") returned 5 [0057.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0057.638] lstrlenA (lpString="*.md") returned 4 [0057.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0057.638] lstrlenA (lpString="*.mdf") returned 5 [0057.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0057.638] lstrlenA (lpString="*.dbf") returned 5 [0057.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0057.638] lstrlenA (lpString="*.odt") returned 5 [0057.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0057.638] lstrlenA (lpString="*.vob") returned 5 [0057.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0057.638] lstrlenA (lpString="*.ifo") returned 5 [0057.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0057.638] lstrlenA (lpString="*.lnk") returned 5 [0057.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0057.638] lstrlenA (lpString="*.torrent") returned 9 [0057.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0057.638] lstrlenA (lpString="*.mov") returned 5 [0057.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0057.638] lstrlenA (lpString="*.m2v") returned 5 [0057.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0057.638] lstrlenA (lpString="*.3gp") returned 5 [0057.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0057.638] lstrlenA (lpString="*.mpeg") returned 6 [0057.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0057.638] lstrlenA (lpString="*.mpg") returned 5 [0057.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0057.639] lstrlenA (lpString="*.flv") returned 5 [0057.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0057.639] lstrlenA (lpString="*.avi") returned 5 [0057.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0057.639] lstrlenA (lpString="*.mp4") returned 5 [0057.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0057.639] lstrlenA (lpString="*.wmv") returned 5 [0057.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0057.639] lstrlenA (lpString="*.divx") returned 6 [0057.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0057.639] lstrlenA (lpString="*.mkv") returned 5 [0057.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0057.639] lstrlenA (lpString="*.mp3") returned 5 [0057.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0057.639] lstrlenA (lpString="*.wav") returned 5 [0057.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0057.639] lstrlenA (lpString="*.flac") returned 6 [0057.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0057.639] lstrlenA (lpString="*.ape") returned 5 [0057.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0057.639] lstrlenA (lpString="*.wma") returned 5 [0057.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0057.639] lstrlenA (lpString="*.ac3") returned 5 [0057.639] FindNextFileA (in: hFindFile=0x636430, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1679af9e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1679af9e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1679af9e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0057.639] FindClose (in: hFindFile=0x636430 | out: hFindFile=0x636430) returned 1 [0057.640] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x691c76a3, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x691c76a3, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0057.640] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0057.640] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Content.xml") returned 1 [0057.640] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Content.xml") returned 1 [0057.640] lstrcmpiA (lpString1="", lpString2="Content.xml") returned -1 [0057.640] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0057.640] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0057.640] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0057.640] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0057.640] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0057.640] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="Content.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" [0057.640] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.zip") returned 0 [0057.640] lstrlenA (lpString="*.zip") returned 5 [0057.640] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.rar") returned 0 [0057.640] lstrlenA (lpString="*.rar") returned 5 [0057.640] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.7z") returned 0 [0057.640] lstrlenA (lpString="*.7z") returned 4 [0057.640] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.tar") returned 0 [0057.640] lstrlenA (lpString="*.tar") returned 5 [0057.640] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.gzip") returned 0 [0057.640] lstrlenA (lpString="*.gzip") returned 6 [0057.641] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.jpg") returned 0 [0057.641] lstrlenA (lpString="*.jpg") returned 5 [0057.641] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.jpeg") returned 0 [0057.641] lstrlenA (lpString="*.jpeg") returned 6 [0057.641] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.psd") returned 0 [0057.641] lstrlenA (lpString="*.psd") returned 5 [0057.641] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.cdr") returned 0 [0057.641] lstrlenA (lpString="*.cdr") returned 5 [0057.641] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.dwg") returned 0 [0057.641] lstrlenA (lpString="*.dwg") returned 5 [0057.641] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.max") returned 0 [0057.641] lstrlenA (lpString="*.max") returned 5 [0057.641] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.bmp") returned 0 [0057.641] lstrlenA (lpString="*.bmp") returned 5 [0057.641] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.gif") returned 0 [0057.641] lstrlenA (lpString="*.gif") returned 5 [0057.641] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.png") returned 0 [0057.641] lstrlenA (lpString="*.png") returned 5 [0057.641] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.doc") returned 0 [0057.641] lstrlenA (lpString="*.doc") returned 5 [0057.641] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.docx") returned 0 [0057.641] lstrlenA (lpString="*.docx") returned 6 [0057.641] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.xls") returned 0 [0057.641] lstrlenA (lpString="*.xls") returned 5 [0057.641] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.xlsx") returned 0 [0057.641] lstrlenA (lpString="*.xlsx") returned 6 [0057.641] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.ppt") returned 0 [0057.641] lstrlenA (lpString="*.ppt") returned 5 [0057.642] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.pptx") returned 0 [0057.642] lstrlenA (lpString="*.pptx") returned 6 [0057.642] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.txt") returned 0 [0057.642] lstrlenA (lpString="*.txt") returned 5 [0057.642] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.pdf") returned 0 [0057.642] lstrlenA (lpString="*.pdf") returned 5 [0057.642] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.djvu") returned 0 [0057.642] lstrlenA (lpString="*.djvu") returned 6 [0057.642] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.htm") returned 0 [0057.642] lstrlenA (lpString="*.htm") returned 5 [0057.642] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.html") returned 0 [0057.642] lstrlenA (lpString="*.html") returned 6 [0057.642] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.mdb") returned 0 [0057.642] lstrlenA (lpString="*.mdb") returned 5 [0057.642] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.cer") returned 0 [0057.642] lstrlenA (lpString="*.cer") returned 5 [0057.642] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.p12") returned 0 [0057.642] lstrlenA (lpString="*.p12") returned 5 [0057.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.pfx") returned 0 [0057.652] lstrlenA (lpString="*.pfx") returned 5 [0057.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.kwm") returned 0 [0057.652] lstrlenA (lpString="*.kwm") returned 5 [0057.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.pwm") returned 0 [0057.653] lstrlenA (lpString="*.pwm") returned 5 [0057.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.1cd") returned 0 [0057.653] lstrlenA (lpString="*.1cd") returned 5 [0057.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.md") returned 0 [0057.653] lstrlenA (lpString="*.md") returned 4 [0057.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.mdf") returned 0 [0057.653] lstrlenA (lpString="*.mdf") returned 5 [0057.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.dbf") returned 0 [0057.653] lstrlenA (lpString="*.dbf") returned 5 [0057.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.odt") returned 0 [0057.653] lstrlenA (lpString="*.odt") returned 5 [0057.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.vob") returned 0 [0057.653] lstrlenA (lpString="*.vob") returned 5 [0057.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.ifo") returned 0 [0057.653] lstrlenA (lpString="*.ifo") returned 5 [0057.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.lnk") returned 0 [0057.653] lstrlenA (lpString="*.lnk") returned 5 [0057.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.torrent") returned 0 [0057.653] lstrlenA (lpString="*.torrent") returned 9 [0057.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.mov") returned 0 [0057.653] lstrlenA (lpString="*.mov") returned 5 [0057.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.m2v") returned 0 [0057.653] lstrlenA (lpString="*.m2v") returned 5 [0057.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.3gp") returned 0 [0057.653] lstrlenA (lpString="*.3gp") returned 5 [0057.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.mpeg") returned 0 [0057.654] lstrlenA (lpString="*.mpeg") returned 6 [0057.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.mpg") returned 0 [0057.654] lstrlenA (lpString="*.mpg") returned 5 [0057.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.flv") returned 0 [0057.654] lstrlenA (lpString="*.flv") returned 5 [0057.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.avi") returned 0 [0057.654] lstrlenA (lpString="*.avi") returned 5 [0057.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.mp4") returned 0 [0057.654] lstrlenA (lpString="*.mp4") returned 5 [0057.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.wmv") returned 0 [0057.654] lstrlenA (lpString="*.wmv") returned 5 [0057.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.divx") returned 0 [0057.654] lstrlenA (lpString="*.divx") returned 6 [0057.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.mkv") returned 0 [0057.654] lstrlenA (lpString="*.mkv") returned 5 [0057.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.mp3") returned 0 [0057.654] lstrlenA (lpString="*.mp3") returned 5 [0057.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.wav") returned 0 [0057.654] lstrlenA (lpString="*.wav") returned 5 [0057.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.flac") returned 0 [0057.654] lstrlenA (lpString="*.flac") returned 6 [0057.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.ape") returned 0 [0057.654] lstrlenA (lpString="*.ape") returned 5 [0057.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.wma") returned 0 [0057.654] lstrlenA (lpString="*.wma") returned 5 [0057.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.ac3") returned 0 [0057.654] lstrlenA (lpString="*.ac3") returned 5 [0057.655] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0057.655] lstrcmpA (lpString1=".", lpString2="cs-CZ") returned -1 [0057.655] lstrcmpA (lpString1="..", lpString2="cs-CZ") returned -1 [0057.655] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned="Content.xml" [0057.655] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="cs-CZ" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ" [0057.655] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ") returned 56 [0057.655] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0xa0, cFileName=".", cAlternateFileName="")) returned 0x6367f0 [0057.656] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.656] FindNextFileA (in: hFindFile=0x6367f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0xa0, cFileName="..", cAlternateFileName="")) returned 1 [0057.656] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.656] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.656] FindNextFileA (in: hFindFile=0x6367f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16774d47, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16774d47, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16774d47, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x77792cf0, dwReserved1=0xa0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0057.656] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.656] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0057.656] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0057.656] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0057.656] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\*.*") returned="*.*" [0057.656] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\" [0057.656] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\") returned="" [0057.656] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\HOW TO DECRYPT FILES.txt" [0057.656] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\how to decrypt files.txt")) returned 0xffffffff [0057.656] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.657] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.657] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.658] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.658] CloseHandle (hObject=0x1d0) returned 1 [0057.659] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" [0057.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0057.659] lstrlenA (lpString="*.zip") returned 5 [0057.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0057.659] lstrlenA (lpString="*.rar") returned 5 [0057.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0057.659] lstrlenA (lpString="*.7z") returned 4 [0057.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0057.659] lstrlenA (lpString="*.tar") returned 5 [0057.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0057.659] lstrlenA (lpString="*.gzip") returned 6 [0057.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0057.659] lstrlenA (lpString="*.jpg") returned 5 [0057.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0057.659] lstrlenA (lpString="*.jpeg") returned 6 [0057.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0057.659] lstrlenA (lpString="*.psd") returned 5 [0057.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0057.659] lstrlenA (lpString="*.cdr") returned 5 [0057.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0057.659] lstrlenA (lpString="*.dwg") returned 5 [0057.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0057.660] lstrlenA (lpString="*.max") returned 5 [0057.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0057.660] lstrlenA (lpString="*.bmp") returned 5 [0057.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0057.660] lstrlenA (lpString="*.gif") returned 5 [0057.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0057.660] lstrlenA (lpString="*.png") returned 5 [0057.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0057.660] lstrlenA (lpString="*.doc") returned 5 [0057.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0057.660] lstrlenA (lpString="*.docx") returned 6 [0057.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0057.660] lstrlenA (lpString="*.xls") returned 5 [0057.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0057.660] lstrlenA (lpString="*.xlsx") returned 6 [0057.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0057.660] lstrlenA (lpString="*.ppt") returned 5 [0057.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0057.660] lstrlenA (lpString="*.pptx") returned 6 [0057.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0057.660] lstrlenA (lpString="*.txt") returned 5 [0057.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0057.660] lstrlenA (lpString="*.pdf") returned 5 [0057.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0057.660] lstrlenA (lpString="*.djvu") returned 6 [0057.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0057.660] lstrlenA (lpString="*.htm") returned 5 [0057.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0057.661] lstrlenA (lpString="*.html") returned 6 [0057.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0057.661] lstrlenA (lpString="*.mdb") returned 5 [0057.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0057.661] lstrlenA (lpString="*.cer") returned 5 [0057.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0057.661] lstrlenA (lpString="*.p12") returned 5 [0057.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0057.661] lstrlenA (lpString="*.pfx") returned 5 [0057.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0057.661] lstrlenA (lpString="*.kwm") returned 5 [0057.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0057.661] lstrlenA (lpString="*.pwm") returned 5 [0057.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0057.661] lstrlenA (lpString="*.1cd") returned 5 [0057.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0057.661] lstrlenA (lpString="*.md") returned 4 [0057.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0057.661] lstrlenA (lpString="*.mdf") returned 5 [0057.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0057.661] lstrlenA (lpString="*.dbf") returned 5 [0057.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0057.661] lstrlenA (lpString="*.odt") returned 5 [0057.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0057.661] lstrlenA (lpString="*.vob") returned 5 [0057.662] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0057.662] lstrlenA (lpString="*.ifo") returned 5 [0057.662] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0057.662] lstrlenA (lpString="*.lnk") returned 5 [0057.662] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0057.662] lstrlenA (lpString="*.torrent") returned 9 [0057.662] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0057.662] lstrlenA (lpString="*.mov") returned 5 [0057.662] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0057.662] lstrlenA (lpString="*.m2v") returned 5 [0057.662] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0057.662] lstrlenA (lpString="*.3gp") returned 5 [0057.662] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0057.662] lstrlenA (lpString="*.mpeg") returned 6 [0057.662] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0057.662] lstrlenA (lpString="*.mpg") returned 5 [0057.662] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0057.662] lstrlenA (lpString="*.flv") returned 5 [0057.662] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0057.662] lstrlenA (lpString="*.avi") returned 5 [0057.662] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0057.662] lstrlenA (lpString="*.mp4") returned 5 [0057.662] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0057.662] lstrlenA (lpString="*.wmv") returned 5 [0057.662] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0057.662] lstrlenA (lpString="*.divx") returned 6 [0057.663] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0057.663] lstrlenA (lpString="*.mkv") returned 5 [0057.663] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0057.663] lstrlenA (lpString="*.mp3") returned 5 [0057.663] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0057.663] lstrlenA (lpString="*.wav") returned 5 [0057.663] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0057.663] lstrlenA (lpString="*.flac") returned 6 [0057.663] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0057.663] lstrlenA (lpString="*.ape") returned 5 [0057.663] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0057.663] lstrlenA (lpString="*.wma") returned 5 [0057.663] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0057.663] lstrlenA (lpString="*.ac3") returned 5 [0057.663] FindNextFileA (in: hFindFile=0x6367f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16774d47, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16774d47, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16774d47, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x77792cf0, dwReserved1=0xa0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0057.663] FindClose (in: hFindFile=0x6367f0 | out: hFindFile=0x6367f0) returned 1 [0057.663] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="da-DK", cAlternateFileName="")) returned 1 [0057.663] lstrcmpA (lpString1=".", lpString2="da-DK") returned -1 [0057.663] lstrcmpA (lpString1="..", lpString2="da-DK") returned -1 [0057.663] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0057.663] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="da-DK" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK" [0057.663] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK") returned 56 [0057.663] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName=".", cAlternateFileName="")) returned 0x636730 [0057.664] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.664] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="..", cAlternateFileName="")) returned 1 [0057.664] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.664] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.664] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16774d47, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16774d47, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16774d47, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0057.664] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.664] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0057.664] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0057.664] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0057.664] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\*.*") returned="*.*" [0057.664] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\" [0057.664] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\") returned="" [0057.664] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\HOW TO DECRYPT FILES.txt" [0057.664] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\how to decrypt files.txt")) returned 0xffffffff [0057.664] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.664] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.664] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.666] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.666] CloseHandle (hObject=0x1d0) returned 1 [0057.666] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" [0057.666] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0057.666] lstrlenA (lpString="*.zip") returned 5 [0057.666] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0057.666] lstrlenA (lpString="*.rar") returned 5 [0057.666] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0057.666] lstrlenA (lpString="*.7z") returned 4 [0057.666] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0057.666] lstrlenA (lpString="*.tar") returned 5 [0057.666] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0057.666] lstrlenA (lpString="*.gzip") returned 6 [0057.666] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0057.666] lstrlenA (lpString="*.jpg") returned 5 [0057.666] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0057.666] lstrlenA (lpString="*.jpeg") returned 6 [0057.666] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0057.666] lstrlenA (lpString="*.psd") returned 5 [0057.666] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0057.666] lstrlenA (lpString="*.cdr") returned 5 [0057.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0057.667] lstrlenA (lpString="*.dwg") returned 5 [0057.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0057.667] lstrlenA (lpString="*.max") returned 5 [0057.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0057.667] lstrlenA (lpString="*.bmp") returned 5 [0057.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0057.667] lstrlenA (lpString="*.gif") returned 5 [0057.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0057.667] lstrlenA (lpString="*.png") returned 5 [0057.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0057.667] lstrlenA (lpString="*.doc") returned 5 [0057.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0057.667] lstrlenA (lpString="*.docx") returned 6 [0057.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0057.667] lstrlenA (lpString="*.xls") returned 5 [0057.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0057.667] lstrlenA (lpString="*.xlsx") returned 6 [0057.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0057.667] lstrlenA (lpString="*.ppt") returned 5 [0057.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0057.667] lstrlenA (lpString="*.pptx") returned 6 [0057.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0057.667] lstrlenA (lpString="*.txt") returned 5 [0057.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0057.667] lstrlenA (lpString="*.pdf") returned 5 [0057.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0057.667] lstrlenA (lpString="*.djvu") returned 6 [0057.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0057.667] lstrlenA (lpString="*.htm") returned 5 [0057.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0057.667] lstrlenA (lpString="*.html") returned 6 [0057.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0057.668] lstrlenA (lpString="*.mdb") returned 5 [0057.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0057.668] lstrlenA (lpString="*.cer") returned 5 [0057.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0057.668] lstrlenA (lpString="*.p12") returned 5 [0057.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0057.668] lstrlenA (lpString="*.pfx") returned 5 [0057.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0057.668] lstrlenA (lpString="*.kwm") returned 5 [0057.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0057.668] lstrlenA (lpString="*.pwm") returned 5 [0057.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0057.668] lstrlenA (lpString="*.1cd") returned 5 [0057.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0057.668] lstrlenA (lpString="*.md") returned 4 [0057.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0057.668] lstrlenA (lpString="*.mdf") returned 5 [0057.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0057.668] lstrlenA (lpString="*.dbf") returned 5 [0057.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0057.668] lstrlenA (lpString="*.odt") returned 5 [0057.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0057.668] lstrlenA (lpString="*.vob") returned 5 [0057.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0057.668] lstrlenA (lpString="*.ifo") returned 5 [0057.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0057.668] lstrlenA (lpString="*.lnk") returned 5 [0057.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0057.668] lstrlenA (lpString="*.torrent") returned 9 [0057.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0057.668] lstrlenA (lpString="*.mov") returned 5 [0057.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0057.668] lstrlenA (lpString="*.m2v") returned 5 [0057.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0057.668] lstrlenA (lpString="*.3gp") returned 5 [0057.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0057.669] lstrlenA (lpString="*.mpeg") returned 6 [0057.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0057.669] lstrlenA (lpString="*.mpg") returned 5 [0057.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0057.669] lstrlenA (lpString="*.flv") returned 5 [0057.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0057.669] lstrlenA (lpString="*.avi") returned 5 [0057.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0057.669] lstrlenA (lpString="*.mp4") returned 5 [0057.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0057.669] lstrlenA (lpString="*.wmv") returned 5 [0057.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0057.669] lstrlenA (lpString="*.divx") returned 6 [0057.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0057.669] lstrlenA (lpString="*.mkv") returned 5 [0057.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0057.669] lstrlenA (lpString="*.mp3") returned 5 [0057.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0057.669] lstrlenA (lpString="*.wav") returned 5 [0057.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0057.669] lstrlenA (lpString="*.flac") returned 6 [0057.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0057.669] lstrlenA (lpString="*.ape") returned 5 [0057.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0057.669] lstrlenA (lpString="*.wma") returned 5 [0057.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0057.669] lstrlenA (lpString="*.ac3") returned 5 [0057.669] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16774d47, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16774d47, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16774d47, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0057.669] FindClose (in: hFindFile=0x636730 | out: hFindFile=0x636730) returned 1 [0057.669] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="de-DE", cAlternateFileName="")) returned 1 [0057.669] lstrcmpA (lpString1=".", lpString2="de-DE") returned -1 [0057.670] lstrcmpA (lpString1="..", lpString2="de-DE") returned -1 [0057.670] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0057.670] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="de-DE" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE" [0057.670] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE") returned 56 [0057.670] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName=".", cAlternateFileName="")) returned 0x636870 [0057.670] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.670] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="..", cAlternateFileName="")) returned 1 [0057.670] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.670] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.670] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16774d47, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16774d47, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16774d47, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0057.670] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.670] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0057.670] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0057.670] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0057.670] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\*.*") returned="*.*" [0057.670] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\" [0057.670] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\") returned="" [0057.670] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\HOW TO DECRYPT FILES.txt" [0057.670] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\how to decrypt files.txt")) returned 0xffffffff [0057.670] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.671] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.671] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.672] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.672] CloseHandle (hObject=0x1d0) returned 1 [0057.672] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" [0057.672] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0057.672] lstrlenA (lpString="*.zip") returned 5 [0057.672] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0057.672] lstrlenA (lpString="*.rar") returned 5 [0057.672] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0057.672] lstrlenA (lpString="*.7z") returned 4 [0057.672] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0057.672] lstrlenA (lpString="*.tar") returned 5 [0057.672] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0057.672] lstrlenA (lpString="*.gzip") returned 6 [0057.672] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0057.672] lstrlenA (lpString="*.jpg") returned 5 [0057.672] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0057.672] lstrlenA (lpString="*.jpeg") returned 6 [0057.672] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0057.672] lstrlenA (lpString="*.psd") returned 5 [0057.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0057.673] lstrlenA (lpString="*.cdr") returned 5 [0057.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0057.673] lstrlenA (lpString="*.dwg") returned 5 [0057.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0057.673] lstrlenA (lpString="*.max") returned 5 [0057.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0057.673] lstrlenA (lpString="*.bmp") returned 5 [0057.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0057.673] lstrlenA (lpString="*.gif") returned 5 [0057.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0057.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0057.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0057.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0057.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0057.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0057.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0057.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0057.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0057.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0057.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0057.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0057.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0057.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0057.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0057.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0057.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0057.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0057.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0057.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0057.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0057.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0057.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0057.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0057.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0057.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0057.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0057.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0057.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0057.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0057.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0057.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0057.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0057.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0057.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0057.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0057.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0057.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0057.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0057.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0057.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0057.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0057.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0057.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0057.675] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16774d47, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16774d47, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16774d47, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0057.675] FindClose (in: hFindFile=0x636870 | out: hFindFile=0x636870) returned 1 [0057.675] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="el-GR", cAlternateFileName="")) returned 1 [0057.675] lstrcmpA (lpString1=".", lpString2="el-GR") returned -1 [0057.675] lstrcmpA (lpString1="..", lpString2="el-GR") returned -1 [0057.675] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0057.675] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="el-GR" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR" [0057.675] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName=".", cAlternateFileName="")) returned 0x6365f0 [0057.675] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.675] FindNextFileA (in: hFindFile=0x6365f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="..", cAlternateFileName="")) returned 1 [0057.675] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.675] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.675] FindNextFileA (in: hFindFile=0x6365f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0057.675] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.675] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0057.675] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0057.675] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0057.675] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\*.*") returned="*.*" [0057.676] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\" [0057.721] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\") returned="" [0057.721] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\HOW TO DECRYPT FILES.txt" [0057.721] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\how to decrypt files.txt")) returned 0xffffffff [0057.721] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.721] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.722] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.723] CloseHandle (hObject=0x1d0) returned 1 [0057.723] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" [0057.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0057.723] lstrlenA (lpString="*.zip") returned 5 [0057.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0057.723] lstrlenA (lpString="*.rar") returned 5 [0057.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0057.723] lstrlenA (lpString="*.7z") returned 4 [0057.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0057.723] lstrlenA (lpString="*.tar") returned 5 [0057.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0057.723] lstrlenA (lpString="*.gzip") returned 6 [0057.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0057.723] lstrlenA (lpString="*.jpg") returned 5 [0057.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0057.723] lstrlenA (lpString="*.jpeg") returned 6 [0057.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0057.723] lstrlenA (lpString="*.psd") returned 5 [0057.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0057.723] lstrlenA (lpString="*.cdr") returned 5 [0057.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0057.723] lstrlenA (lpString="*.dwg") returned 5 [0057.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0057.723] lstrlenA (lpString="*.max") returned 5 [0057.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0057.723] lstrlenA (lpString="*.bmp") returned 5 [0057.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0057.724] lstrlenA (lpString="*.gif") returned 5 [0057.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0057.724] lstrlenA (lpString="*.png") returned 5 [0057.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0057.724] lstrlenA (lpString="*.doc") returned 5 [0057.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0057.724] lstrlenA (lpString="*.docx") returned 6 [0057.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0057.724] lstrlenA (lpString="*.xls") returned 5 [0057.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0057.724] lstrlenA (lpString="*.xlsx") returned 6 [0057.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0057.724] lstrlenA (lpString="*.ppt") returned 5 [0057.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0057.724] lstrlenA (lpString="*.pptx") returned 6 [0057.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0057.724] lstrlenA (lpString="*.txt") returned 5 [0057.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0057.724] lstrlenA (lpString="*.pdf") returned 5 [0057.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0057.724] lstrlenA (lpString="*.djvu") returned 6 [0057.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0057.724] lstrlenA (lpString="*.htm") returned 5 [0057.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0057.724] lstrlenA (lpString="*.html") returned 6 [0057.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0057.724] lstrlenA (lpString="*.mdb") returned 5 [0057.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0057.724] lstrlenA (lpString="*.cer") returned 5 [0057.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0057.724] lstrlenA (lpString="*.p12") returned 5 [0057.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0057.724] lstrlenA (lpString="*.pfx") returned 5 [0057.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0057.725] lstrlenA (lpString="*.kwm") returned 5 [0057.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0057.725] lstrlenA (lpString="*.pwm") returned 5 [0057.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0057.725] lstrlenA (lpString="*.1cd") returned 5 [0057.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0057.725] lstrlenA (lpString="*.md") returned 4 [0057.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0057.725] lstrlenA (lpString="*.mdf") returned 5 [0057.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0057.725] lstrlenA (lpString="*.dbf") returned 5 [0057.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0057.725] lstrlenA (lpString="*.odt") returned 5 [0057.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0057.725] lstrlenA (lpString="*.vob") returned 5 [0057.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0057.725] lstrlenA (lpString="*.ifo") returned 5 [0057.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0057.725] lstrlenA (lpString="*.lnk") returned 5 [0057.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0057.725] lstrlenA (lpString="*.torrent") returned 9 [0057.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0057.725] lstrlenA (lpString="*.mov") returned 5 [0057.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0057.725] lstrlenA (lpString="*.m2v") returned 5 [0057.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0057.725] lstrlenA (lpString="*.3gp") returned 5 [0057.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0057.725] lstrlenA (lpString="*.mpeg") returned 6 [0057.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0057.725] lstrlenA (lpString="*.mpg") returned 5 [0057.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0057.726] lstrlenA (lpString="*.flv") returned 5 [0057.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0057.726] lstrlenA (lpString="*.avi") returned 5 [0057.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0057.726] lstrlenA (lpString="*.mp4") returned 5 [0057.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0057.726] lstrlenA (lpString="*.wmv") returned 5 [0057.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0057.726] lstrlenA (lpString="*.divx") returned 6 [0057.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0057.726] lstrlenA (lpString="*.mkv") returned 5 [0057.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0057.726] lstrlenA (lpString="*.mp3") returned 5 [0057.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0057.726] lstrlenA (lpString="*.wav") returned 5 [0057.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0057.726] lstrlenA (lpString="*.flac") returned 6 [0057.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0057.726] lstrlenA (lpString="*.ape") returned 5 [0057.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0057.726] lstrlenA (lpString="*.wma") returned 5 [0057.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0057.726] lstrlenA (lpString="*.ac3") returned 5 [0057.726] FindNextFileA (in: hFindFile=0x6365f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0057.726] FindClose (in: hFindFile=0x6365f0 | out: hFindFile=0x6365f0) returned 1 [0057.726] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="en-GB", cAlternateFileName="")) returned 1 [0057.726] lstrcmpA (lpString1=".", lpString2="en-GB") returned -1 [0057.726] lstrcmpA (lpString1="..", lpString2="en-GB") returned -1 [0057.727] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0057.727] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="en-GB" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB" [0057.727] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB") returned 56 [0057.727] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName=".", cAlternateFileName="")) returned 0x6368b0 [0057.732] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.732] FindNextFileA (in: hFindFile=0x6368b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="..", cAlternateFileName="")) returned 1 [0057.732] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.733] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.733] FindNextFileA (in: hFindFile=0x6368b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0057.733] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.733] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0057.733] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0057.733] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0057.733] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\*.*") returned="*.*" [0057.733] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\" [0057.733] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\") returned="" [0057.733] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\HOW TO DECRYPT FILES.txt" [0057.733] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\how to decrypt files.txt")) returned 0xffffffff [0057.733] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.733] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.733] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.741] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.741] CloseHandle (hObject=0x1d0) returned 1 [0057.741] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" [0057.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0057.741] lstrlenA (lpString="*.zip") returned 5 [0057.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0057.741] lstrlenA (lpString="*.rar") returned 5 [0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0057.742] lstrlenA (lpString="*.7z") returned 4 [0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0057.742] lstrlenA (lpString="*.tar") returned 5 [0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0057.742] lstrlenA (lpString="*.gzip") returned 6 [0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0057.742] lstrlenA (lpString="*.jpg") returned 5 [0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0057.742] lstrlenA (lpString="*.jpeg") returned 6 [0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0057.742] lstrlenA (lpString="*.psd") returned 5 [0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0057.742] lstrlenA (lpString="*.cdr") returned 5 [0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0057.742] lstrlenA (lpString="*.dwg") returned 5 [0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0057.742] lstrlenA (lpString="*.max") returned 5 [0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0057.742] lstrlenA (lpString="*.bmp") returned 5 [0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0057.742] lstrlenA (lpString="*.gif") returned 5 [0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0057.742] lstrlenA (lpString="*.png") returned 5 [0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0057.742] lstrlenA (lpString="*.doc") returned 5 [0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0057.742] lstrlenA (lpString="*.docx") returned 6 [0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0057.742] lstrlenA (lpString="*.xls") returned 5 [0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0057.742] lstrlenA (lpString="*.xlsx") returned 6 [0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0057.742] lstrlenA (lpString="*.ppt") returned 5 [0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0057.743] lstrlenA (lpString="*.pptx") returned 6 [0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0057.743] lstrlenA (lpString="*.txt") returned 5 [0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0057.743] lstrlenA (lpString="*.pdf") returned 5 [0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0057.743] lstrlenA (lpString="*.djvu") returned 6 [0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0057.743] lstrlenA (lpString="*.htm") returned 5 [0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0057.743] lstrlenA (lpString="*.html") returned 6 [0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0057.743] lstrlenA (lpString="*.mdb") returned 5 [0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0057.743] lstrlenA (lpString="*.cer") returned 5 [0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0057.743] lstrlenA (lpString="*.p12") returned 5 [0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0057.743] lstrlenA (lpString="*.pfx") returned 5 [0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0057.743] lstrlenA (lpString="*.kwm") returned 5 [0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0057.743] lstrlenA (lpString="*.pwm") returned 5 [0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0057.743] lstrlenA (lpString="*.1cd") returned 5 [0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0057.743] lstrlenA (lpString="*.md") returned 4 [0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0057.743] lstrlenA (lpString="*.mdf") returned 5 [0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0057.743] lstrlenA (lpString="*.dbf") returned 5 [0057.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0057.744] lstrlenA (lpString="*.odt") returned 5 [0057.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0057.744] lstrlenA (lpString="*.vob") returned 5 [0057.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0057.744] lstrlenA (lpString="*.ifo") returned 5 [0057.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0057.744] lstrlenA (lpString="*.lnk") returned 5 [0057.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0057.744] lstrlenA (lpString="*.torrent") returned 9 [0057.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0057.744] lstrlenA (lpString="*.mov") returned 5 [0057.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0057.744] lstrlenA (lpString="*.m2v") returned 5 [0057.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0057.744] lstrlenA (lpString="*.3gp") returned 5 [0057.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0057.744] lstrlenA (lpString="*.mpeg") returned 6 [0057.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0057.744] lstrlenA (lpString="*.mpg") returned 5 [0057.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0057.744] lstrlenA (lpString="*.flv") returned 5 [0057.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0057.744] lstrlenA (lpString="*.avi") returned 5 [0057.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0057.744] lstrlenA (lpString="*.mp4") returned 5 [0057.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0057.744] lstrlenA (lpString="*.wmv") returned 5 [0057.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0057.744] lstrlenA (lpString="*.divx") returned 6 [0057.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0057.744] lstrlenA (lpString="*.mkv") returned 5 [0057.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0057.744] lstrlenA (lpString="*.mp3") returned 5 [0057.745] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0057.745] lstrlenA (lpString="*.wav") returned 5 [0057.745] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0057.745] lstrlenA (lpString="*.flac") returned 6 [0057.745] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0057.745] lstrlenA (lpString="*.ape") returned 5 [0057.745] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0057.745] lstrlenA (lpString="*.wma") returned 5 [0057.745] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0057.745] lstrlenA (lpString="*.ac3") returned 5 [0057.745] FindNextFileA (in: hFindFile=0x6368b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0057.745] FindClose (in: hFindFile=0x6368b0 | out: hFindFile=0x6368b0) returned 1 [0057.745] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="en-US", cAlternateFileName="")) returned 1 [0057.745] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0057.745] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0057.745] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0057.745] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US" [0057.745] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US") returned 56 [0057.745] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName=".", cAlternateFileName="")) returned 0x636b30 [0057.747] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.748] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="..", cAlternateFileName="")) returned 1 [0057.748] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.748] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.748] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b3bdfd4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b3e423a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1b2d8, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0057.748] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.748] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="boxed-correct.avi") returned 1 [0057.748] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="boxed-correct.avi") returned 1 [0057.748] lstrcmpiA (lpString1="", lpString2="boxed-correct.avi") returned -1 [0057.748] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*.*") returned="*.*" [0057.748] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0057.748] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0057.748] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0057.748] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0057.748] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.748] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.748] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.749] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.750] CloseHandle (hObject=0x1d0) returned 1 [0057.750] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="boxed-correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" [0057.750] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.zip") returned 0 [0057.750] lstrlenA (lpString="*.zip") returned 5 [0057.750] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.rar") returned 0 [0057.750] lstrlenA (lpString="*.rar") returned 5 [0057.750] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.7z") returned 0 [0057.750] lstrlenA (lpString="*.7z") returned 4 [0057.750] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.tar") returned 0 [0057.750] lstrlenA (lpString="*.tar") returned 5 [0057.750] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.gzip") returned 0 [0057.750] lstrlenA (lpString="*.gzip") returned 6 [0057.750] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.jpg") returned 0 [0057.750] lstrlenA (lpString="*.jpg") returned 5 [0057.750] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.jpeg") returned 0 [0057.750] lstrlenA (lpString="*.jpeg") returned 6 [0057.750] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.psd") returned 0 [0057.750] lstrlenA (lpString="*.psd") returned 5 [0057.750] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.cdr") returned 0 [0057.750] lstrlenA (lpString="*.cdr") returned 5 [0057.750] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.dwg") returned 0 [0057.750] lstrlenA (lpString="*.dwg") returned 5 [0057.750] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.max") returned 0 [0057.750] lstrlenA (lpString="*.max") returned 5 [0057.750] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.bmp") returned 0 [0057.750] lstrlenA (lpString="*.bmp") returned 5 [0057.750] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.gif") returned 0 [0057.750] lstrlenA (lpString="*.gif") returned 5 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.png") returned 0 [0057.751] lstrlenA (lpString="*.png") returned 5 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.doc") returned 0 [0057.751] lstrlenA (lpString="*.doc") returned 5 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.docx") returned 0 [0057.751] lstrlenA (lpString="*.docx") returned 6 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.xls") returned 0 [0057.751] lstrlenA (lpString="*.xls") returned 5 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.xlsx") returned 0 [0057.751] lstrlenA (lpString="*.xlsx") returned 6 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.ppt") returned 0 [0057.751] lstrlenA (lpString="*.ppt") returned 5 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.pptx") returned 0 [0057.751] lstrlenA (lpString="*.pptx") returned 6 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.txt") returned 0 [0057.751] lstrlenA (lpString="*.txt") returned 5 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.pdf") returned 0 [0057.751] lstrlenA (lpString="*.pdf") returned 5 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.djvu") returned 0 [0057.751] lstrlenA (lpString="*.djvu") returned 6 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.htm") returned 0 [0057.751] lstrlenA (lpString="*.htm") returned 5 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.html") returned 0 [0057.751] lstrlenA (lpString="*.html") returned 6 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.mdb") returned 0 [0057.751] lstrlenA (lpString="*.mdb") returned 5 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.cer") returned 0 [0057.751] lstrlenA (lpString="*.cer") returned 5 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.p12") returned 0 [0057.751] lstrlenA (lpString="*.p12") returned 5 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.pfx") returned 0 [0057.751] lstrlenA (lpString="*.pfx") returned 5 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.kwm") returned 0 [0057.751] lstrlenA (lpString="*.kwm") returned 5 [0057.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.pwm") returned 0 [0057.752] lstrlenA (lpString="*.pwm") returned 5 [0057.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.1cd") returned 0 [0057.752] lstrlenA (lpString="*.1cd") returned 5 [0057.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.md") returned 0 [0057.752] lstrlenA (lpString="*.md") returned 4 [0057.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.mdf") returned 0 [0057.752] lstrlenA (lpString="*.mdf") returned 5 [0057.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.dbf") returned 0 [0057.752] lstrlenA (lpString="*.dbf") returned 5 [0057.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.odt") returned 0 [0057.752] lstrlenA (lpString="*.odt") returned 5 [0057.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.vob") returned 0 [0057.752] lstrlenA (lpString="*.vob") returned 5 [0057.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.ifo") returned 0 [0057.752] lstrlenA (lpString="*.ifo") returned 5 [0057.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.lnk") returned 0 [0057.752] lstrlenA (lpString="*.lnk") returned 5 [0057.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.torrent") returned 0 [0057.752] lstrlenA (lpString="*.torrent") returned 9 [0057.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.mov") returned 0 [0057.752] lstrlenA (lpString="*.mov") returned 5 [0057.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.m2v") returned 0 [0057.752] lstrlenA (lpString="*.m2v") returned 5 [0057.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.3gp") returned 0 [0057.753] lstrlenA (lpString="*.3gp") returned 5 [0057.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.mpeg") returned 0 [0057.753] lstrlenA (lpString="*.mpeg") returned 6 [0057.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.mpg") returned 0 [0057.753] lstrlenA (lpString="*.mpg") returned 5 [0057.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.flv") returned 0 [0057.753] lstrlenA (lpString="*.flv") returned 5 [0057.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.avi") returned 1 [0057.753] lstrlenA (lpString="*.avi") returned 5 [0057.753] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" [0057.753] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" [0057.753] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi." [0057.753] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.", lpString2="BD" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.BD") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.BD" [0057.753] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.755] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b3e423a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b40a495, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xbf28, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0057.755] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.755] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="boxed-delete.avi") returned 1 [0057.755] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="boxed-delete.avi") returned 1 [0057.755] lstrcmpiA (lpString1="", lpString2="boxed-delete.avi") returned -1 [0057.755] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned="boxed-correct.avi" [0057.755] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0057.755] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0057.755] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0057.755] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0057.755] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="boxed-delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" [0057.755] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.zip") returned 0 [0057.755] lstrlenA (lpString="*.zip") returned 5 [0057.755] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.rar") returned 0 [0057.755] lstrlenA (lpString="*.rar") returned 5 [0057.755] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.7z") returned 0 [0057.755] lstrlenA (lpString="*.7z") returned 4 [0057.755] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.tar") returned 0 [0057.755] lstrlenA (lpString="*.tar") returned 5 [0057.755] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.gzip") returned 0 [0057.756] lstrlenA (lpString="*.gzip") returned 6 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.jpg") returned 0 [0057.756] lstrlenA (lpString="*.jpg") returned 5 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.jpeg") returned 0 [0057.756] lstrlenA (lpString="*.jpeg") returned 6 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.psd") returned 0 [0057.756] lstrlenA (lpString="*.psd") returned 5 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.cdr") returned 0 [0057.756] lstrlenA (lpString="*.cdr") returned 5 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.dwg") returned 0 [0057.756] lstrlenA (lpString="*.dwg") returned 5 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.max") returned 0 [0057.756] lstrlenA (lpString="*.max") returned 5 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.bmp") returned 0 [0057.756] lstrlenA (lpString="*.bmp") returned 5 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.gif") returned 0 [0057.756] lstrlenA (lpString="*.gif") returned 5 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.png") returned 0 [0057.756] lstrlenA (lpString="*.png") returned 5 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.doc") returned 0 [0057.756] lstrlenA (lpString="*.doc") returned 5 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.docx") returned 0 [0057.756] lstrlenA (lpString="*.docx") returned 6 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.xls") returned 0 [0057.756] lstrlenA (lpString="*.xls") returned 5 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.xlsx") returned 0 [0057.756] lstrlenA (lpString="*.xlsx") returned 6 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.ppt") returned 0 [0057.756] lstrlenA (lpString="*.ppt") returned 5 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.pptx") returned 0 [0057.756] lstrlenA (lpString="*.pptx") returned 6 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.txt") returned 0 [0057.756] lstrlenA (lpString="*.txt") returned 5 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.pdf") returned 0 [0057.756] lstrlenA (lpString="*.pdf") returned 5 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.djvu") returned 0 [0057.757] lstrlenA (lpString="*.djvu") returned 6 [0057.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.htm") returned 0 [0057.757] lstrlenA (lpString="*.htm") returned 5 [0057.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.html") returned 0 [0057.757] lstrlenA (lpString="*.html") returned 6 [0057.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.mdb") returned 0 [0057.757] lstrlenA (lpString="*.mdb") returned 5 [0057.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.cer") returned 0 [0057.757] lstrlenA (lpString="*.cer") returned 5 [0057.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.p12") returned 0 [0057.757] lstrlenA (lpString="*.p12") returned 5 [0057.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.pfx") returned 0 [0057.757] lstrlenA (lpString="*.pfx") returned 5 [0057.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.kwm") returned 0 [0057.757] lstrlenA (lpString="*.kwm") returned 5 [0057.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.pwm") returned 0 [0057.757] lstrlenA (lpString="*.pwm") returned 5 [0057.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.1cd") returned 0 [0057.757] lstrlenA (lpString="*.1cd") returned 5 [0057.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.md") returned 0 [0057.757] lstrlenA (lpString="*.md") returned 4 [0057.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.mdf") returned 0 [0057.757] lstrlenA (lpString="*.mdf") returned 5 [0057.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.dbf") returned 0 [0057.757] lstrlenA (lpString="*.dbf") returned 5 [0057.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.odt") returned 0 [0057.757] lstrlenA (lpString="*.odt") returned 5 [0057.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.vob") returned 0 [0057.757] lstrlenA (lpString="*.vob") returned 5 [0057.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.ifo") returned 0 [0057.757] lstrlenA (lpString="*.ifo") returned 5 [0057.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.lnk") returned 0 [0057.757] lstrlenA (lpString="*.lnk") returned 5 [0057.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.torrent") returned 0 [0057.757] lstrlenA (lpString="*.torrent") returned 9 [0057.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.mov") returned 0 [0057.758] lstrlenA (lpString="*.mov") returned 5 [0057.758] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.m2v") returned 0 [0057.758] lstrlenA (lpString="*.m2v") returned 5 [0057.758] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.3gp") returned 0 [0057.758] lstrlenA (lpString="*.3gp") returned 5 [0057.758] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.mpeg") returned 0 [0057.758] lstrlenA (lpString="*.mpeg") returned 6 [0057.758] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.mpg") returned 0 [0057.758] lstrlenA (lpString="*.mpg") returned 5 [0057.758] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.flv") returned 0 [0057.758] lstrlenA (lpString="*.flv") returned 5 [0057.758] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.avi") returned 1 [0057.758] lstrlenA (lpString="*.avi") returned 5 [0057.758] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" [0057.758] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" [0057.758] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi." [0057.758] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.", lpString2="BD" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.BD") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.BD" [0057.758] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.758] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b4ef2e1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b4ef2e1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb61e, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0057.758] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.758] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="boxed-join.avi") returned 1 [0057.758] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="boxed-join.avi") returned 1 [0057.758] lstrcmpiA (lpString1="", lpString2="boxed-join.avi") returned -1 [0057.758] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned="boxed-delete.avi" [0057.758] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0057.758] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0057.758] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0057.759] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0057.759] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="boxed-join.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.zip") returned 0 [0057.759] lstrlenA (lpString="*.zip") returned 5 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.rar") returned 0 [0057.759] lstrlenA (lpString="*.rar") returned 5 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.7z") returned 0 [0057.759] lstrlenA (lpString="*.7z") returned 4 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.tar") returned 0 [0057.759] lstrlenA (lpString="*.tar") returned 5 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.gzip") returned 0 [0057.759] lstrlenA (lpString="*.gzip") returned 6 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.jpg") returned 0 [0057.759] lstrlenA (lpString="*.jpg") returned 5 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.jpeg") returned 0 [0057.759] lstrlenA (lpString="*.jpeg") returned 6 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.psd") returned 0 [0057.759] lstrlenA (lpString="*.psd") returned 5 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.cdr") returned 0 [0057.759] lstrlenA (lpString="*.cdr") returned 5 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.dwg") returned 0 [0057.759] lstrlenA (lpString="*.dwg") returned 5 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.max") returned 0 [0057.759] lstrlenA (lpString="*.max") returned 5 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.bmp") returned 0 [0057.759] lstrlenA (lpString="*.bmp") returned 5 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.gif") returned 0 [0057.759] lstrlenA (lpString="*.gif") returned 5 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.png") returned 0 [0057.759] lstrlenA (lpString="*.png") returned 5 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.doc") returned 0 [0057.759] lstrlenA (lpString="*.doc") returned 5 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.docx") returned 0 [0057.760] lstrlenA (lpString="*.docx") returned 6 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.xls") returned 0 [0057.760] lstrlenA (lpString="*.xls") returned 5 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.xlsx") returned 0 [0057.760] lstrlenA (lpString="*.xlsx") returned 6 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.ppt") returned 0 [0057.760] lstrlenA (lpString="*.ppt") returned 5 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.pptx") returned 0 [0057.760] lstrlenA (lpString="*.pptx") returned 6 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.txt") returned 0 [0057.760] lstrlenA (lpString="*.txt") returned 5 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.pdf") returned 0 [0057.760] lstrlenA (lpString="*.pdf") returned 5 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.djvu") returned 0 [0057.760] lstrlenA (lpString="*.djvu") returned 6 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.htm") returned 0 [0057.760] lstrlenA (lpString="*.htm") returned 5 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.html") returned 0 [0057.760] lstrlenA (lpString="*.html") returned 6 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.mdb") returned 0 [0057.760] lstrlenA (lpString="*.mdb") returned 5 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.cer") returned 0 [0057.760] lstrlenA (lpString="*.cer") returned 5 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.p12") returned 0 [0057.760] lstrlenA (lpString="*.p12") returned 5 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.pfx") returned 0 [0057.760] lstrlenA (lpString="*.pfx") returned 5 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.kwm") returned 0 [0057.760] lstrlenA (lpString="*.kwm") returned 5 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.pwm") returned 0 [0057.760] lstrlenA (lpString="*.pwm") returned 5 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.1cd") returned 0 [0057.760] lstrlenA (lpString="*.1cd") returned 5 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.md") returned 0 [0057.760] lstrlenA (lpString="*.md") returned 4 [0057.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.mdf") returned 0 [0057.761] lstrlenA (lpString="*.mdf") returned 5 [0057.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.dbf") returned 0 [0057.761] lstrlenA (lpString="*.dbf") returned 5 [0057.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.odt") returned 0 [0057.761] lstrlenA (lpString="*.odt") returned 5 [0057.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.vob") returned 0 [0057.761] lstrlenA (lpString="*.vob") returned 5 [0057.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.ifo") returned 0 [0057.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.lnk") returned 0 [0057.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.torrent") returned 0 [0057.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.mov") returned 0 [0057.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.m2v") returned 0 [0057.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.3gp") returned 0 [0057.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.mpeg") returned 0 [0057.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.mpg") returned 0 [0057.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.flv") returned 0 [0057.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.avi") returned 1 [0057.761] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" [0057.761] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" [0057.761] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi." [0057.761] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.", lpString2="BD" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.BD") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.BD" [0057.761] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.761] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b47cbb9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b47cbb9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x148de, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0057.761] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.762] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="boxed-split.avi") returned 1 [0057.762] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="boxed-split.avi") returned 1 [0057.762] lstrcmpiA (lpString1="", lpString2="boxed-split.avi") returned -1 [0057.762] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned="boxed-join.avi" [0057.762] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0057.762] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0057.762] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0057.762] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0057.762] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="boxed-split.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" [0057.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.zip") returned 0 [0057.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.rar") returned 0 [0057.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.7z") returned 0 [0057.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.tar") returned 0 [0057.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.gzip") returned 0 [0057.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.jpg") returned 0 [0057.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.jpeg") returned 0 [0057.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.psd") returned 0 [0057.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.cdr") returned 0 [0057.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.dwg") returned 0 [0057.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.max") returned 0 [0057.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.bmp") returned 0 [0057.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.gif") returned 0 [0057.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.png") returned 0 [0057.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.doc") returned 0 [0057.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.docx") returned 0 [0057.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.xls") returned 0 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.xlsx") returned 0 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.ppt") returned 0 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.pptx") returned 0 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.txt") returned 0 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.pdf") returned 0 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.djvu") returned 0 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.htm") returned 0 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.html") returned 0 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.mdb") returned 0 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.cer") returned 0 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.p12") returned 0 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.pfx") returned 0 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.kwm") returned 0 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.pwm") returned 0 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.1cd") returned 0 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.md") returned 0 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.mdf") returned 0 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.dbf") returned 0 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.odt") returned 0 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.vob") returned 0 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.ifo") returned 0 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.lnk") returned 0 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.torrent") returned 0 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.mov") returned 0 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.m2v") returned 0 [0057.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.3gp") returned 0 [0057.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.mpeg") returned 0 [0057.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.mpg") returned 0 [0057.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.flv") returned 0 [0057.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.avi") returned 1 [0057.764] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" [0057.764] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" [0057.764] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi." [0057.764] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.", lpString2="BD" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.BD") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.BD" [0057.764] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.765] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b456971, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b47cbb9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2bfcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0057.765] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.765] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="correct.avi") returned 1 [0057.765] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="correct.avi") returned 1 [0057.765] lstrcmpiA (lpString1="", lpString2="correct.avi") returned -1 [0057.765] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned="boxed-split.avi" [0057.765] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0057.765] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0057.765] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0057.765] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0057.765] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" [0057.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.zip") returned 0 [0057.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.rar") returned 0 [0057.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.7z") returned 0 [0057.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.tar") returned 0 [0057.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.gzip") returned 0 [0057.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.jpg") returned 0 [0057.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.jpeg") returned 0 [0057.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.psd") returned 0 [0057.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.cdr") returned 0 [0057.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.dwg") returned 0 [0057.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.max") returned 0 [0057.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.bmp") returned 0 [0057.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.gif") returned 0 [0057.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.png") returned 0 [0057.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.doc") returned 0 [0057.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.docx") returned 0 [0057.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.xls") returned 0 [0057.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.xlsx") returned 0 [0057.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.ppt") returned 0 [0057.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.pptx") returned 0 [0057.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.txt") returned 0 [0057.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.pdf") returned 0 [0057.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.djvu") returned 0 [0057.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.htm") returned 0 [0057.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.html") returned 0 [0057.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.mdb") returned 0 [0057.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.cer") returned 0 [0057.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.p12") returned 0 [0057.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.pfx") returned 0 [0057.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.kwm") returned 0 [0057.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.pwm") returned 0 [0057.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.1cd") returned 0 [0057.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.md") returned 0 [0057.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.mdf") returned 0 [0057.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.dbf") returned 0 [0057.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.odt") returned 0 [0057.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.vob") returned 0 [0057.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.ifo") returned 0 [0057.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.lnk") returned 0 [0057.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.torrent") returned 0 [0057.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.mov") returned 0 [0057.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.m2v") returned 0 [0057.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.3gp") returned 0 [0057.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.mpeg") returned 0 [0057.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.mpg") returned 0 [0057.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.flv") returned 0 [0057.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.avi") returned 1 [0057.767] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" [0057.767] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" [0057.767] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi." [0057.767] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.", lpString2="BD" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.BD") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.BD" [0057.767] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.769] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b40a495, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b40a495, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x32e18, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0057.769] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.769] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="delete.avi") returned 1 [0057.769] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="delete.avi") returned 1 [0057.769] lstrcmpiA (lpString1="", lpString2="delete.avi") returned -1 [0057.769] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned="correct.avi" [0057.769] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0057.769] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0057.769] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0057.769] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0057.769] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" [0057.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", pszSpec="*.zip") returned 0 [0057.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", pszSpec="*.rar") returned 0 [0057.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", pszSpec="*.7z") returned 0 [0057.770] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", pszSpec="*.tar") returned 0 [0057.770] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", pszSpec="*.gzip") returned 0 [0057.770] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", pszSpec="*.jpg") returned 0 [0057.770] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", pszSpec="*.jpeg") returned 0 [0057.770] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", pszSpec="*.psd") returned 0 [0057.770] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", pszSpec="*.cdr") returned 0 [0057.770] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", pszSpec="*.dwg") returned 0 [0057.770] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", pszSpec="*.max") returned 0 [0057.770] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", pszSpec="*.bmp") returned 0 [0057.770] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", pszSpec="*.gif") returned 0 [0057.770] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", pszSpec="*.png") returned 0 [0057.770] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" [0057.770] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" [0057.770] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi." [0057.770] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.", lpString2="BD" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.BD") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.BD" [0057.770] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.771] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0057.771] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.771] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FlickLearningWizard.exe.mui") returned -1 [0057.771] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FlickLearningWizard.exe.mui") returned 1 [0057.771] lstrcmpiA (lpString1="", lpString2="FlickLearningWizard.exe.mui") returned -1 [0057.771] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned="delete.avi" [0057.771] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0057.771] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0057.771] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0057.772] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0057.772] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="FlickLearningWizard.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" [0057.772] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c57ed8c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9c57ed8c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9c57ed8c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0057.772] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.772] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InkObj.dll.mui") returned -1 [0057.772] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InkObj.dll.mui") returned -1 [0057.772] lstrcmpiA (lpString1="", lpString2="InkObj.dll.mui") returned -1 [0057.772] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned="FlickLearningWizard.exe.mui" [0057.772] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0057.772] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0057.772] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0057.772] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0057.772] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="InkObj.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" [0057.772] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa522aa93, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa522aa93, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa522aa93, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0057.772] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.772] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InputPersonalization.exe.mui") returned -1 [0057.772] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InputPersonalization.exe.mui") returned -1 [0057.772] lstrcmpiA (lpString1="", lpString2="InputPersonalization.exe.mui") returned -1 [0057.772] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned="InkObj.dll.mui" [0057.772] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0057.772] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0057.772] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0057.772] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0057.773] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="InputPersonalization.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" [0057.773] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0057.773] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.773] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IPSEventLogMsg.dll.mui") returned -1 [0057.773] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPSEventLogMsg.dll.mui") returned -1 [0057.773] lstrcmpiA (lpString1="", lpString2="IPSEventLogMsg.dll.mui") returned -1 [0057.773] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned="InputPersonalization.exe.mui" [0057.773] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0057.773] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0057.773] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0057.773] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0057.773] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="IPSEventLogMsg.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" [0057.773] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa522aa93, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa522aa93, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa522aa93, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0057.773] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.773] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IpsMigrationPlugin.dll.mui") returned -1 [0057.773] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IpsMigrationPlugin.dll.mui") returned -1 [0057.773] lstrcmpiA (lpString1="", lpString2="IpsMigrationPlugin.dll.mui") returned -1 [0057.773] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned="IPSEventLogMsg.dll.mui" [0057.773] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0057.773] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0057.773] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0057.773] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0057.773] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="IpsMigrationPlugin.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" [0057.774] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b5619f1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b587c54, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x30d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0057.774] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.774] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="join.avi") returned -1 [0057.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="join.avi") returned -1 [0057.774] lstrcmpiA (lpString1="", lpString2="join.avi") returned -1 [0057.774] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned="IpsMigrationPlugin.dll.mui" [0057.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0057.774] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0057.774] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0057.774] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0057.774] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="join.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" [0057.774] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" [0057.774] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" [0057.774] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi." [0057.774] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.", lpString2="BD" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.BD") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.BD" [0057.774] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.775] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0057.775] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.775] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="micaut.dll.mui") returned -1 [0057.775] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="micaut.dll.mui") returned -1 [0057.775] lstrcmpiA (lpString1="", lpString2="micaut.dll.mui") returned -1 [0057.775] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned="join.avi" [0057.775] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0057.775] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0057.775] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0057.775] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0057.775] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="micaut.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" [0057.776] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0057.776] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.776] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mip.exe.mui") returned -1 [0057.776] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mip.exe.mui") returned -1 [0057.776] lstrcmpiA (lpString1="", lpString2="mip.exe.mui") returned -1 [0057.776] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned="micaut.dll.mui" [0057.776] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0057.776] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0057.776] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0057.776] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0057.776] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="mip.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" [0057.776] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa522aa93, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa522aa93, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa522aa93, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0057.776] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.776] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mshwLatin.dll.mui") returned -1 [0057.776] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mshwLatin.dll.mui") returned -1 [0057.776] lstrcmpiA (lpString1="", lpString2="mshwLatin.dll.mui") returned -1 [0057.776] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned="mip.exe.mui" [0057.776] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0057.776] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0057.776] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0057.776] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0057.776] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="mshwLatin.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" [0057.776] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c558b79, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9c558b79, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9c558b79, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0057.776] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.777] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtscom.dll.mui") returned -1 [0057.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtscom.dll.mui") returned -1 [0057.777] lstrcmpiA (lpString1="", lpString2="rtscom.dll.mui") returned -1 [0057.777] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned="mshwLatin.dll.mui" [0057.777] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0057.777] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0057.777] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0057.777] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0057.777] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="rtscom.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" [0057.777] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa522aa93, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa522aa93, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa522aa93, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0057.777] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.777] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ShapeCollector.exe.mui") returned -1 [0057.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ShapeCollector.exe.mui") returned -1 [0057.777] lstrcmpiA (lpString1="", lpString2="ShapeCollector.exe.mui") returned -1 [0057.777] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned="rtscom.dll.mui" [0057.777] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0057.777] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0057.777] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0057.777] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0057.777] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="ShapeCollector.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" [0057.777] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b47cbb9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b4a2e36, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2c6cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0057.777] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.777] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="split.avi") returned -1 [0057.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="split.avi") returned -1 [0057.777] lstrcmpiA (lpString1="", lpString2="split.avi") returned -1 [0057.777] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui") returned="ShapeCollector.exe.mui" [0057.778] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0057.778] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0057.778] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0057.778] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0057.778] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="split.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" [0057.778] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" [0057.778] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" [0057.778] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi." [0057.778] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.", lpString2="BD" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.BD") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.BD" [0057.778] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.786] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a4fbf, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9c5a4fbf, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9c5a4fbf, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0057.786] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.786] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tabskb.dll.mui") returned -1 [0057.786] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tabskb.dll.mui") returned -1 [0057.786] lstrcmpiA (lpString1="", lpString2="tabskb.dll.mui") returned -1 [0057.786] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned="split.avi" [0057.786] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0057.786] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0057.786] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0057.786] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0057.787] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="tabskb.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" [0057.787] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe.mui", cAlternateFileName="")) returned 1 [0057.787] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.787] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TabTip.exe.mui") returned -1 [0057.787] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TabTip.exe.mui") returned -1 [0057.787] lstrcmpiA (lpString1="", lpString2="TabTip.exe.mui") returned -1 [0057.787] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned="tabskb.dll.mui" [0057.787] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0057.787] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0057.787] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0057.787] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0057.787] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="TabTip.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" [0057.787] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x6400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0057.787] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.787] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TipRes.dll.mui") returned -1 [0057.787] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipRes.dll.mui") returned -1 [0057.787] lstrcmpiA (lpString1="", lpString2="TipRes.dll.mui") returned -1 [0057.787] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui") returned="TabTip.exe.mui" [0057.787] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0057.787] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0057.787] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0057.787] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0057.787] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="TipRes.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" [0057.788] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0057.788] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.788] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0057.788] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0057.788] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0057.788] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui") returned="TipRes.dll.mui" [0057.788] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0057.788] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0057.788] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0057.788] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0057.788] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" [0057.788] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa522aa93, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa522aa93, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa522aa93, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0057.788] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.788] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TipTsf.dll.mui") returned -1 [0057.788] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipTsf.dll.mui") returned -1 [0057.788] lstrcmpiA (lpString1="", lpString2="TipTsf.dll.mui") returned -1 [0057.788] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned="tipresx.dll.mui" [0057.788] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0057.788] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0057.788] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0057.788] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0057.788] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="TipTsf.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" [0057.788] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa522aa93, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa522aa93, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa522aa93, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0057.788] FindClose (in: hFindFile=0x636b30 | out: hFindFile=0x636b30) returned 1 [0057.789] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="es-ES", cAlternateFileName="")) returned 1 [0057.789] lstrcmpA (lpString1=".", lpString2="es-ES") returned -1 [0057.789] lstrcmpA (lpString1="..", lpString2="es-ES") returned -1 [0057.789] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0057.789] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="es-ES" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES" [0057.789] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636b30 [0057.789] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.789] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.789] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.789] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.789] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0057.789] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.789] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0057.789] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0057.789] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0057.789] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\*.*") returned="*.*" [0057.790] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\" [0057.790] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\") returned="" [0057.790] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\HOW TO DECRYPT FILES.txt" [0057.790] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\how to decrypt files.txt")) returned 0xffffffff [0057.790] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.790] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.791] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.791] CloseHandle (hObject=0x1d0) returned 1 [0057.791] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" [0057.792] lstrlenA (lpString="*.zip") returned 5 [0057.792] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0057.792] lstrlenA (lpString="*.rar") returned 5 [0057.792] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0057.792] lstrlenA (lpString="*.7z") returned 4 [0057.792] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0057.792] lstrlenA (lpString="*.tar") returned 5 [0057.792] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0057.792] lstrlenA (lpString="*.gzip") returned 6 [0057.792] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0057.792] lstrlenA (lpString="*.jpg") returned 5 [0057.792] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0057.792] lstrlenA (lpString="*.jpeg") returned 6 [0057.792] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0057.792] lstrlenA (lpString="*.psd") returned 5 [0057.792] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0057.792] lstrlenA (lpString="*.cdr") returned 5 [0057.792] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0057.792] lstrlenA (lpString="*.dwg") returned 5 [0057.792] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0057.792] lstrlenA (lpString="*.max") returned 5 [0057.792] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0057.792] lstrlenA (lpString="*.bmp") returned 5 [0057.792] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0057.792] lstrlenA (lpString="*.gif") returned 5 [0057.792] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0057.792] lstrlenA (lpString="*.png") returned 5 [0057.792] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0057.792] lstrlenA (lpString="*.doc") returned 5 [0057.792] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0057.792] lstrlenA (lpString="*.docx") returned 6 [0057.792] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0057.792] lstrlenA (lpString="*.xls") returned 5 [0057.792] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0057.793] lstrlenA (lpString="*.xlsx") returned 6 [0057.793] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0057.793] lstrlenA (lpString="*.ppt") returned 5 [0057.793] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0057.793] lstrlenA (lpString="*.pptx") returned 6 [0057.793] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0057.793] lstrlenA (lpString="*.txt") returned 5 [0057.793] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0057.793] lstrlenA (lpString="*.pdf") returned 5 [0057.793] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0057.793] lstrlenA (lpString="*.djvu") returned 6 [0057.793] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0057.793] lstrlenA (lpString="*.htm") returned 5 [0057.793] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0057.793] lstrlenA (lpString="*.html") returned 6 [0057.793] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0057.793] lstrlenA (lpString="*.mdb") returned 5 [0057.793] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0057.793] lstrlenA (lpString="*.cer") returned 5 [0057.793] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0057.793] lstrlenA (lpString="*.p12") returned 5 [0057.793] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0057.793] lstrlenA (lpString="*.pfx") returned 5 [0057.793] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0057.793] lstrlenA (lpString="*.kwm") returned 5 [0057.793] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0057.793] lstrlenA (lpString="*.pwm") returned 5 [0057.793] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0057.793] lstrlenA (lpString="*.1cd") returned 5 [0057.793] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0057.793] lstrlenA (lpString="*.md") returned 4 [0057.793] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0057.793] lstrlenA (lpString="*.mdf") returned 5 [0057.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0057.794] lstrlenA (lpString="*.dbf") returned 5 [0057.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0057.794] lstrlenA (lpString="*.odt") returned 5 [0057.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0057.794] lstrlenA (lpString="*.vob") returned 5 [0057.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0057.794] lstrlenA (lpString="*.ifo") returned 5 [0057.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0057.794] lstrlenA (lpString="*.lnk") returned 5 [0057.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0057.794] lstrlenA (lpString="*.torrent") returned 9 [0057.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0057.794] lstrlenA (lpString="*.mov") returned 5 [0057.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0057.794] lstrlenA (lpString="*.m2v") returned 5 [0057.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0057.794] lstrlenA (lpString="*.3gp") returned 5 [0057.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0057.794] lstrlenA (lpString="*.mpeg") returned 6 [0057.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0057.794] lstrlenA (lpString="*.mpg") returned 5 [0057.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0057.794] lstrlenA (lpString="*.flv") returned 5 [0057.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0057.794] lstrlenA (lpString="*.avi") returned 5 [0057.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0057.794] lstrlenA (lpString="*.mp4") returned 5 [0057.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0057.794] lstrlenA (lpString="*.wmv") returned 5 [0057.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0057.794] lstrlenA (lpString="*.divx") returned 6 [0057.795] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0057.795] lstrlenA (lpString="*.mkv") returned 5 [0057.795] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0057.795] lstrlenA (lpString="*.mp3") returned 5 [0057.795] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0057.795] lstrlenA (lpString="*.wav") returned 5 [0057.795] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0057.795] lstrlenA (lpString="*.flac") returned 6 [0057.795] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0057.795] lstrlenA (lpString="*.ape") returned 5 [0057.795] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0057.795] lstrlenA (lpString="*.wma") returned 5 [0057.795] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0057.795] lstrlenA (lpString="*.ac3") returned 5 [0057.795] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0057.795] FindClose (in: hFindFile=0x636b30 | out: hFindFile=0x636b30) returned 1 [0057.795] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="es-MX", cAlternateFileName="")) returned 1 [0057.795] lstrcmpA (lpString1=".", lpString2="es-MX") returned -1 [0057.795] lstrcmpA (lpString1="..", lpString2="es-MX") returned -1 [0057.795] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0057.795] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="es-MX" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX" [0057.795] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX") returned 56 [0057.795] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName=".", cAlternateFileName="")) returned 0x6369f0 [0057.796] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.796] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="..", cAlternateFileName="")) returned 1 [0057.796] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.796] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.796] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0057.796] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.796] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0057.796] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0057.796] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0057.796] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\*.*") returned="*.*" [0057.796] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\" [0057.796] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\") returned="" [0057.796] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\HOW TO DECRYPT FILES.txt" [0057.796] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\how to decrypt files.txt")) returned 0xffffffff [0057.796] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.796] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.796] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.798] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.798] CloseHandle (hObject=0x1d0) returned 1 [0057.798] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" [0057.798] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0057.798] lstrlenA (lpString="*.zip") returned 5 [0057.798] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0057.798] lstrlenA (lpString="*.rar") returned 5 [0057.798] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0057.798] lstrlenA (lpString="*.7z") returned 4 [0057.798] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0057.798] lstrlenA (lpString="*.tar") returned 5 [0057.798] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0057.798] lstrlenA (lpString="*.gzip") returned 6 [0057.798] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0057.798] lstrlenA (lpString="*.jpg") returned 5 [0057.805] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0057.805] lstrlenA (lpString="*.jpeg") returned 6 [0057.805] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0057.805] lstrlenA (lpString="*.psd") returned 5 [0057.805] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0057.805] lstrlenA (lpString="*.cdr") returned 5 [0057.805] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0057.805] lstrlenA (lpString="*.dwg") returned 5 [0057.805] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0057.805] lstrlenA (lpString="*.max") returned 5 [0057.805] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0057.805] lstrlenA (lpString="*.bmp") returned 5 [0057.805] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0057.805] lstrlenA (lpString="*.gif") returned 5 [0057.805] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0057.805] lstrlenA (lpString="*.png") returned 5 [0057.805] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0057.805] lstrlenA (lpString="*.doc") returned 5 [0057.805] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0057.805] lstrlenA (lpString="*.docx") returned 6 [0057.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0057.806] lstrlenA (lpString="*.xls") returned 5 [0057.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0057.806] lstrlenA (lpString="*.xlsx") returned 6 [0057.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0057.806] lstrlenA (lpString="*.ppt") returned 5 [0057.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0057.806] lstrlenA (lpString="*.pptx") returned 6 [0057.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0057.806] lstrlenA (lpString="*.txt") returned 5 [0057.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0057.806] lstrlenA (lpString="*.pdf") returned 5 [0057.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0057.806] lstrlenA (lpString="*.djvu") returned 6 [0057.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0057.806] lstrlenA (lpString="*.htm") returned 5 [0057.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0057.806] lstrlenA (lpString="*.html") returned 6 [0057.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0057.806] lstrlenA (lpString="*.mdb") returned 5 [0057.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0057.806] lstrlenA (lpString="*.cer") returned 5 [0057.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0057.806] lstrlenA (lpString="*.p12") returned 5 [0057.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0057.806] lstrlenA (lpString="*.pfx") returned 5 [0057.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0057.806] lstrlenA (lpString="*.kwm") returned 5 [0057.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0057.806] lstrlenA (lpString="*.pwm") returned 5 [0057.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0057.806] lstrlenA (lpString="*.1cd") returned 5 [0057.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0057.807] lstrlenA (lpString="*.md") returned 4 [0057.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0057.807] lstrlenA (lpString="*.mdf") returned 5 [0057.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0057.807] lstrlenA (lpString="*.dbf") returned 5 [0057.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0057.807] lstrlenA (lpString="*.odt") returned 5 [0057.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0057.807] lstrlenA (lpString="*.vob") returned 5 [0057.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0057.807] lstrlenA (lpString="*.ifo") returned 5 [0057.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0057.807] lstrlenA (lpString="*.lnk") returned 5 [0057.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0057.807] lstrlenA (lpString="*.torrent") returned 9 [0057.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0057.807] lstrlenA (lpString="*.mov") returned 5 [0057.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0057.807] lstrlenA (lpString="*.m2v") returned 5 [0057.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0057.807] lstrlenA (lpString="*.3gp") returned 5 [0057.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0057.807] lstrlenA (lpString="*.mpeg") returned 6 [0057.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0057.807] lstrlenA (lpString="*.mpg") returned 5 [0057.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0057.807] lstrlenA (lpString="*.flv") returned 5 [0057.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0057.807] lstrlenA (lpString="*.avi") returned 5 [0057.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0057.807] lstrlenA (lpString="*.mp4") returned 5 [0057.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0057.807] lstrlenA (lpString="*.wmv") returned 5 [0057.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0057.808] lstrlenA (lpString="*.divx") returned 6 [0057.808] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0057.808] lstrlenA (lpString="*.mkv") returned 5 [0057.808] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0057.808] lstrlenA (lpString="*.mp3") returned 5 [0057.808] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0057.808] lstrlenA (lpString="*.wav") returned 5 [0057.808] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0057.808] lstrlenA (lpString="*.flac") returned 6 [0057.808] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0057.808] lstrlenA (lpString="*.ape") returned 5 [0057.808] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0057.808] lstrlenA (lpString="*.wma") returned 5 [0057.808] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0057.808] lstrlenA (lpString="*.ac3") returned 5 [0057.808] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0057.808] FindClose (in: hFindFile=0x6369f0 | out: hFindFile=0x6369f0) returned 1 [0057.808] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="et-EE", cAlternateFileName="")) returned 1 [0057.808] lstrcmpA (lpString1=".", lpString2="et-EE") returned -1 [0057.808] lstrcmpA (lpString1="..", lpString2="et-EE") returned -1 [0057.808] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0057.808] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="et-EE" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE" [0057.808] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE") returned 56 [0057.808] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName=".", cAlternateFileName="")) returned 0x6364b0 [0057.809] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.809] FindNextFileA (in: hFindFile=0x6364b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="..", cAlternateFileName="")) returned 1 [0057.809] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.809] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.809] FindNextFileA (in: hFindFile=0x6364b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0057.809] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.809] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0057.809] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0057.809] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0057.809] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\*.*") returned="*.*" [0057.809] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\" [0057.810] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\") returned="" [0057.810] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\HOW TO DECRYPT FILES.txt" [0057.810] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\how to decrypt files.txt")) returned 0xffffffff [0057.810] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.810] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.810] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.811] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.811] CloseHandle (hObject=0x1d0) returned 1 [0057.811] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" [0057.811] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0057.811] lstrlenA (lpString="*.zip") returned 5 [0057.811] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0057.811] lstrlenA (lpString="*.rar") returned 5 [0057.811] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0057.811] lstrlenA (lpString="*.7z") returned 4 [0057.812] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0057.812] lstrlenA (lpString="*.tar") returned 5 [0057.812] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0057.812] lstrlenA (lpString="*.gzip") returned 6 [0057.812] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0057.812] lstrlenA (lpString="*.jpg") returned 5 [0057.812] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0057.812] lstrlenA (lpString="*.jpeg") returned 6 [0057.812] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0057.812] lstrlenA (lpString="*.psd") returned 5 [0057.812] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0057.812] lstrlenA (lpString="*.cdr") returned 5 [0057.812] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0057.812] lstrlenA (lpString="*.dwg") returned 5 [0057.812] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0057.812] lstrlenA (lpString="*.max") returned 5 [0057.812] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0057.812] lstrlenA (lpString="*.bmp") returned 5 [0057.812] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0057.812] lstrlenA (lpString="*.gif") returned 5 [0057.812] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0057.812] lstrlenA (lpString="*.png") returned 5 [0057.812] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0057.812] lstrlenA (lpString="*.doc") returned 5 [0057.812] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0057.812] lstrlenA (lpString="*.docx") returned 6 [0057.812] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0057.812] lstrlenA (lpString="*.xls") returned 5 [0057.812] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0057.812] lstrlenA (lpString="*.xlsx") returned 6 [0057.812] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0057.812] lstrlenA (lpString="*.ppt") returned 5 [0057.812] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0057.812] lstrlenA (lpString="*.pptx") returned 6 [0057.813] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0057.813] lstrlenA (lpString="*.txt") returned 5 [0057.813] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0057.813] lstrlenA (lpString="*.pdf") returned 5 [0057.813] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0057.813] lstrlenA (lpString="*.djvu") returned 6 [0057.813] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0057.813] lstrlenA (lpString="*.htm") returned 5 [0057.813] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0057.813] lstrlenA (lpString="*.html") returned 6 [0057.813] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0057.813] lstrlenA (lpString="*.mdb") returned 5 [0057.813] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0057.813] lstrlenA (lpString="*.cer") returned 5 [0057.813] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0057.813] lstrlenA (lpString="*.p12") returned 5 [0057.813] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0057.813] lstrlenA (lpString="*.pfx") returned 5 [0057.813] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0057.813] lstrlenA (lpString="*.kwm") returned 5 [0057.813] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0057.813] lstrlenA (lpString="*.pwm") returned 5 [0057.813] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0057.813] lstrlenA (lpString="*.1cd") returned 5 [0057.813] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0057.813] lstrlenA (lpString="*.md") returned 4 [0057.813] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0057.813] lstrlenA (lpString="*.mdf") returned 5 [0057.813] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0057.813] lstrlenA (lpString="*.dbf") returned 5 [0057.813] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0057.813] lstrlenA (lpString="*.odt") returned 5 [0057.813] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0057.813] lstrlenA (lpString="*.vob") returned 5 [0057.814] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0057.814] lstrlenA (lpString="*.ifo") returned 5 [0057.814] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0057.814] lstrlenA (lpString="*.lnk") returned 5 [0057.814] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0057.814] lstrlenA (lpString="*.torrent") returned 9 [0057.814] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0057.814] lstrlenA (lpString="*.mov") returned 5 [0057.814] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0057.814] lstrlenA (lpString="*.m2v") returned 5 [0057.814] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0057.814] lstrlenA (lpString="*.3gp") returned 5 [0057.814] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0057.814] lstrlenA (lpString="*.mpeg") returned 6 [0057.814] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0057.814] lstrlenA (lpString="*.mpg") returned 5 [0057.814] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0057.814] lstrlenA (lpString="*.flv") returned 5 [0057.814] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0057.814] lstrlenA (lpString="*.avi") returned 5 [0057.814] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0057.814] lstrlenA (lpString="*.mp4") returned 5 [0057.814] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0057.814] lstrlenA (lpString="*.wmv") returned 5 [0057.814] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0057.814] lstrlenA (lpString="*.divx") returned 6 [0057.815] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0057.815] lstrlenA (lpString="*.mkv") returned 5 [0057.815] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0057.815] lstrlenA (lpString="*.mp3") returned 5 [0057.815] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0057.815] lstrlenA (lpString="*.wav") returned 5 [0057.815] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0057.815] lstrlenA (lpString="*.flac") returned 6 [0057.815] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0057.815] lstrlenA (lpString="*.ape") returned 5 [0057.815] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0057.815] lstrlenA (lpString="*.wma") returned 5 [0057.815] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0057.815] lstrlenA (lpString="*.ac3") returned 5 [0057.815] FindNextFileA (in: hFindFile=0x6364b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0057.815] FindClose (in: hFindFile=0x6364b0 | out: hFindFile=0x6364b0) returned 1 [0057.815] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0057.815] lstrcmpA (lpString1=".", lpString2="fi-FI") returned -1 [0057.815] lstrcmpA (lpString1="..", lpString2="fi-FI") returned -1 [0057.815] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0057.815] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="fi-FI" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI" [0057.815] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI") returned 56 [0057.815] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName=".", cAlternateFileName="")) returned 0x6368b0 [0057.816] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.816] FindNextFileA (in: hFindFile=0x6368b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="..", cAlternateFileName="")) returned 1 [0057.816] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.816] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.816] FindNextFileA (in: hFindFile=0x6368b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16702634, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16702634, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16702634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0057.816] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.816] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0057.816] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0057.816] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0057.816] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\*.*") returned="*.*" [0057.816] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\" [0057.816] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\") returned="" [0057.816] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\HOW TO DECRYPT FILES.txt" [0057.816] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\how to decrypt files.txt")) returned 0xffffffff [0057.816] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.817] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.817] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.818] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.818] CloseHandle (hObject=0x1d0) returned 1 [0057.818] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" [0057.818] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0057.819] lstrlenA (lpString="*.zip") returned 5 [0057.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0057.819] lstrlenA (lpString="*.rar") returned 5 [0057.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0057.819] lstrlenA (lpString="*.7z") returned 4 [0057.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0057.819] lstrlenA (lpString="*.tar") returned 5 [0057.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0057.819] lstrlenA (lpString="*.gzip") returned 6 [0057.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0057.819] lstrlenA (lpString="*.jpg") returned 5 [0057.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0057.819] lstrlenA (lpString="*.jpeg") returned 6 [0057.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0057.819] lstrlenA (lpString="*.psd") returned 5 [0057.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0057.819] lstrlenA (lpString="*.cdr") returned 5 [0057.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0057.819] lstrlenA (lpString="*.dwg") returned 5 [0057.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0057.819] lstrlenA (lpString="*.max") returned 5 [0057.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0057.819] lstrlenA (lpString="*.bmp") returned 5 [0057.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0057.819] lstrlenA (lpString="*.gif") returned 5 [0057.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0057.819] lstrlenA (lpString="*.png") returned 5 [0057.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0057.819] lstrlenA (lpString="*.doc") returned 5 [0057.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0057.819] lstrlenA (lpString="*.docx") returned 6 [0057.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0057.819] lstrlenA (lpString="*.xls") returned 5 [0057.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0057.820] lstrlenA (lpString="*.xlsx") returned 6 [0057.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0057.820] lstrlenA (lpString="*.ppt") returned 5 [0057.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0057.820] lstrlenA (lpString="*.pptx") returned 6 [0057.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0057.820] lstrlenA (lpString="*.txt") returned 5 [0057.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0057.820] lstrlenA (lpString="*.pdf") returned 5 [0057.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0057.820] lstrlenA (lpString="*.djvu") returned 6 [0057.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0057.820] lstrlenA (lpString="*.htm") returned 5 [0057.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0057.820] lstrlenA (lpString="*.html") returned 6 [0057.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0057.820] lstrlenA (lpString="*.mdb") returned 5 [0057.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0057.820] lstrlenA (lpString="*.cer") returned 5 [0057.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0057.820] lstrlenA (lpString="*.p12") returned 5 [0057.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0057.820] lstrlenA (lpString="*.pfx") returned 5 [0057.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0057.820] lstrlenA (lpString="*.kwm") returned 5 [0057.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0057.820] lstrlenA (lpString="*.pwm") returned 5 [0057.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0057.820] lstrlenA (lpString="*.1cd") returned 5 [0057.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0057.820] lstrlenA (lpString="*.md") returned 4 [0057.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0057.820] lstrlenA (lpString="*.mdf") returned 5 [0057.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0057.821] lstrlenA (lpString="*.dbf") returned 5 [0057.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0057.821] lstrlenA (lpString="*.odt") returned 5 [0057.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0057.821] lstrlenA (lpString="*.vob") returned 5 [0057.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0057.821] lstrlenA (lpString="*.ifo") returned 5 [0057.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0057.821] lstrlenA (lpString="*.lnk") returned 5 [0057.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0057.821] lstrlenA (lpString="*.torrent") returned 9 [0057.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0057.821] lstrlenA (lpString="*.mov") returned 5 [0057.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0057.821] lstrlenA (lpString="*.m2v") returned 5 [0057.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0057.821] lstrlenA (lpString="*.3gp") returned 5 [0057.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0057.821] lstrlenA (lpString="*.mpeg") returned 6 [0057.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0057.821] lstrlenA (lpString="*.mpg") returned 5 [0057.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0057.821] lstrlenA (lpString="*.flv") returned 5 [0057.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0057.821] lstrlenA (lpString="*.avi") returned 5 [0057.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0057.821] lstrlenA (lpString="*.mp4") returned 5 [0057.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0057.821] lstrlenA (lpString="*.wmv") returned 5 [0057.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0057.821] lstrlenA (lpString="*.divx") returned 6 [0057.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0057.821] lstrlenA (lpString="*.mkv") returned 5 [0057.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0057.822] lstrlenA (lpString="*.mp3") returned 5 [0057.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0057.822] lstrlenA (lpString="*.wav") returned 5 [0057.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0057.822] lstrlenA (lpString="*.flac") returned 6 [0057.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0057.822] lstrlenA (lpString="*.ape") returned 5 [0057.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0057.822] lstrlenA (lpString="*.wma") returned 5 [0057.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0057.822] lstrlenA (lpString="*.ac3") returned 5 [0057.822] FindNextFileA (in: hFindFile=0x6368b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16702634, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16702634, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16702634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0057.822] FindClose (in: hFindFile=0x6368b0 | out: hFindFile=0x6368b0) returned 1 [0057.822] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37da94b9, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5ab195d5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5abb1fd7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0057.822] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0057.822] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FlickAnimation.avi") returned -1 [0057.822] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FlickAnimation.avi") returned 1 [0057.822] lstrcmpiA (lpString1="", lpString2="FlickAnimation.avi") returned -1 [0057.822] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0057.822] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0057.822] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0057.822] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0057.822] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0057.822] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="FlickAnimation.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" [0057.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.zip") returned 0 [0057.822] lstrlenA (lpString="*.zip") returned 5 [0057.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.rar") returned 0 [0057.822] lstrlenA (lpString="*.rar") returned 5 [0057.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.7z") returned 0 [0057.823] lstrlenA (lpString="*.7z") returned 4 [0057.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.tar") returned 0 [0057.823] lstrlenA (lpString="*.tar") returned 5 [0057.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.gzip") returned 0 [0057.823] lstrlenA (lpString="*.gzip") returned 6 [0057.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.jpg") returned 0 [0057.823] lstrlenA (lpString="*.jpg") returned 5 [0057.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.jpeg") returned 0 [0057.823] lstrlenA (lpString="*.jpeg") returned 6 [0057.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.psd") returned 0 [0057.823] lstrlenA (lpString="*.psd") returned 5 [0057.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.cdr") returned 0 [0057.823] lstrlenA (lpString="*.cdr") returned 5 [0057.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.dwg") returned 0 [0057.823] lstrlenA (lpString="*.dwg") returned 5 [0057.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.max") returned 0 [0057.823] lstrlenA (lpString="*.max") returned 5 [0057.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.bmp") returned 0 [0057.823] lstrlenA (lpString="*.bmp") returned 5 [0057.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.gif") returned 0 [0057.823] lstrlenA (lpString="*.gif") returned 5 [0057.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.png") returned 0 [0057.823] lstrlenA (lpString="*.png") returned 5 [0057.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.doc") returned 0 [0057.823] lstrlenA (lpString="*.doc") returned 5 [0057.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.docx") returned 0 [0057.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.xls") returned 0 [0057.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.xlsx") returned 0 [0057.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.ppt") returned 0 [0057.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.pptx") returned 0 [0057.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.txt") returned 0 [0057.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.pdf") returned 0 [0057.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.djvu") returned 0 [0057.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.htm") returned 0 [0057.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.html") returned 0 [0057.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.mdb") returned 0 [0057.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.cer") returned 0 [0057.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.p12") returned 0 [0057.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.pfx") returned 0 [0057.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.kwm") returned 0 [0057.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.pwm") returned 0 [0057.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.1cd") returned 0 [0057.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.md") returned 0 [0057.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.mdf") returned 0 [0057.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.dbf") returned 0 [0057.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.odt") returned 0 [0057.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.vob") returned 0 [0057.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.ifo") returned 0 [0057.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.lnk") returned 0 [0057.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.torrent") returned 0 [0057.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.mov") returned 0 [0057.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.m2v") returned 0 [0057.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.3gp") returned 0 [0057.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.mpeg") returned 0 [0057.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.mpg") returned 0 [0057.825] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.flv") returned 0 [0057.825] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.avi") returned 1 [0057.825] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" [0057.825] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" [0057.825] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi." [0057.825] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.", lpString2="BD" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.BD") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.BD" [0057.825] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.829] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37da94b9, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5abd7ff0, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5ac24455, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xc5400, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0057.829] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0057.829] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FlickLearningWizard.exe") returned -1 [0057.829] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FlickLearningWizard.exe") returned 1 [0057.829] lstrcmpiA (lpString1="", lpString2="FlickLearningWizard.exe") returned -1 [0057.829] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned="FlickAnimation.avi" [0057.829] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0057.829] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0057.829] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0057.829] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0057.829] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="FlickLearningWizard.exe" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" [0057.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.zip") returned 0 [0057.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.rar") returned 0 [0057.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.7z") returned 0 [0057.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.tar") returned 0 [0057.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.gzip") returned 0 [0057.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.jpg") returned 0 [0057.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.jpeg") returned 0 [0057.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.psd") returned 0 [0057.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.cdr") returned 0 [0057.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.dwg") returned 0 [0057.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.max") returned 0 [0057.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.bmp") returned 0 [0057.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.gif") returned 0 [0057.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.png") returned 0 [0057.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.doc") returned 0 [0057.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.docx") returned 0 [0057.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.xls") returned 0 [0057.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.xlsx") returned 0 [0057.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.ppt") returned 0 [0057.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.pptx") returned 0 [0057.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.txt") returned 0 [0057.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.pdf") returned 0 [0057.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.djvu") returned 0 [0057.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.htm") returned 0 [0057.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.html") returned 0 [0057.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.mdb") returned 0 [0057.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.cer") returned 0 [0057.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.p12") returned 0 [0057.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.pfx") returned 0 [0057.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.kwm") returned 0 [0057.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.pwm") returned 0 [0057.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.1cd") returned 0 [0057.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.md") returned 0 [0057.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.mdf") returned 0 [0057.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.dbf") returned 0 [0057.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.odt") returned 0 [0057.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.vob") returned 0 [0057.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.ifo") returned 0 [0057.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.lnk") returned 0 [0057.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.torrent") returned 0 [0057.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.mov") returned 0 [0057.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.m2v") returned 0 [0057.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.3gp") returned 0 [0057.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.mpeg") returned 0 [0057.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.mpg") returned 0 [0057.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.flv") returned 0 [0057.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.avi") returned 0 [0057.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.mp4") returned 0 [0057.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.wmv") returned 0 [0057.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.divx") returned 0 [0057.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.mkv") returned 0 [0057.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.mp3") returned 0 [0057.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.wav") returned 0 [0057.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.flac") returned 0 [0057.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.ape") returned 0 [0057.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.wma") returned 0 [0057.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.ac3") returned 0 [0057.832] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0057.832] lstrcmpA (lpString1=".", lpString2="fr-CA") returned -1 [0057.832] lstrcmpA (lpString1="..", lpString2="fr-CA") returned -1 [0057.832] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned="FlickLearningWizard.exe" [0057.832] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="fr-CA" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA" [0057.832] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0xa0, cFileName=".", cAlternateFileName="")) returned 0x6364b0 [0057.832] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.832] FindNextFileA (in: hFindFile=0x6364b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0xa0, cFileName="..", cAlternateFileName="")) returned 1 [0057.833] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.833] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.833] FindNextFileA (in: hFindFile=0x6364b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16702634, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16702634, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16702634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x77792cf0, dwReserved1=0xa0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0057.833] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.833] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0057.833] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0057.833] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0057.833] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\*.*") returned="*.*" [0057.833] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\" [0057.833] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\") returned="" [0057.833] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\HOW TO DECRYPT FILES.txt" [0057.833] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\how to decrypt files.txt")) returned 0xffffffff [0057.833] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.833] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.834] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.834] CloseHandle (hObject=0x1d0) returned 1 [0057.835] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" [0057.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0057.835] lstrlenA (lpString="*.zip") returned 5 [0057.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0057.835] lstrlenA (lpString="*.rar") returned 5 [0057.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0057.835] lstrlenA (lpString="*.7z") returned 4 [0057.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0057.835] lstrlenA (lpString="*.tar") returned 5 [0057.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0057.835] lstrlenA (lpString="*.gzip") returned 6 [0057.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0057.835] lstrlenA (lpString="*.jpg") returned 5 [0057.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0057.835] lstrlenA (lpString="*.jpeg") returned 6 [0057.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0057.835] lstrlenA (lpString="*.psd") returned 5 [0057.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0057.835] lstrlenA (lpString="*.cdr") returned 5 [0057.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0057.835] lstrlenA (lpString="*.dwg") returned 5 [0057.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0057.835] lstrlenA (lpString="*.max") returned 5 [0057.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0057.835] lstrlenA (lpString="*.bmp") returned 5 [0057.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0057.835] lstrlenA (lpString="*.gif") returned 5 [0057.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0057.835] lstrlenA (lpString="*.png") returned 5 [0057.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0057.835] lstrlenA (lpString="*.doc") returned 5 [0057.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0057.836] lstrlenA (lpString="*.docx") returned 6 [0057.836] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0057.836] lstrlenA (lpString="*.xls") returned 5 [0057.836] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0057.836] lstrlenA (lpString="*.xlsx") returned 6 [0057.836] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0057.836] lstrlenA (lpString="*.ppt") returned 5 [0057.836] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0057.836] lstrlenA (lpString="*.pptx") returned 6 [0057.836] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0057.836] lstrlenA (lpString="*.txt") returned 5 [0057.836] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0057.836] lstrlenA (lpString="*.pdf") returned 5 [0057.836] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0057.836] lstrlenA (lpString="*.djvu") returned 6 [0057.836] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0057.836] lstrlenA (lpString="*.htm") returned 5 [0057.836] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0057.836] lstrlenA (lpString="*.html") returned 6 [0057.836] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0057.836] lstrlenA (lpString="*.mdb") returned 5 [0057.836] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0057.836] lstrlenA (lpString="*.cer") returned 5 [0057.836] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0057.836] lstrlenA (lpString="*.p12") returned 5 [0057.836] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0057.836] lstrlenA (lpString="*.pfx") returned 5 [0057.836] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0057.836] lstrlenA (lpString="*.kwm") returned 5 [0057.836] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0057.836] lstrlenA (lpString="*.pwm") returned 5 [0057.836] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0057.836] lstrlenA (lpString="*.1cd") returned 5 [0057.836] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0057.837] lstrlenA (lpString="*.md") returned 4 [0057.837] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0057.837] lstrlenA (lpString="*.mdf") returned 5 [0057.837] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0057.837] lstrlenA (lpString="*.dbf") returned 5 [0057.837] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0057.837] lstrlenA (lpString="*.odt") returned 5 [0057.837] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0057.837] lstrlenA (lpString="*.vob") returned 5 [0057.837] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0057.837] lstrlenA (lpString="*.ifo") returned 5 [0057.837] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0057.837] lstrlenA (lpString="*.lnk") returned 5 [0057.837] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0057.837] lstrlenA (lpString="*.torrent") returned 9 [0057.837] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0057.837] lstrlenA (lpString="*.mov") returned 5 [0057.837] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0057.837] lstrlenA (lpString="*.m2v") returned 5 [0057.837] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0057.837] lstrlenA (lpString="*.3gp") returned 5 [0057.837] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0057.837] lstrlenA (lpString="*.mpeg") returned 6 [0057.837] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0057.837] lstrlenA (lpString="*.mpg") returned 5 [0057.837] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0057.837] lstrlenA (lpString="*.flv") returned 5 [0057.837] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0057.837] lstrlenA (lpString="*.avi") returned 5 [0057.837] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0057.837] lstrlenA (lpString="*.mp4") returned 5 [0057.837] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0057.837] lstrlenA (lpString="*.wmv") returned 5 [0057.837] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0057.837] lstrlenA (lpString="*.divx") returned 6 [0057.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0057.838] lstrlenA (lpString="*.mkv") returned 5 [0057.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0057.838] lstrlenA (lpString="*.mp3") returned 5 [0057.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0057.838] lstrlenA (lpString="*.wav") returned 5 [0057.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0057.838] lstrlenA (lpString="*.flac") returned 6 [0057.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0057.838] lstrlenA (lpString="*.ape") returned 5 [0057.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0057.838] lstrlenA (lpString="*.wma") returned 5 [0057.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0057.838] lstrlenA (lpString="*.ac3") returned 5 [0057.838] FindNextFileA (in: hFindFile=0x6364b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16702634, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16702634, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16702634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x77792cf0, dwReserved1=0xa0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0057.838] FindClose (in: hFindFile=0x6364b0 | out: hFindFile=0x6364b0) returned 1 [0057.838] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0057.838] lstrcmpA (lpString1=".", lpString2="fr-FR") returned -1 [0057.838] lstrcmpA (lpString1="..", lpString2="fr-FR") returned -1 [0057.838] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0057.838] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="fr-FR" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR" [0057.838] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR") returned 56 [0057.838] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName=".", cAlternateFileName="")) returned 0x6367f0 [0057.838] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.838] FindNextFileA (in: hFindFile=0x6367f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="..", cAlternateFileName="")) returned 1 [0057.839] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.839] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.839] FindNextFileA (in: hFindFile=0x6367f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16702634, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16702634, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16702634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0057.839] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.839] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0057.839] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0057.839] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0057.839] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\*.*") returned="*.*" [0057.839] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\" [0057.839] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\") returned="" [0057.839] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\HOW TO DECRYPT FILES.txt" [0057.839] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\how to decrypt files.txt")) returned 0xffffffff [0057.839] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.839] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.839] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.840] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.840] CloseHandle (hObject=0x1d0) returned 1 [0057.840] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" [0057.840] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0057.841] lstrlenA (lpString="*.zip") returned 5 [0057.841] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0057.841] lstrlenA (lpString="*.rar") returned 5 [0057.841] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0057.841] lstrlenA (lpString="*.7z") returned 4 [0057.841] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0057.841] lstrlenA (lpString="*.tar") returned 5 [0057.841] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0057.841] lstrlenA (lpString="*.gzip") returned 6 [0057.841] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0057.841] lstrlenA (lpString="*.jpg") returned 5 [0057.841] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0057.841] lstrlenA (lpString="*.jpeg") returned 6 [0057.841] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0057.841] lstrlenA (lpString="*.psd") returned 5 [0057.841] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0057.841] lstrlenA (lpString="*.cdr") returned 5 [0057.841] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0057.841] lstrlenA (lpString="*.dwg") returned 5 [0057.841] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0057.841] lstrlenA (lpString="*.max") returned 5 [0057.841] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0057.841] lstrlenA (lpString="*.bmp") returned 5 [0057.841] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0057.841] lstrlenA (lpString="*.gif") returned 5 [0057.841] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0057.841] lstrlenA (lpString="*.png") returned 5 [0057.841] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0057.841] lstrlenA (lpString="*.doc") returned 5 [0057.841] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0057.841] lstrlenA (lpString="*.docx") returned 6 [0057.841] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0057.841] lstrlenA (lpString="*.xls") returned 5 [0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0057.842] lstrlenA (lpString="*.xlsx") returned 6 [0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0057.842] lstrlenA (lpString="*.ppt") returned 5 [0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0057.842] lstrlenA (lpString="*.pptx") returned 6 [0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0057.842] lstrlenA (lpString="*.txt") returned 5 [0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0057.842] lstrlenA (lpString="*.pdf") returned 5 [0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0057.842] lstrlenA (lpString="*.djvu") returned 6 [0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0057.842] lstrlenA (lpString="*.htm") returned 5 [0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0057.842] lstrlenA (lpString="*.html") returned 6 [0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0057.842] lstrlenA (lpString="*.mdb") returned 5 [0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0057.842] lstrlenA (lpString="*.cer") returned 5 [0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0057.842] lstrlenA (lpString="*.p12") returned 5 [0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0057.842] lstrlenA (lpString="*.pfx") returned 5 [0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0057.842] lstrlenA (lpString="*.kwm") returned 5 [0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0057.842] lstrlenA (lpString="*.pwm") returned 5 [0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0057.842] lstrlenA (lpString="*.1cd") returned 5 [0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0057.842] lstrlenA (lpString="*.md") returned 4 [0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0057.842] lstrlenA (lpString="*.mdf") returned 5 [0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0057.843] lstrlenA (lpString="*.dbf") returned 5 [0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0057.843] lstrlenA (lpString="*.odt") returned 5 [0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0057.843] lstrlenA (lpString="*.vob") returned 5 [0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0057.843] lstrlenA (lpString="*.ifo") returned 5 [0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0057.843] lstrlenA (lpString="*.lnk") returned 5 [0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0057.843] lstrlenA (lpString="*.torrent") returned 9 [0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0057.843] lstrlenA (lpString="*.mov") returned 5 [0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0057.843] lstrlenA (lpString="*.m2v") returned 5 [0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0057.843] lstrlenA (lpString="*.3gp") returned 5 [0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0057.843] lstrlenA (lpString="*.mpeg") returned 6 [0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0057.843] lstrlenA (lpString="*.mpg") returned 5 [0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0057.843] lstrlenA (lpString="*.flv") returned 5 [0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0057.843] lstrlenA (lpString="*.avi") returned 5 [0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0057.843] lstrlenA (lpString="*.mp4") returned 5 [0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0057.843] lstrlenA (lpString="*.wmv") returned 5 [0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0057.843] lstrlenA (lpString="*.divx") returned 6 [0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0057.843] lstrlenA (lpString="*.mkv") returned 5 [0057.844] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0057.844] lstrlenA (lpString="*.mp3") returned 5 [0057.844] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0057.844] lstrlenA (lpString="*.wav") returned 5 [0057.844] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0057.844] lstrlenA (lpString="*.flac") returned 6 [0057.844] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0057.844] lstrlenA (lpString="*.ape") returned 5 [0057.844] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0057.844] lstrlenA (lpString="*.wma") returned 5 [0057.844] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0057.844] lstrlenA (lpString="*.ac3") returned 5 [0057.844] FindNextFileA (in: hFindFile=0x6367f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16702634, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16702634, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16702634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0057.844] FindClose (in: hFindFile=0x6367f0 | out: hFindFile=0x6367f0) returned 1 [0057.844] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0057.844] lstrcmpA (lpString1=".", lpString2="fsdefinitions") returned -1 [0057.844] lstrcmpA (lpString1="..", lpString2="fsdefinitions") returned -1 [0057.844] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0057.844] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="fsdefinitions" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions" [0057.844] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions") returned 64 [0057.844] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName=".", cAlternateFileName="")) returned 0x6369f0 [0057.847] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.848] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="..", cAlternateFileName="")) returned 1 [0057.848] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.848] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.848] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="auxpad", cAlternateFileName="")) returned 1 [0057.848] lstrcmpA (lpString1=".", lpString2="auxpad") returned -1 [0057.848] lstrcmpA (lpString1="..", lpString2="auxpad") returned -1 [0057.848] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0057.848] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="auxpad" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad" [0057.848] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad") returned 71 [0057.848] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*.*"), lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x643888, dwReserved1=0x643880, cFileName=".", cAlternateFileName="")) returned 0x636930 [0057.848] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.848] FindNextFileA (in: hFindFile=0x636930, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x643888, dwReserved1=0x643880, cFileName="..", cAlternateFileName="")) returned 1 [0057.848] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.848] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.848] FindNextFileA (in: hFindFile=0x636930, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x643888, dwReserved1=0x643880, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0057.848] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0057.849] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="auxbase.xml") returned 1 [0057.849] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="auxbase.xml") returned 1 [0057.849] lstrcmpiA (lpString1="", lpString2="auxbase.xml") returned -1 [0057.849] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*.*") returned="*.*" [0057.849] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\" [0057.849] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned="" [0057.849] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\HOW TO DECRYPT FILES.txt" [0057.849] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\how to decrypt files.txt")) returned 0xffffffff [0057.849] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0057.849] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.849] WriteFile (in: hFile=0x1d4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.850] SetFileTime (hFile=0x1d4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.850] CloseHandle (hObject=0x1d4) returned 1 [0057.851] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\", lpString2="auxbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" [0057.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.zip") returned 0 [0057.851] lstrlenA (lpString="*.zip") returned 5 [0057.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.rar") returned 0 [0057.851] lstrlenA (lpString="*.rar") returned 5 [0057.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.7z") returned 0 [0057.851] lstrlenA (lpString="*.7z") returned 4 [0057.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.tar") returned 0 [0057.851] lstrlenA (lpString="*.tar") returned 5 [0057.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.gzip") returned 0 [0057.851] lstrlenA (lpString="*.gzip") returned 6 [0057.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.jpg") returned 0 [0057.851] lstrlenA (lpString="*.jpg") returned 5 [0057.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.jpeg") returned 0 [0057.851] lstrlenA (lpString="*.jpeg") returned 6 [0057.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.psd") returned 0 [0057.851] lstrlenA (lpString="*.psd") returned 5 [0057.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.cdr") returned 0 [0057.851] lstrlenA (lpString="*.cdr") returned 5 [0057.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.dwg") returned 0 [0057.851] lstrlenA (lpString="*.dwg") returned 5 [0057.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.max") returned 0 [0057.851] lstrlenA (lpString="*.max") returned 5 [0057.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.bmp") returned 0 [0057.851] lstrlenA (lpString="*.bmp") returned 5 [0057.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.gif") returned 0 [0057.851] lstrlenA (lpString="*.gif") returned 5 [0057.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.png") returned 0 [0057.851] lstrlenA (lpString="*.png") returned 5 [0057.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.doc") returned 0 [0057.851] lstrlenA (lpString="*.doc") returned 5 [0057.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.docx") returned 0 [0057.852] lstrlenA (lpString="*.docx") returned 6 [0057.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.xls") returned 0 [0057.852] lstrlenA (lpString="*.xls") returned 5 [0057.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.xlsx") returned 0 [0057.852] lstrlenA (lpString="*.xlsx") returned 6 [0057.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.ppt") returned 0 [0057.852] lstrlenA (lpString="*.ppt") returned 5 [0057.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.pptx") returned 0 [0057.852] lstrlenA (lpString="*.pptx") returned 6 [0057.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.txt") returned 0 [0057.852] lstrlenA (lpString="*.txt") returned 5 [0057.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.pdf") returned 0 [0057.852] lstrlenA (lpString="*.pdf") returned 5 [0057.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.djvu") returned 0 [0057.852] lstrlenA (lpString="*.djvu") returned 6 [0057.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.htm") returned 0 [0057.852] lstrlenA (lpString="*.htm") returned 5 [0057.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.html") returned 0 [0057.852] lstrlenA (lpString="*.html") returned 6 [0057.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.mdb") returned 0 [0057.852] lstrlenA (lpString="*.mdb") returned 5 [0057.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.cer") returned 0 [0057.852] lstrlenA (lpString="*.cer") returned 5 [0057.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.p12") returned 0 [0057.852] lstrlenA (lpString="*.p12") returned 5 [0057.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.pfx") returned 0 [0057.852] lstrlenA (lpString="*.pfx") returned 5 [0057.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.kwm") returned 0 [0057.852] lstrlenA (lpString="*.kwm") returned 5 [0057.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.pwm") returned 0 [0057.852] lstrlenA (lpString="*.pwm") returned 5 [0057.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.1cd") returned 0 [0057.853] lstrlenA (lpString="*.1cd") returned 5 [0057.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.md") returned 0 [0057.853] lstrlenA (lpString="*.md") returned 4 [0057.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.mdf") returned 0 [0057.853] lstrlenA (lpString="*.mdf") returned 5 [0057.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.dbf") returned 0 [0057.853] lstrlenA (lpString="*.dbf") returned 5 [0057.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.odt") returned 0 [0057.853] lstrlenA (lpString="*.odt") returned 5 [0057.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.vob") returned 0 [0057.853] lstrlenA (lpString="*.vob") returned 5 [0057.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.ifo") returned 0 [0057.853] lstrlenA (lpString="*.ifo") returned 5 [0057.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.lnk") returned 0 [0057.853] lstrlenA (lpString="*.lnk") returned 5 [0057.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.torrent") returned 0 [0057.853] lstrlenA (lpString="*.torrent") returned 9 [0057.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.mov") returned 0 [0057.853] lstrlenA (lpString="*.mov") returned 5 [0057.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.m2v") returned 0 [0057.853] lstrlenA (lpString="*.m2v") returned 5 [0057.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.3gp") returned 0 [0057.853] lstrlenA (lpString="*.3gp") returned 5 [0057.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.mpeg") returned 0 [0057.853] lstrlenA (lpString="*.mpeg") returned 6 [0057.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.mpg") returned 0 [0057.853] lstrlenA (lpString="*.mpg") returned 5 [0057.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.flv") returned 0 [0057.853] lstrlenA (lpString="*.flv") returned 5 [0057.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.avi") returned 0 [0057.853] lstrlenA (lpString="*.avi") returned 5 [0057.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.mp4") returned 0 [0057.853] lstrlenA (lpString="*.mp4") returned 5 [0057.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.wmv") returned 0 [0057.854] lstrlenA (lpString="*.wmv") returned 5 [0057.854] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.divx") returned 0 [0057.854] lstrlenA (lpString="*.divx") returned 6 [0057.854] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.mkv") returned 0 [0057.854] lstrlenA (lpString="*.mkv") returned 5 [0057.854] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.mp3") returned 0 [0057.854] lstrlenA (lpString="*.mp3") returned 5 [0057.854] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.wav") returned 0 [0057.854] lstrlenA (lpString="*.wav") returned 5 [0057.854] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.flac") returned 0 [0057.854] lstrlenA (lpString="*.flac") returned 6 [0057.854] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.ape") returned 0 [0057.854] lstrlenA (lpString="*.ape") returned 5 [0057.854] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.wma") returned 0 [0057.854] lstrlenA (lpString="*.wma") returned 5 [0057.854] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.ac3") returned 0 [0057.854] lstrlenA (lpString="*.ac3") returned 5 [0057.854] FindNextFileA (in: hFindFile=0x636930, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x643888, dwReserved1=0x643880, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0057.854] FindClose (in: hFindFile=0x636930 | out: hFindFile=0x636930) returned 1 [0057.854] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1714a855, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1714a855, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1714a855, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0057.854] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.854] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="auxpad.xml") returned 1 [0057.854] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="auxpad.xml") returned 1 [0057.854] lstrcmpiA (lpString1="", lpString2="auxpad.xml") returned -1 [0057.854] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0057.854] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" [0057.854] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="" [0057.854] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0057.855] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0xffffffff [0057.855] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.855] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.855] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.856] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.856] CloseHandle (hObject=0x1d0) returned 1 [0057.856] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="auxpad.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" [0057.856] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.zip") returned 0 [0057.856] lstrlenA (lpString="*.zip") returned 5 [0057.856] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.rar") returned 0 [0057.856] lstrlenA (lpString="*.rar") returned 5 [0057.856] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.7z") returned 0 [0057.856] lstrlenA (lpString="*.7z") returned 4 [0057.856] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.tar") returned 0 [0057.856] lstrlenA (lpString="*.tar") returned 5 [0057.856] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.gzip") returned 0 [0057.856] lstrlenA (lpString="*.gzip") returned 6 [0057.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.jpg") returned 0 [0057.857] lstrlenA (lpString="*.jpg") returned 5 [0057.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.jpeg") returned 0 [0057.857] lstrlenA (lpString="*.jpeg") returned 6 [0057.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.psd") returned 0 [0057.857] lstrlenA (lpString="*.psd") returned 5 [0057.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.cdr") returned 0 [0057.857] lstrlenA (lpString="*.cdr") returned 5 [0057.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.dwg") returned 0 [0057.857] lstrlenA (lpString="*.dwg") returned 5 [0057.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.max") returned 0 [0057.857] lstrlenA (lpString="*.max") returned 5 [0057.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.bmp") returned 0 [0057.857] lstrlenA (lpString="*.bmp") returned 5 [0057.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.gif") returned 0 [0057.857] lstrlenA (lpString="*.gif") returned 5 [0057.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.png") returned 0 [0057.857] lstrlenA (lpString="*.png") returned 5 [0057.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.doc") returned 0 [0057.857] lstrlenA (lpString="*.doc") returned 5 [0057.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.docx") returned 0 [0057.857] lstrlenA (lpString="*.docx") returned 6 [0057.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.xls") returned 0 [0057.857] lstrlenA (lpString="*.xls") returned 5 [0057.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.xlsx") returned 0 [0057.857] lstrlenA (lpString="*.xlsx") returned 6 [0057.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.ppt") returned 0 [0057.857] lstrlenA (lpString="*.ppt") returned 5 [0057.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.pptx") returned 0 [0057.857] lstrlenA (lpString="*.pptx") returned 6 [0057.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.txt") returned 0 [0057.858] lstrlenA (lpString="*.txt") returned 5 [0057.858] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.pdf") returned 0 [0057.858] lstrlenA (lpString="*.pdf") returned 5 [0057.858] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.djvu") returned 0 [0057.858] lstrlenA (lpString="*.djvu") returned 6 [0057.858] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.htm") returned 0 [0057.858] lstrlenA (lpString="*.htm") returned 5 [0057.858] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.html") returned 0 [0057.858] lstrlenA (lpString="*.html") returned 6 [0057.858] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.mdb") returned 0 [0057.858] lstrlenA (lpString="*.mdb") returned 5 [0057.858] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.cer") returned 0 [0057.858] lstrlenA (lpString="*.cer") returned 5 [0057.858] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.p12") returned 0 [0057.858] lstrlenA (lpString="*.p12") returned 5 [0057.858] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.pfx") returned 0 [0057.858] lstrlenA (lpString="*.pfx") returned 5 [0057.858] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.kwm") returned 0 [0057.858] lstrlenA (lpString="*.kwm") returned 5 [0057.858] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.pwm") returned 0 [0057.858] lstrlenA (lpString="*.pwm") returned 5 [0057.858] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.1cd") returned 0 [0057.858] lstrlenA (lpString="*.1cd") returned 5 [0057.858] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.md") returned 0 [0057.858] lstrlenA (lpString="*.md") returned 4 [0057.858] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.mdf") returned 0 [0057.858] lstrlenA (lpString="*.mdf") returned 5 [0057.858] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.dbf") returned 0 [0057.858] lstrlenA (lpString="*.dbf") returned 5 [0057.858] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.odt") returned 0 [0057.858] lstrlenA (lpString="*.odt") returned 5 [0057.858] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.vob") returned 0 [0057.858] lstrlenA (lpString="*.vob") returned 5 [0057.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.ifo") returned 0 [0057.859] lstrlenA (lpString="*.ifo") returned 5 [0057.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.lnk") returned 0 [0057.859] lstrlenA (lpString="*.lnk") returned 5 [0057.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.torrent") returned 0 [0057.859] lstrlenA (lpString="*.torrent") returned 9 [0057.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.mov") returned 0 [0057.859] lstrlenA (lpString="*.mov") returned 5 [0057.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.m2v") returned 0 [0057.859] lstrlenA (lpString="*.m2v") returned 5 [0057.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.3gp") returned 0 [0057.859] lstrlenA (lpString="*.3gp") returned 5 [0057.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.mpeg") returned 0 [0057.859] lstrlenA (lpString="*.mpeg") returned 6 [0057.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.mpg") returned 0 [0057.859] lstrlenA (lpString="*.mpg") returned 5 [0057.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.flv") returned 0 [0057.859] lstrlenA (lpString="*.flv") returned 5 [0057.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.avi") returned 0 [0057.859] lstrlenA (lpString="*.avi") returned 5 [0057.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.mp4") returned 0 [0057.859] lstrlenA (lpString="*.mp4") returned 5 [0057.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.wmv") returned 0 [0057.859] lstrlenA (lpString="*.wmv") returned 5 [0057.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.divx") returned 0 [0057.859] lstrlenA (lpString="*.divx") returned 6 [0057.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.mkv") returned 0 [0057.859] lstrlenA (lpString="*.mkv") returned 5 [0057.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.mp3") returned 0 [0057.859] lstrlenA (lpString="*.mp3") returned 5 [0057.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.wav") returned 0 [0057.859] lstrlenA (lpString="*.wav") returned 5 [0057.860] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.flac") returned 0 [0057.860] lstrlenA (lpString="*.flac") returned 6 [0057.860] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.ape") returned 0 [0057.860] lstrlenA (lpString="*.ape") returned 5 [0057.860] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.wma") returned 0 [0057.860] lstrlenA (lpString="*.wma") returned 5 [0057.860] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.ac3") returned 0 [0057.860] lstrlenA (lpString="*.ac3") returned 5 [0057.860] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="insert", cAlternateFileName="")) returned 1 [0057.860] lstrcmpA (lpString1=".", lpString2="insert") returned -1 [0057.860] lstrcmpA (lpString1="..", lpString2="insert") returned -1 [0057.860] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned="auxpad.xml" [0057.860] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="insert" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert" [0057.860] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert") returned 71 [0057.860] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\*.*"), lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f6c8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636730 [0057.860] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.860] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f6c8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.860] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.860] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.860] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x19f6c8, dwReserved1=0x0, cFileName="insertbase.xml", cAlternateFileName="")) returned 1 [0057.860] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0057.860] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="insertbase.xml") returned -1 [0057.860] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="insertbase.xml") returned -1 [0057.861] lstrcmpiA (lpString1="", lpString2="insertbase.xml") returned -1 [0057.861] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\*.*") returned="*.*" [0057.861] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\" [0057.861] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\") returned="" [0057.861] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\HOW TO DECRYPT FILES.txt" [0057.861] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\how to decrypt files.txt")) returned 0xffffffff [0057.861] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0057.861] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.861] WriteFile (in: hFile=0x1d4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.870] SetFileTime (hFile=0x1d4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.870] CloseHandle (hObject=0x1d4) returned 1 [0057.870] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\", lpString2="insertbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" [0057.870] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.zip") returned 0 [0057.870] lstrlenA (lpString="*.zip") returned 5 [0057.870] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.rar") returned 0 [0057.871] lstrlenA (lpString="*.rar") returned 5 [0057.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.7z") returned 0 [0057.871] lstrlenA (lpString="*.7z") returned 4 [0057.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.tar") returned 0 [0057.871] lstrlenA (lpString="*.tar") returned 5 [0057.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.gzip") returned 0 [0057.871] lstrlenA (lpString="*.gzip") returned 6 [0057.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.jpg") returned 0 [0057.871] lstrlenA (lpString="*.jpg") returned 5 [0057.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.jpeg") returned 0 [0057.871] lstrlenA (lpString="*.jpeg") returned 6 [0057.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.psd") returned 0 [0057.871] lstrlenA (lpString="*.psd") returned 5 [0057.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.cdr") returned 0 [0057.871] lstrlenA (lpString="*.cdr") returned 5 [0057.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.dwg") returned 0 [0057.871] lstrlenA (lpString="*.dwg") returned 5 [0057.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.max") returned 0 [0057.871] lstrlenA (lpString="*.max") returned 5 [0057.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.bmp") returned 0 [0057.871] lstrlenA (lpString="*.bmp") returned 5 [0057.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.gif") returned 0 [0057.871] lstrlenA (lpString="*.gif") returned 5 [0057.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.png") returned 0 [0057.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.doc") returned 0 [0057.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.docx") returned 0 [0057.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.xls") returned 0 [0057.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.xlsx") returned 0 [0057.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.ppt") returned 0 [0057.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.pptx") returned 0 [0057.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.txt") returned 0 [0057.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.pdf") returned 0 [0057.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.djvu") returned 0 [0057.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.htm") returned 0 [0057.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.html") returned 0 [0057.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.mdb") returned 0 [0057.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.cer") returned 0 [0057.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.p12") returned 0 [0057.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.pfx") returned 0 [0057.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.kwm") returned 0 [0057.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.pwm") returned 0 [0057.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.1cd") returned 0 [0057.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.md") returned 0 [0057.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.mdf") returned 0 [0057.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.dbf") returned 0 [0057.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.odt") returned 0 [0057.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.vob") returned 0 [0057.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.ifo") returned 0 [0057.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.lnk") returned 0 [0057.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.torrent") returned 0 [0057.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.mov") returned 0 [0057.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.m2v") returned 0 [0057.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.3gp") returned 0 [0057.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.mpeg") returned 0 [0057.873] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.mpg") returned 0 [0057.873] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.flv") returned 0 [0057.873] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.avi") returned 0 [0057.873] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.mp4") returned 0 [0057.873] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.wmv") returned 0 [0057.873] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.divx") returned 0 [0057.873] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.mkv") returned 0 [0057.873] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.mp3") returned 0 [0057.873] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.wav") returned 0 [0057.873] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.flac") returned 0 [0057.873] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.ape") returned 0 [0057.873] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.wma") returned 0 [0057.873] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.ac3") returned 0 [0057.873] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x19f6c8, dwReserved1=0x0, cFileName="insertbase.xml", cAlternateFileName="")) returned 0 [0057.873] FindClose (in: hFindFile=0x636730 | out: hFindFile=0x636730) returned 1 [0057.873] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="insert.xml", cAlternateFileName="")) returned 1 [0057.873] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.873] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="insert.xml") returned -1 [0057.873] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="insert.xml") returned -1 [0057.873] lstrcmpiA (lpString1="", lpString2="insert.xml") returned -1 [0057.873] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0057.873] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" [0057.873] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="" [0057.874] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0057.874] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0057.874] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="insert.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" [0057.874] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.zip") returned 0 [0057.874] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.rar") returned 0 [0057.874] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.7z") returned 0 [0057.874] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.tar") returned 0 [0057.874] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.gzip") returned 0 [0057.874] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.jpg") returned 0 [0057.874] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.jpeg") returned 0 [0057.874] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.psd") returned 0 [0057.874] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.cdr") returned 0 [0057.874] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.dwg") returned 0 [0057.874] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.max") returned 0 [0057.874] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.bmp") returned 0 [0057.874] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.gif") returned 0 [0057.874] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.png") returned 0 [0057.874] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.doc") returned 0 [0057.874] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.docx") returned 0 [0057.874] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.xls") returned 0 [0057.874] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.xlsx") returned 0 [0057.874] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.ppt") returned 0 [0057.874] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.pptx") returned 0 [0057.875] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.txt") returned 0 [0057.875] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.pdf") returned 0 [0057.875] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.djvu") returned 0 [0057.875] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.htm") returned 0 [0057.875] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.html") returned 0 [0057.875] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.mdb") returned 0 [0057.875] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.cer") returned 0 [0057.875] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.p12") returned 0 [0057.875] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.pfx") returned 0 [0057.875] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.kwm") returned 0 [0057.875] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.pwm") returned 0 [0057.875] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.1cd") returned 0 [0057.875] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.md") returned 0 [0057.875] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.mdf") returned 0 [0057.875] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.dbf") returned 0 [0057.875] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.odt") returned 0 [0057.875] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.vob") returned 0 [0057.875] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.ifo") returned 0 [0057.875] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.lnk") returned 0 [0057.875] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.torrent") returned 0 [0057.875] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.mov") returned 0 [0057.875] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.m2v") returned 0 [0057.875] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.3gp") returned 0 [0057.875] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.mpeg") returned 0 [0057.876] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.mpg") returned 0 [0057.876] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.flv") returned 0 [0057.876] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.avi") returned 0 [0057.876] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.mp4") returned 0 [0057.876] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.wmv") returned 0 [0057.876] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.divx") returned 0 [0057.876] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.mkv") returned 0 [0057.876] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.mp3") returned 0 [0057.876] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.wav") returned 0 [0057.876] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.flac") returned 0 [0057.876] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.ape") returned 0 [0057.876] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.wma") returned 0 [0057.876] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.ac3") returned 0 [0057.876] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="keypad", cAlternateFileName="")) returned 1 [0057.876] lstrcmpA (lpString1=".", lpString2="keypad") returned -1 [0057.876] lstrcmpA (lpString1="..", lpString2="keypad") returned -1 [0057.876] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned="insert.xml" [0057.876] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="keypad" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad" [0057.876] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*.*"), lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName=".", cAlternateFileName="")) returned 0x636b70 [0057.876] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.876] FindNextFileA (in: hFindFile=0x636b70, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName="..", cAlternateFileName="")) returned 1 [0057.877] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.877] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.877] FindNextFileA (in: hFindFile=0x636b70, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0057.877] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0057.877] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ea.xml") returned 1 [0057.877] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ea.xml") returned 1 [0057.877] lstrcmpiA (lpString1="", lpString2="ea.xml") returned -1 [0057.877] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*.*") returned="*.*" [0057.877] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\" [0057.877] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned="" [0057.877] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt" [0057.877] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\how to decrypt files.txt")) returned 0xffffffff [0057.877] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0057.877] WriteFile (in: hFile=0x1d4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.878] SetFileTime (hFile=0x1d4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.879] CloseHandle (hObject=0x1d4) returned 1 [0057.879] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\", lpString2="ea.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" [0057.879] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.zip") returned 0 [0057.879] lstrlenA (lpString="*.zip") returned 5 [0057.879] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.rar") returned 0 [0057.879] lstrlenA (lpString="*.rar") returned 5 [0057.879] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.7z") returned 0 [0057.879] lstrlenA (lpString="*.7z") returned 4 [0057.879] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.tar") returned 0 [0057.879] lstrlenA (lpString="*.tar") returned 5 [0057.879] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.gzip") returned 0 [0057.879] lstrlenA (lpString="*.gzip") returned 6 [0057.879] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.jpg") returned 0 [0057.879] lstrlenA (lpString="*.jpg") returned 5 [0057.879] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.jpeg") returned 0 [0057.879] lstrlenA (lpString="*.jpeg") returned 6 [0057.879] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.psd") returned 0 [0057.879] lstrlenA (lpString="*.psd") returned 5 [0057.879] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.cdr") returned 0 [0057.879] lstrlenA (lpString="*.cdr") returned 5 [0057.879] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.dwg") returned 0 [0057.879] lstrlenA (lpString="*.dwg") returned 5 [0057.879] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.max") returned 0 [0057.879] lstrlenA (lpString="*.max") returned 5 [0057.879] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.bmp") returned 0 [0057.879] lstrlenA (lpString="*.bmp") returned 5 [0057.879] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.gif") returned 0 [0057.879] lstrlenA (lpString="*.gif") returned 5 [0057.879] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.png") returned 0 [0057.880] lstrlenA (lpString="*.png") returned 5 [0057.880] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.doc") returned 0 [0057.880] lstrlenA (lpString="*.doc") returned 5 [0057.880] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.docx") returned 0 [0057.880] lstrlenA (lpString="*.docx") returned 6 [0057.880] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.xls") returned 0 [0057.880] lstrlenA (lpString="*.xls") returned 5 [0057.880] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.xlsx") returned 0 [0057.880] lstrlenA (lpString="*.xlsx") returned 6 [0057.880] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.ppt") returned 0 [0057.880] lstrlenA (lpString="*.ppt") returned 5 [0057.880] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.pptx") returned 0 [0057.880] lstrlenA (lpString="*.pptx") returned 6 [0057.880] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.txt") returned 0 [0057.880] lstrlenA (lpString="*.txt") returned 5 [0057.880] lstrlenA (lpString="*.pdf") returned 5 [0057.880] lstrlenA (lpString="*.djvu") returned 6 [0057.880] lstrlenA (lpString="*.htm") returned 5 [0057.880] lstrlenA (lpString="*.html") returned 6 [0057.880] lstrlenA (lpString="*.mdb") returned 5 [0057.880] lstrlenA (lpString="*.cer") returned 5 [0057.880] lstrlenA (lpString="*.p12") returned 5 [0057.881] lstrlenA (lpString="*.pfx") returned 5 [0057.881] lstrlenA (lpString="*.kwm") returned 5 [0057.881] lstrlenA (lpString="*.pwm") returned 5 [0057.881] lstrlenA (lpString="*.1cd") returned 5 [0057.881] lstrlenA (lpString="*.md") returned 4 [0057.881] lstrlenA (lpString="*.mdf") returned 5 [0057.881] lstrlenA (lpString="*.dbf") returned 5 [0057.881] lstrlenA (lpString="*.odt") returned 5 [0057.881] lstrlenA (lpString="*.vob") returned 5 [0057.881] lstrlenA (lpString="*.ifo") returned 5 [0057.881] lstrlenA (lpString="*.lnk") returned 5 [0057.881] lstrlenA (lpString="*.torrent") returned 9 [0057.881] lstrlenA (lpString="*.mov") returned 5 [0057.881] lstrlenA (lpString="*.m2v") returned 5 [0057.881] lstrlenA (lpString="*.3gp") returned 5 [0057.881] lstrlenA (lpString="*.mpeg") returned 6 [0057.881] lstrlenA (lpString="*.mpg") returned 5 [0057.881] lstrlenA (lpString="*.flv") returned 5 [0057.881] lstrlenA (lpString="*.avi") returned 5 [0057.881] lstrlenA (lpString="*.mp4") returned 5 [0057.881] lstrlenA (lpString="*.wmv") returned 5 [0057.881] lstrlenA (lpString="*.divx") returned 6 [0057.881] lstrlenA (lpString="*.mkv") returned 5 [0057.881] lstrlenA (lpString="*.mp3") returned 5 [0057.881] lstrlenA (lpString="*.wav") returned 5 [0057.881] lstrlenA (lpString="*.flac") returned 6 [0057.882] lstrlenA (lpString="*.ape") returned 5 [0057.882] lstrlenA (lpString="*.wma") returned 5 [0057.882] lstrlenA (lpString="*.ac3") returned 5 [0057.882] FindNextFileA (in: hFindFile=0x636b70, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0057.882] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0057.882] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="keypadbase.xml") returned -1 [0057.882] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="keypadbase.xml") returned -1 [0057.882] lstrcmpiA (lpString1="", lpString2="keypadbase.xml") returned -1 [0057.882] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned="ea.xml" [0057.882] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\" [0057.882] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned="" [0057.882] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt" [0057.882] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\how to decrypt files.txt")) returned 0x20 [0057.882] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\", lpString2="keypadbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" [0057.882] lstrlenA (lpString="*.zip") returned 5 [0057.882] lstrlenA (lpString="*.rar") returned 5 [0057.882] lstrlenA (lpString="*.7z") returned 4 [0057.882] lstrlenA (lpString="*.tar") returned 5 [0057.882] lstrlenA (lpString="*.gzip") returned 6 [0057.882] lstrlenA (lpString="*.jpg") returned 5 [0057.882] lstrlenA (lpString="*.jpeg") returned 6 [0057.882] lstrlenA (lpString="*.psd") returned 5 [0057.882] lstrlenA (lpString="*.cdr") returned 5 [0057.882] lstrlenA (lpString="*.dwg") returned 5 [0057.882] lstrlenA (lpString="*.max") returned 5 [0057.882] lstrlenA (lpString="*.bmp") returned 5 [0057.883] lstrlenA (lpString="*.gif") returned 5 [0057.883] lstrlenA (lpString="*.png") returned 5 [0057.883] lstrlenA (lpString="*.doc") returned 5 [0057.883] lstrlenA (lpString="*.docx") returned 6 [0057.883] lstrlenA (lpString="*.xls") returned 5 [0057.883] lstrlenA (lpString="*.xlsx") returned 6 [0057.883] lstrlenA (lpString="*.ppt") returned 5 [0057.883] lstrlenA (lpString="*.pptx") returned 6 [0057.883] lstrlenA (lpString="*.txt") returned 5 [0057.883] lstrlenA (lpString="*.pdf") returned 5 [0057.883] lstrlenA (lpString="*.djvu") returned 6 [0057.883] lstrlenA (lpString="*.htm") returned 5 [0057.883] lstrlenA (lpString="*.html") returned 6 [0057.883] lstrlenA (lpString="*.mdb") returned 5 [0057.883] lstrlenA (lpString="*.cer") returned 5 [0057.883] lstrlenA (lpString="*.p12") returned 5 [0057.883] lstrlenA (lpString="*.pfx") returned 5 [0057.883] lstrlenA (lpString="*.kwm") returned 5 [0057.883] lstrlenA (lpString="*.pwm") returned 5 [0057.883] lstrlenA (lpString="*.1cd") returned 5 [0057.883] lstrlenA (lpString="*.md") returned 4 [0057.883] lstrlenA (lpString="*.mdf") returned 5 [0057.883] lstrlenA (lpString="*.dbf") returned 5 [0057.883] lstrlenA (lpString="*.odt") returned 5 [0057.883] lstrlenA (lpString="*.vob") returned 5 [0057.883] lstrlenA (lpString="*.ifo") returned 5 [0057.884] lstrlenA (lpString="*.lnk") returned 5 [0057.884] lstrlenA (lpString="*.torrent") returned 9 [0057.884] lstrlenA (lpString="*.mov") returned 5 [0057.884] lstrlenA (lpString="*.m2v") returned 5 [0057.884] lstrlenA (lpString="*.3gp") returned 5 [0057.884] lstrlenA (lpString="*.mpeg") returned 6 [0057.884] lstrlenA (lpString="*.mpg") returned 5 [0057.884] lstrlenA (lpString="*.flv") returned 5 [0057.884] lstrlenA (lpString="*.avi") returned 5 [0057.884] lstrlenA (lpString="*.mp4") returned 5 [0057.884] lstrlenA (lpString="*.wmv") returned 5 [0057.884] lstrlenA (lpString="*.divx") returned 6 [0057.884] lstrlenA (lpString="*.mkv") returned 5 [0057.884] lstrlenA (lpString="*.mp3") returned 5 [0057.884] lstrlenA (lpString="*.wav") returned 5 [0057.884] lstrlenA (lpString="*.flac") returned 6 [0057.884] lstrlenA (lpString="*.ape") returned 5 [0057.884] lstrlenA (lpString="*.wma") returned 5 [0057.884] lstrlenA (lpString="*.ac3") returned 5 [0057.884] FindNextFileA (in: hFindFile=0x636b70, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1714a855, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1714a855, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1714a855, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0057.884] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0057.884] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="kor-kor.xml") returned -1 [0057.884] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="kor-kor.xml") returned -1 [0057.884] lstrcmpiA (lpString1="", lpString2="kor-kor.xml") returned -1 [0057.884] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned="keypadbase.xml" [0057.884] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\" [0057.884] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned="" [0057.884] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt" [0057.884] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\how to decrypt files.txt")) returned 0x20 [0057.885] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\", lpString2="kor-kor.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" [0057.885] lstrlenA (lpString="*.zip") returned 5 [0057.885] lstrlenA (lpString="*.rar") returned 5 [0057.885] lstrlenA (lpString="*.7z") returned 4 [0057.885] lstrlenA (lpString="*.tar") returned 5 [0057.885] lstrlenA (lpString="*.gzip") returned 6 [0057.885] lstrlenA (lpString="*.jpg") returned 5 [0057.885] lstrlenA (lpString="*.jpeg") returned 6 [0057.885] lstrlenA (lpString="*.psd") returned 5 [0057.885] lstrlenA (lpString="*.cdr") returned 5 [0057.885] lstrlenA (lpString="*.dwg") returned 5 [0057.885] lstrlenA (lpString="*.max") returned 5 [0057.885] lstrlenA (lpString="*.bmp") returned 5 [0057.885] lstrlenA (lpString="*.gif") returned 5 [0057.885] lstrlenA (lpString="*.png") returned 5 [0057.885] lstrlenA (lpString="*.doc") returned 5 [0057.885] lstrlenA (lpString="*.docx") returned 6 [0057.885] lstrlenA (lpString="*.xls") returned 5 [0057.885] lstrlenA (lpString="*.xlsx") returned 6 [0057.885] lstrlenA (lpString="*.ppt") returned 5 [0057.885] lstrlenA (lpString="*.pptx") returned 6 [0057.885] lstrlenA (lpString="*.txt") returned 5 [0057.885] lstrlenA (lpString="*.pdf") returned 5 [0057.885] lstrlenA (lpString="*.djvu") returned 6 [0057.886] lstrlenA (lpString="*.htm") returned 5 [0057.886] lstrlenA (lpString="*.html") returned 6 [0057.886] lstrlenA (lpString="*.mdb") returned 5 [0057.886] lstrlenA (lpString="*.cer") returned 5 [0057.886] lstrlenA (lpString="*.p12") returned 5 [0057.886] lstrlenA (lpString="*.pfx") returned 5 [0057.886] lstrlenA (lpString="*.kwm") returned 5 [0057.886] lstrlenA (lpString="*.pwm") returned 5 [0057.886] lstrlenA (lpString="*.1cd") returned 5 [0057.886] lstrlenA (lpString="*.md") returned 4 [0057.886] lstrlenA (lpString="*.mdf") returned 5 [0057.886] lstrlenA (lpString="*.dbf") returned 5 [0057.886] lstrlenA (lpString="*.odt") returned 5 [0057.886] lstrlenA (lpString="*.vob") returned 5 [0057.886] lstrlenA (lpString="*.ifo") returned 5 [0057.886] lstrlenA (lpString="*.lnk") returned 5 [0057.886] lstrlenA (lpString="*.torrent") returned 9 [0057.886] lstrlenA (lpString="*.mov") returned 5 [0057.886] lstrlenA (lpString="*.m2v") returned 5 [0057.886] lstrlenA (lpString="*.3gp") returned 5 [0057.886] lstrlenA (lpString="*.mpeg") returned 6 [0057.886] lstrlenA (lpString="*.mpg") returned 5 [0057.886] lstrlenA (lpString="*.flv") returned 5 [0057.886] lstrlenA (lpString="*.avi") returned 5 [0057.886] lstrlenA (lpString="*.mp4") returned 5 [0057.886] lstrlenA (lpString="*.wmv") returned 5 [0057.887] lstrlenA (lpString="*.divx") returned 6 [0057.887] lstrlenA (lpString="*.mkv") returned 5 [0057.887] lstrlenA (lpString="*.mp3") returned 5 [0057.887] lstrlenA (lpString="*.wav") returned 5 [0057.887] lstrlenA (lpString="*.flac") returned 6 [0057.887] lstrlenA (lpString="*.ape") returned 5 [0057.887] lstrlenA (lpString="*.wma") returned 5 [0057.887] lstrlenA (lpString="*.ac3") returned 5 [0057.887] FindNextFileA (in: hFindFile=0x636b70, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1714a855, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1714a855, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1714a855, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0057.887] FindClose (in: hFindFile=0x636b70 | out: hFindFile=0x636b70) returned 1 [0057.887] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0057.887] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.887] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="keypad.xml") returned -1 [0057.887] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="keypad.xml") returned -1 [0057.887] lstrcmpiA (lpString1="", lpString2="keypad.xml") returned -1 [0057.887] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0057.887] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" [0057.887] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="" [0057.887] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0057.887] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0057.887] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="keypad.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" [0057.887] lstrlenA (lpString="*.zip") returned 5 [0057.887] lstrlenA (lpString="*.rar") returned 5 [0057.888] lstrlenA (lpString="*.7z") returned 4 [0057.888] lstrlenA (lpString="*.tar") returned 5 [0057.888] lstrlenA (lpString="*.gzip") returned 6 [0057.888] lstrlenA (lpString="*.jpg") returned 5 [0057.888] lstrlenA (lpString="*.jpeg") returned 6 [0057.888] lstrlenA (lpString="*.psd") returned 5 [0057.888] lstrlenA (lpString="*.cdr") returned 5 [0057.888] lstrlenA (lpString="*.dwg") returned 5 [0057.888] lstrlenA (lpString="*.max") returned 5 [0057.888] lstrlenA (lpString="*.bmp") returned 5 [0057.888] lstrlenA (lpString="*.gif") returned 5 [0057.888] lstrlenA (lpString="*.png") returned 5 [0057.888] lstrlenA (lpString="*.doc") returned 5 [0057.888] lstrlenA (lpString="*.docx") returned 6 [0057.888] lstrlenA (lpString="*.xls") returned 5 [0057.888] lstrlenA (lpString="*.xlsx") returned 6 [0057.888] lstrlenA (lpString="*.ppt") returned 5 [0057.888] lstrlenA (lpString="*.pptx") returned 6 [0057.888] lstrlenA (lpString="*.txt") returned 5 [0057.888] lstrlenA (lpString="*.pdf") returned 5 [0057.888] lstrlenA (lpString="*.djvu") returned 6 [0057.888] lstrlenA (lpString="*.htm") returned 5 [0057.888] lstrlenA (lpString="*.html") returned 6 [0057.888] lstrlenA (lpString="*.mdb") returned 5 [0057.888] lstrlenA (lpString="*.cer") returned 5 [0057.888] lstrlenA (lpString="*.p12") returned 5 [0057.889] lstrlenA (lpString="*.pfx") returned 5 [0057.889] lstrlenA (lpString="*.kwm") returned 5 [0057.889] lstrlenA (lpString="*.pwm") returned 5 [0057.889] lstrlenA (lpString="*.1cd") returned 5 [0057.889] lstrlenA (lpString="*.md") returned 4 [0057.889] lstrlenA (lpString="*.mdf") returned 5 [0057.889] lstrlenA (lpString="*.dbf") returned 5 [0057.889] lstrlenA (lpString="*.odt") returned 5 [0057.889] lstrlenA (lpString="*.vob") returned 5 [0057.889] lstrlenA (lpString="*.ifo") returned 5 [0057.889] lstrlenA (lpString="*.lnk") returned 5 [0057.889] lstrlenA (lpString="*.torrent") returned 9 [0057.889] lstrlenA (lpString="*.mov") returned 5 [0057.889] lstrlenA (lpString="*.m2v") returned 5 [0057.889] lstrlenA (lpString="*.3gp") returned 5 [0057.889] lstrlenA (lpString="*.mpeg") returned 6 [0057.889] lstrlenA (lpString="*.mpg") returned 5 [0057.889] lstrlenA (lpString="*.flv") returned 5 [0057.889] lstrlenA (lpString="*.avi") returned 5 [0057.889] lstrlenA (lpString="*.mp4") returned 5 [0057.889] lstrlenA (lpString="*.wmv") returned 5 [0057.889] lstrlenA (lpString="*.divx") returned 6 [0057.889] lstrlenA (lpString="*.mkv") returned 5 [0057.889] lstrlenA (lpString="*.mp3") returned 5 [0057.889] lstrlenA (lpString="*.wav") returned 5 [0057.889] lstrlenA (lpString="*.flac") returned 6 [0057.890] lstrlenA (lpString="*.ape") returned 5 [0057.890] lstrlenA (lpString="*.wma") returned 5 [0057.890] lstrlenA (lpString="*.ac3") returned 5 [0057.890] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="main", cAlternateFileName="")) returned 1 [0057.890] lstrcmpA (lpString1=".", lpString2="main") returned -1 [0057.890] lstrcmpA (lpString1="..", lpString2="main") returned -1 [0057.890] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned="keypad.xml" [0057.890] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="main" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main" [0057.890] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main") returned 69 [0057.890] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\*.*"), lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName=".", cAlternateFileName="")) returned 0x636b30 [0057.892] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.892] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName="..", cAlternateFileName="")) returned 1 [0057.892] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.892] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.892] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd05, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName="base.xml", cAlternateFileName="")) returned 1 [0057.892] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0057.892] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="base.xml") returned 1 [0057.892] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base.xml") returned 1 [0057.892] lstrcmpiA (lpString1="", lpString2="base.xml") returned -1 [0057.892] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\*.*") returned="*.*" [0057.892] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" [0057.893] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="" [0057.893] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0057.893] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0xffffffff [0057.893] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0057.893] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.893] WriteFile (in: hFile=0x1d4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.894] SetFileTime (hFile=0x1d4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.894] CloseHandle (hObject=0x1d4) returned 1 [0057.894] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="base.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" [0057.894] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.zip") returned 0 [0057.894] lstrlenA (lpString="*.zip") returned 5 [0057.894] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.rar") returned 0 [0057.894] lstrlenA (lpString="*.rar") returned 5 [0057.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.7z") returned 0 [0057.895] lstrlenA (lpString="*.7z") returned 4 [0057.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.tar") returned 0 [0057.895] lstrlenA (lpString="*.tar") returned 5 [0057.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.gzip") returned 0 [0057.895] lstrlenA (lpString="*.gzip") returned 6 [0057.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.jpg") returned 0 [0057.895] lstrlenA (lpString="*.jpg") returned 5 [0057.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.jpeg") returned 0 [0057.895] lstrlenA (lpString="*.jpeg") returned 6 [0057.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.psd") returned 0 [0057.895] lstrlenA (lpString="*.psd") returned 5 [0057.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.cdr") returned 0 [0057.895] lstrlenA (lpString="*.cdr") returned 5 [0057.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.dwg") returned 0 [0057.895] lstrlenA (lpString="*.dwg") returned 5 [0057.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.max") returned 0 [0057.895] lstrlenA (lpString="*.max") returned 5 [0057.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.bmp") returned 0 [0057.895] lstrlenA (lpString="*.bmp") returned 5 [0057.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.gif") returned 0 [0057.895] lstrlenA (lpString="*.gif") returned 5 [0057.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.png") returned 0 [0057.895] lstrlenA (lpString="*.png") returned 5 [0057.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.doc") returned 0 [0057.895] lstrlenA (lpString="*.doc") returned 5 [0057.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.docx") returned 0 [0057.895] lstrlenA (lpString="*.docx") returned 6 [0057.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.xls") returned 0 [0057.895] lstrlenA (lpString="*.xls") returned 5 [0057.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.xlsx") returned 0 [0057.895] lstrlenA (lpString="*.xlsx") returned 6 [0057.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.ppt") returned 0 [0057.896] lstrlenA (lpString="*.ppt") returned 5 [0057.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.pptx") returned 0 [0057.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.txt") returned 0 [0057.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.pdf") returned 0 [0057.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.djvu") returned 0 [0057.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.htm") returned 0 [0057.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.html") returned 0 [0057.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.mdb") returned 0 [0057.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.cer") returned 0 [0057.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.p12") returned 0 [0057.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.pfx") returned 0 [0057.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.kwm") returned 0 [0057.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.pwm") returned 0 [0057.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.1cd") returned 0 [0057.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.md") returned 0 [0057.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.mdf") returned 0 [0057.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.dbf") returned 0 [0057.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.odt") returned 0 [0057.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.vob") returned 0 [0057.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.ifo") returned 0 [0057.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.lnk") returned 0 [0057.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.torrent") returned 0 [0057.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.mov") returned 0 [0057.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.m2v") returned 0 [0057.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.3gp") returned 0 [0057.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.mpeg") returned 0 [0057.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.mpg") returned 0 [0057.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.flv") returned 0 [0057.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.avi") returned 0 [0057.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.mp4") returned 0 [0057.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.wmv") returned 0 [0057.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.divx") returned 0 [0057.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.mkv") returned 0 [0057.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.mp3") returned 0 [0057.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.wav") returned 0 [0057.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.flac") returned 0 [0057.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.ape") returned 0 [0057.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.wma") returned 0 [0057.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.ac3") returned 0 [0057.897] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1714a855, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1714a855, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1714a855, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0057.897] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0057.897] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="baseAltGr_rtl.xml") returned 1 [0057.897] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="baseAltGr_rtl.xml") returned 1 [0057.897] lstrcmpiA (lpString1="", lpString2="baseAltGr_rtl.xml") returned -1 [0057.897] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned="base.xml" [0057.897] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" [0057.897] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="" [0057.897] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0057.897] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0057.897] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="baseAltGr_rtl.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" [0057.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.zip") returned 0 [0057.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.rar") returned 0 [0057.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.7z") returned 0 [0057.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.tar") returned 0 [0057.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.gzip") returned 0 [0057.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.jpg") returned 0 [0057.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.jpeg") returned 0 [0057.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.psd") returned 0 [0057.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.cdr") returned 0 [0057.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.dwg") returned 0 [0057.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.max") returned 0 [0057.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.bmp") returned 0 [0057.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.gif") returned 0 [0057.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.png") returned 0 [0057.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.doc") returned 0 [0057.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.docx") returned 0 [0057.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.xls") returned 0 [0057.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.xlsx") returned 0 [0057.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.ppt") returned 0 [0057.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.pptx") returned 0 [0057.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.txt") returned 0 [0057.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.pdf") returned 0 [0057.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.djvu") returned 0 [0057.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.htm") returned 0 [0057.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.html") returned 0 [0057.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.mdb") returned 0 [0057.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.cer") returned 0 [0057.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.p12") returned 0 [0057.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.pfx") returned 0 [0057.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.kwm") returned 0 [0057.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.pwm") returned 0 [0057.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.1cd") returned 0 [0057.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.md") returned 0 [0057.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.mdf") returned 0 [0057.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.dbf") returned 0 [0057.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.odt") returned 0 [0057.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.vob") returned 0 [0057.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.ifo") returned 0 [0057.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.lnk") returned 0 [0057.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.torrent") returned 0 [0057.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.mov") returned 0 [0057.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.m2v") returned 0 [0057.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.3gp") returned 0 [0057.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.mpeg") returned 0 [0057.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.mpg") returned 0 [0057.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.flv") returned 0 [0057.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.avi") returned 0 [0057.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.mp4") returned 0 [0057.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.wmv") returned 0 [0057.900] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.divx") returned 0 [0057.900] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.mkv") returned 0 [0057.900] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.mp3") returned 0 [0057.900] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.wav") returned 0 [0057.900] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.flac") returned 0 [0057.900] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.ape") returned 0 [0057.900] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.wma") returned 0 [0057.900] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.ac3") returned 0 [0057.900] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0057.900] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0057.900] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="base_altgr.xml") returned 1 [0057.900] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_altgr.xml") returned 1 [0057.900] lstrcmpiA (lpString1="", lpString2="base_altgr.xml") returned -1 [0057.900] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned="baseAltGr_rtl.xml" [0057.900] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" [0057.900] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="" [0057.900] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0057.900] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0057.900] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="base_altgr.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" [0057.900] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.zip") returned 0 [0057.900] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.rar") returned 0 [0057.900] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.7z") returned 0 [0057.900] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.tar") returned 0 [0057.900] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.gzip") returned 0 [0057.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.jpg") returned 0 [0057.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.jpeg") returned 0 [0057.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.psd") returned 0 [0057.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.cdr") returned 0 [0057.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.dwg") returned 0 [0057.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.max") returned 0 [0057.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.bmp") returned 0 [0057.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.gif") returned 0 [0057.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.png") returned 0 [0057.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.doc") returned 0 [0057.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.docx") returned 0 [0057.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.xls") returned 0 [0057.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.xlsx") returned 0 [0057.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.ppt") returned 0 [0057.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.pptx") returned 0 [0057.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.txt") returned 0 [0057.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.pdf") returned 0 [0057.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.djvu") returned 0 [0057.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.htm") returned 0 [0057.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.html") returned 0 [0057.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.mdb") returned 0 [0057.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.cer") returned 0 [0057.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.p12") returned 0 [0057.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.pfx") returned 0 [0057.902] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.kwm") returned 0 [0057.902] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.pwm") returned 0 [0057.902] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.1cd") returned 0 [0057.902] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.md") returned 0 [0057.902] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.mdf") returned 0 [0057.902] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.dbf") returned 0 [0057.902] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.odt") returned 0 [0057.902] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.vob") returned 0 [0057.902] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.ifo") returned 0 [0057.902] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.lnk") returned 0 [0057.902] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.torrent") returned 0 [0057.902] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.mov") returned 0 [0057.902] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.m2v") returned 0 [0057.902] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.3gp") returned 0 [0057.902] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.mpeg") returned 0 [0057.902] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.mpg") returned 0 [0057.902] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.flv") returned 0 [0057.902] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.avi") returned 0 [0057.902] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.mp4") returned 0 [0057.902] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.wmv") returned 0 [0057.902] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.divx") returned 0 [0057.902] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.mkv") returned 0 [0057.902] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.mp3") returned 0 [0057.902] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.wav") returned 0 [0057.902] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.flac") returned 0 [0057.903] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.ape") returned 0 [0057.903] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.wma") returned 0 [0057.903] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.ac3") returned 0 [0057.903] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xdc9, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0057.903] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0057.903] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="base_ca.xml") returned 1 [0057.903] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_ca.xml") returned 1 [0057.903] lstrcmpiA (lpString1="", lpString2="base_ca.xml") returned -1 [0057.903] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned="base_altgr.xml" [0057.903] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" [0057.903] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="" [0057.903] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0057.903] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0057.903] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="base_ca.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" [0057.903] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.zip") returned 0 [0057.903] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.rar") returned 0 [0057.903] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.7z") returned 0 [0057.903] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.tar") returned 0 [0057.903] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.gzip") returned 0 [0057.903] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.jpg") returned 0 [0057.903] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.jpeg") returned 0 [0057.903] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.psd") returned 0 [0057.903] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.cdr") returned 0 [0057.903] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.dwg") returned 0 [0057.903] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.max") returned 0 [0057.903] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.bmp") returned 0 [0057.904] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.gif") returned 0 [0057.904] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.png") returned 0 [0057.904] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.doc") returned 0 [0057.904] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.docx") returned 0 [0057.904] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.xls") returned 0 [0057.904] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.xlsx") returned 0 [0057.904] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.ppt") returned 0 [0057.904] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.pptx") returned 0 [0057.904] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.txt") returned 0 [0057.904] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.pdf") returned 0 [0057.904] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.djvu") returned 0 [0057.904] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.htm") returned 0 [0057.904] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.html") returned 0 [0057.904] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.mdb") returned 0 [0057.904] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.cer") returned 0 [0057.904] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.p12") returned 0 [0057.904] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.pfx") returned 0 [0057.904] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.kwm") returned 0 [0057.904] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.pwm") returned 0 [0057.904] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.1cd") returned 0 [0057.904] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.md") returned 0 [0057.904] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.mdf") returned 0 [0057.904] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.dbf") returned 0 [0057.904] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.odt") returned 0 [0057.904] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.vob") returned 0 [0057.905] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.ifo") returned 0 [0057.905] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.lnk") returned 0 [0057.905] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.torrent") returned 0 [0057.905] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.mov") returned 0 [0057.905] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.m2v") returned 0 [0057.905] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.3gp") returned 0 [0057.905] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.mpeg") returned 0 [0057.905] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.mpg") returned 0 [0057.905] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.flv") returned 0 [0057.905] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.avi") returned 0 [0057.905] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.mp4") returned 0 [0057.905] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.wmv") returned 0 [0057.905] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.divx") returned 0 [0057.905] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.mkv") returned 0 [0057.905] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.mp3") returned 0 [0057.905] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.wav") returned 0 [0057.905] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.flac") returned 0 [0057.905] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.ape") returned 0 [0057.905] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.wma") returned 0 [0057.905] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.ac3") returned 0 [0057.905] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0057.905] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0057.905] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="base_heb.xml") returned 1 [0057.905] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_heb.xml") returned 1 [0057.906] lstrcmpiA (lpString1="", lpString2="base_heb.xml") returned -1 [0057.906] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned="base_ca.xml" [0057.906] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" [0057.906] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="" [0057.906] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0057.906] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0057.906] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="base_heb.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" [0057.906] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.zip") returned 0 [0057.906] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.rar") returned 0 [0057.906] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.7z") returned 0 [0057.906] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.tar") returned 0 [0057.906] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.gzip") returned 0 [0057.906] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.jpg") returned 0 [0057.906] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.jpeg") returned 0 [0057.906] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.psd") returned 0 [0057.906] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.cdr") returned 0 [0057.906] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.dwg") returned 0 [0057.906] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.max") returned 0 [0057.906] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.bmp") returned 0 [0057.906] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.gif") returned 0 [0057.906] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.png") returned 0 [0057.906] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.doc") returned 0 [0057.906] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.docx") returned 0 [0057.906] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.xls") returned 0 [0057.906] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.xlsx") returned 0 [0057.907] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.ppt") returned 0 [0057.907] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.pptx") returned 0 [0057.907] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.txt") returned 0 [0057.907] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0057.907] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0057.907] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="base_jpn.xml") returned 1 [0057.907] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_jpn.xml") returned 1 [0057.907] lstrcmpiA (lpString1="", lpString2="base_jpn.xml") returned -1 [0057.907] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned="base_heb.xml" [0057.907] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" [0057.907] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="" [0057.907] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0057.907] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0057.907] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="base_jpn.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" [0057.907] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0057.907] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0057.907] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="base_kor.xml") returned 1 [0057.907] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_kor.xml") returned 1 [0057.907] lstrcmpiA (lpString1="", lpString2="base_kor.xml") returned -1 [0057.908] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned="base_jpn.xml" [0057.908] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" [0057.908] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="" [0057.908] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0057.908] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0057.908] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="base_kor.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" [0057.922] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0057.922] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0057.922] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="base_rtl.xml") returned 1 [0057.922] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_rtl.xml") returned 1 [0057.922] lstrcmpiA (lpString1="", lpString2="base_rtl.xml") returned -1 [0057.922] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned="base_kor.xml" [0057.922] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" [0057.922] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="" [0057.922] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0057.922] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0057.922] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="base_rtl.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" [0057.922] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1714a855, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1714a855, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1714a855, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0057.922] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0057.922] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ja-jp.xml") returned -1 [0057.922] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ja-jp.xml") returned -1 [0057.922] lstrcmpiA (lpString1="", lpString2="ja-jp.xml") returned -1 [0057.922] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned="base_rtl.xml" [0057.923] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" [0057.923] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="" [0057.923] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0057.923] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0057.923] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="ja-jp.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" [0057.923] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0057.923] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0057.923] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ko-kr.xml") returned -1 [0057.923] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ko-kr.xml") returned -1 [0057.923] lstrcmpiA (lpString1="", lpString2="ko-kr.xml") returned -1 [0057.923] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned="ja-jp.xml" [0057.923] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" [0057.923] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="" [0057.923] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0057.923] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0057.923] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="ko-kr.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" [0057.923] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0057.923] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0057.923] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="zh-changjei.xml") returned -1 [0057.923] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="zh-changjei.xml") returned -1 [0057.923] lstrcmpiA (lpString1="", lpString2="zh-changjei.xml") returned -1 [0057.924] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned="ko-kr.xml" [0057.924] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" [0057.924] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="" [0057.924] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0057.924] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0057.924] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="zh-changjei.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" [0057.924] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0057.924] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0057.924] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="zh-dayi.xml") returned -1 [0057.924] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="zh-dayi.xml") returned -1 [0057.924] lstrcmpiA (lpString1="", lpString2="zh-dayi.xml") returned -1 [0057.924] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned="zh-changjei.xml" [0057.924] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" [0057.924] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="" [0057.924] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0057.924] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0057.924] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="zh-dayi.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" [0057.924] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0057.924] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0057.925] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="zh-phonetic.xml") returned -1 [0057.925] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="zh-phonetic.xml") returned -1 [0057.925] lstrcmpiA (lpString1="", lpString2="zh-phonetic.xml") returned -1 [0057.925] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned="zh-dayi.xml" [0057.925] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" [0057.925] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="" [0057.925] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0057.925] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0057.925] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="zh-phonetic.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" [0057.925] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0057.925] FindClose (in: hFindFile=0x636b30 | out: hFindFile=0x636b30) returned 1 [0057.925] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="main.xml", cAlternateFileName="")) returned 1 [0057.925] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.925] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="main.xml") returned -1 [0057.926] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="main.xml") returned -1 [0057.926] lstrcmpiA (lpString1="", lpString2="main.xml") returned -1 [0057.926] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0057.926] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" [0057.926] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="" [0057.926] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0057.926] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0057.926] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="main.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" [0057.926] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="oskclearui", cAlternateFileName="OSKCLE~1")) returned 1 [0057.926] lstrcmpA (lpString1=".", lpString2="oskclearui") returned -1 [0057.926] lstrcmpA (lpString1="..", lpString2="oskclearui") returned -1 [0057.926] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned="main.xml" [0057.926] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\*.*"), lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName=".", cAlternateFileName="")) returned 0x636530 [0057.926] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.926] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName="..", cAlternateFileName="")) returned 1 [0057.926] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.926] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.926] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName="oskclearuibase.xml", cAlternateFileName="")) returned 1 [0057.927] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0057.927] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oskclearuibase.xml") returned -1 [0057.927] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oskclearuibase.xml") returned -1 [0057.927] lstrcmpiA (lpString1="", lpString2="oskclearuibase.xml") returned -1 [0057.927] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\*.*") returned="*.*" [0057.927] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\" [0057.927] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\") returned="" [0057.927] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\how to decrypt files.txt")) returned 0xffffffff [0057.927] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0057.927] WriteFile (in: hFile=0x1d4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.928] SetFileTime (hFile=0x1d4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.928] CloseHandle (hObject=0x1d4) returned 1 [0057.929] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.zip") returned 0 [0057.929] lstrlenA (lpString="*.zip") returned 5 [0057.929] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.rar") returned 0 [0057.929] lstrlenA (lpString="*.rar") returned 5 [0057.929] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.7z") returned 0 [0057.929] lstrlenA (lpString="*.7z") returned 4 [0057.929] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.tar") returned 0 [0057.929] lstrlenA (lpString="*.tar") returned 5 [0057.929] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.gzip") returned 0 [0057.929] lstrlenA (lpString="*.gzip") returned 6 [0057.929] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.jpg") returned 0 [0057.929] lstrlenA (lpString="*.jpg") returned 5 [0057.929] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.jpeg") returned 0 [0057.929] lstrlenA (lpString="*.jpeg") returned 6 [0057.929] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.psd") returned 0 [0057.929] lstrlenA (lpString="*.psd") returned 5 [0057.929] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.cdr") returned 0 [0057.929] lstrlenA (lpString="*.cdr") returned 5 [0057.929] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.dwg") returned 0 [0057.929] lstrlenA (lpString="*.dwg") returned 5 [0057.929] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.max") returned 0 [0057.929] lstrlenA (lpString="*.max") returned 5 [0057.929] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.bmp") returned 0 [0057.929] lstrlenA (lpString="*.bmp") returned 5 [0057.929] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.gif") returned 0 [0057.929] lstrlenA (lpString="*.gif") returned 5 [0057.929] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.png") returned 0 [0057.929] lstrlenA (lpString="*.png") returned 5 [0057.929] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.doc") returned 0 [0057.930] lstrlenA (lpString="*.doc") returned 5 [0057.930] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.docx") returned 0 [0057.930] lstrlenA (lpString="*.docx") returned 6 [0057.930] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.xls") returned 0 [0057.930] lstrlenA (lpString="*.xls") returned 5 [0057.930] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.xlsx") returned 0 [0057.930] lstrlenA (lpString="*.xlsx") returned 6 [0057.930] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.ppt") returned 0 [0057.930] lstrlenA (lpString="*.ppt") returned 5 [0057.930] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.pptx") returned 0 [0057.930] lstrlenA (lpString="*.pptx") returned 6 [0057.930] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.txt") returned 0 [0057.930] lstrlenA (lpString="*.txt") returned 5 [0057.930] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.pdf") returned 0 [0057.930] lstrlenA (lpString="*.pdf") returned 5 [0057.930] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.djvu") returned 0 [0057.930] lstrlenA (lpString="*.djvu") returned 6 [0057.930] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.htm") returned 0 [0057.930] lstrlenA (lpString="*.htm") returned 5 [0057.930] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.html") returned 0 [0057.930] lstrlenA (lpString="*.html") returned 6 [0057.930] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.mdb") returned 0 [0057.930] lstrlenA (lpString="*.mdb") returned 5 [0057.930] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.cer") returned 0 [0057.930] lstrlenA (lpString="*.cer") returned 5 [0057.930] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.p12") returned 0 [0057.930] lstrlenA (lpString="*.p12") returned 5 [0057.930] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.pfx") returned 0 [0057.930] lstrlenA (lpString="*.pfx") returned 5 [0057.930] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.kwm") returned 0 [0057.930] lstrlenA (lpString="*.kwm") returned 5 [0057.931] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.pwm") returned 0 [0057.931] lstrlenA (lpString="*.pwm") returned 5 [0057.931] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.1cd") returned 0 [0057.931] lstrlenA (lpString="*.1cd") returned 5 [0057.931] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.md") returned 0 [0057.931] lstrlenA (lpString="*.md") returned 4 [0057.931] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.mdf") returned 0 [0057.931] lstrlenA (lpString="*.mdf") returned 5 [0057.931] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.dbf") returned 0 [0057.931] lstrlenA (lpString="*.dbf") returned 5 [0057.931] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.odt") returned 0 [0057.931] lstrlenA (lpString="*.odt") returned 5 [0057.931] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.vob") returned 0 [0057.931] lstrlenA (lpString="*.vob") returned 5 [0057.931] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.ifo") returned 0 [0057.931] lstrlenA (lpString="*.ifo") returned 5 [0057.931] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.lnk") returned 0 [0057.931] lstrlenA (lpString="*.lnk") returned 5 [0057.931] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.torrent") returned 0 [0057.931] lstrlenA (lpString="*.torrent") returned 9 [0057.931] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.mov") returned 0 [0057.931] lstrlenA (lpString="*.mov") returned 5 [0057.931] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.m2v") returned 0 [0057.931] lstrlenA (lpString="*.m2v") returned 5 [0057.931] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.3gp") returned 0 [0057.931] lstrlenA (lpString="*.3gp") returned 5 [0057.931] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.mpeg") returned 0 [0057.931] lstrlenA (lpString="*.mpeg") returned 6 [0057.931] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.mpg") returned 0 [0057.931] lstrlenA (lpString="*.mpg") returned 5 [0057.931] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.flv") returned 0 [0057.932] lstrlenA (lpString="*.flv") returned 5 [0057.932] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.avi") returned 0 [0057.932] lstrlenA (lpString="*.avi") returned 5 [0057.932] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.mp4") returned 0 [0057.932] lstrlenA (lpString="*.mp4") returned 5 [0057.932] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.wmv") returned 0 [0057.932] lstrlenA (lpString="*.wmv") returned 5 [0057.932] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.divx") returned 0 [0057.932] lstrlenA (lpString="*.divx") returned 6 [0057.932] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.mkv") returned 0 [0057.932] lstrlenA (lpString="*.mkv") returned 5 [0057.932] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.mp3") returned 0 [0057.932] lstrlenA (lpString="*.mp3") returned 5 [0057.932] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.wav") returned 0 [0057.932] lstrlenA (lpString="*.wav") returned 5 [0057.932] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.flac") returned 0 [0057.932] lstrlenA (lpString="*.flac") returned 6 [0057.932] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.ape") returned 0 [0057.932] lstrlenA (lpString="*.ape") returned 5 [0057.932] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.wma") returned 0 [0057.932] lstrlenA (lpString="*.wma") returned 5 [0057.932] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.ac3") returned 0 [0057.932] lstrlenA (lpString="*.ac3") returned 5 [0057.932] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName="oskclearuibase.xml", cAlternateFileName="")) returned 0 [0057.932] FindClose (in: hFindFile=0x636530 | out: hFindFile=0x636530) returned 1 [0057.932] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1 [0057.932] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.933] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oskclearui.xml") returned -1 [0057.933] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oskclearui.xml") returned -1 [0057.933] lstrcmpiA (lpString1="", lpString2="oskclearui.xml") returned -1 [0057.933] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0057.933] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" [0057.933] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="" [0057.933] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0057.933] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0057.933] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="oskclearui.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" [0057.933] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.zip") returned 0 [0057.933] lstrlenA (lpString="*.zip") returned 5 [0057.933] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.rar") returned 0 [0057.933] lstrlenA (lpString="*.rar") returned 5 [0057.933] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.7z") returned 0 [0057.933] lstrlenA (lpString="*.7z") returned 4 [0057.933] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.tar") returned 0 [0057.933] lstrlenA (lpString="*.tar") returned 5 [0057.933] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.gzip") returned 0 [0057.933] lstrlenA (lpString="*.gzip") returned 6 [0057.933] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.jpg") returned 0 [0057.933] lstrlenA (lpString="*.jpg") returned 5 [0057.933] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.jpeg") returned 0 [0057.933] lstrlenA (lpString="*.jpeg") returned 6 [0057.933] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.psd") returned 0 [0057.933] lstrlenA (lpString="*.psd") returned 5 [0057.933] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.cdr") returned 0 [0057.933] lstrlenA (lpString="*.cdr") returned 5 [0057.933] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.dwg") returned 0 [0057.933] lstrlenA (lpString="*.dwg") returned 5 [0057.934] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.max") returned 0 [0057.934] lstrlenA (lpString="*.max") returned 5 [0057.934] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.bmp") returned 0 [0057.934] lstrlenA (lpString="*.bmp") returned 5 [0057.934] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.gif") returned 0 [0057.934] lstrlenA (lpString="*.gif") returned 5 [0057.934] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.png") returned 0 [0057.934] lstrlenA (lpString="*.png") returned 5 [0057.934] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.doc") returned 0 [0057.934] lstrlenA (lpString="*.doc") returned 5 [0057.934] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.docx") returned 0 [0057.934] lstrlenA (lpString="*.docx") returned 6 [0057.934] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.xls") returned 0 [0057.934] lstrlenA (lpString="*.xls") returned 5 [0057.934] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.xlsx") returned 0 [0057.934] lstrlenA (lpString="*.xlsx") returned 6 [0057.934] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.ppt") returned 0 [0057.934] lstrlenA (lpString="*.ppt") returned 5 [0057.934] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.pptx") returned 0 [0057.934] lstrlenA (lpString="*.pptx") returned 6 [0057.934] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.txt") returned 0 [0057.934] lstrlenA (lpString="*.txt") returned 5 [0057.934] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.pdf") returned 0 [0057.934] lstrlenA (lpString="*.pdf") returned 5 [0057.934] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.djvu") returned 0 [0057.934] lstrlenA (lpString="*.djvu") returned 6 [0057.934] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.htm") returned 0 [0057.934] lstrlenA (lpString="*.htm") returned 5 [0057.934] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.html") returned 0 [0057.934] lstrlenA (lpString="*.html") returned 6 [0057.934] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.mdb") returned 0 [0057.934] lstrlenA (lpString="*.mdb") returned 5 [0057.934] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.cer") returned 0 [0057.935] lstrlenA (lpString="*.cer") returned 5 [0057.935] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.p12") returned 0 [0057.935] lstrlenA (lpString="*.p12") returned 5 [0057.935] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.pfx") returned 0 [0057.935] lstrlenA (lpString="*.pfx") returned 5 [0057.935] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.kwm") returned 0 [0057.935] lstrlenA (lpString="*.kwm") returned 5 [0057.935] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.pwm") returned 0 [0057.935] lstrlenA (lpString="*.pwm") returned 5 [0057.935] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.1cd") returned 0 [0057.935] lstrlenA (lpString="*.1cd") returned 5 [0057.935] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.md") returned 0 [0057.935] lstrlenA (lpString="*.md") returned 4 [0057.935] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.mdf") returned 0 [0057.935] lstrlenA (lpString="*.mdf") returned 5 [0057.935] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.dbf") returned 0 [0057.935] lstrlenA (lpString="*.dbf") returned 5 [0057.935] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.odt") returned 0 [0057.935] lstrlenA (lpString="*.odt") returned 5 [0057.935] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.vob") returned 0 [0057.935] lstrlenA (lpString="*.vob") returned 5 [0057.935] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.ifo") returned 0 [0057.935] lstrlenA (lpString="*.ifo") returned 5 [0057.935] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.lnk") returned 0 [0057.935] lstrlenA (lpString="*.lnk") returned 5 [0057.935] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.torrent") returned 0 [0057.935] lstrlenA (lpString="*.torrent") returned 9 [0057.935] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.mov") returned 0 [0057.935] lstrlenA (lpString="*.mov") returned 5 [0057.935] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.m2v") returned 0 [0057.935] lstrlenA (lpString="*.m2v") returned 5 [0057.935] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.3gp") returned 0 [0057.935] lstrlenA (lpString="*.3gp") returned 5 [0057.936] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.mpeg") returned 0 [0057.936] lstrlenA (lpString="*.mpeg") returned 6 [0057.936] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.mpg") returned 0 [0057.936] lstrlenA (lpString="*.mpg") returned 5 [0057.936] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.flv") returned 0 [0057.936] lstrlenA (lpString="*.flv") returned 5 [0057.936] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.avi") returned 0 [0057.936] lstrlenA (lpString="*.avi") returned 5 [0057.936] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.mp4") returned 0 [0057.936] lstrlenA (lpString="*.mp4") returned 5 [0057.936] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.wmv") returned 0 [0057.936] lstrlenA (lpString="*.wmv") returned 5 [0057.936] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.divx") returned 0 [0057.936] lstrlenA (lpString="*.divx") returned 6 [0057.936] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.mkv") returned 0 [0057.936] lstrlenA (lpString="*.mkv") returned 5 [0057.936] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.mp3") returned 0 [0057.936] lstrlenA (lpString="*.mp3") returned 5 [0057.936] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.wav") returned 0 [0057.936] lstrlenA (lpString="*.wav") returned 5 [0057.936] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.flac") returned 0 [0057.936] lstrlenA (lpString="*.flac") returned 6 [0057.936] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.ape") returned 0 [0057.936] lstrlenA (lpString="*.ape") returned 5 [0057.936] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.wma") returned 0 [0057.936] lstrlenA (lpString="*.wma") returned 5 [0057.936] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.ac3") returned 0 [0057.936] lstrlenA (lpString="*.ac3") returned 5 [0057.936] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0057.936] lstrcmpA (lpString1=".", lpString2="oskmenu") returned -1 [0057.936] lstrcmpA (lpString1="..", lpString2="oskmenu") returned -1 [0057.937] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned="oskclearui.xml" [0057.937] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="oskmenu" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu" [0057.937] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu") returned 72 [0057.937] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\*.*"), lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName=".", cAlternateFileName="")) returned 0x636b30 [0057.937] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.937] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName="..", cAlternateFileName="")) returned 1 [0057.937] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.937] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.937] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0057.937] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0057.937] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oskmenubase.xml") returned -1 [0057.937] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oskmenubase.xml") returned -1 [0057.937] lstrcmpiA (lpString1="", lpString2="oskmenubase.xml") returned -1 [0057.937] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\*.*") returned="*.*" [0057.937] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\" [0057.937] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned="" [0057.937] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\HOW TO DECRYPT FILES.txt" [0057.937] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\how to decrypt files.txt")) returned 0xffffffff [0057.937] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0057.938] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.938] WriteFile (in: hFile=0x1d4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.939] SetFileTime (hFile=0x1d4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.939] CloseHandle (hObject=0x1d4) returned 1 [0057.939] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\", lpString2="oskmenubase.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" [0057.939] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.zip") returned 0 [0057.939] lstrlenA (lpString="*.zip") returned 5 [0057.939] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.rar") returned 0 [0057.939] lstrlenA (lpString="*.rar") returned 5 [0057.939] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.7z") returned 0 [0057.939] lstrlenA (lpString="*.7z") returned 4 [0057.939] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.tar") returned 0 [0057.940] lstrlenA (lpString="*.tar") returned 5 [0057.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.gzip") returned 0 [0057.940] lstrlenA (lpString="*.gzip") returned 6 [0057.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.jpg") returned 0 [0057.940] lstrlenA (lpString="*.jpg") returned 5 [0057.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.jpeg") returned 0 [0057.940] lstrlenA (lpString="*.jpeg") returned 6 [0057.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.psd") returned 0 [0057.940] lstrlenA (lpString="*.psd") returned 5 [0057.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.cdr") returned 0 [0057.940] lstrlenA (lpString="*.cdr") returned 5 [0057.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.dwg") returned 0 [0057.940] lstrlenA (lpString="*.dwg") returned 5 [0057.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.max") returned 0 [0057.940] lstrlenA (lpString="*.max") returned 5 [0057.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.bmp") returned 0 [0057.940] lstrlenA (lpString="*.bmp") returned 5 [0057.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.gif") returned 0 [0057.940] lstrlenA (lpString="*.gif") returned 5 [0057.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.png") returned 0 [0057.940] lstrlenA (lpString="*.png") returned 5 [0057.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.doc") returned 0 [0057.940] lstrlenA (lpString="*.doc") returned 5 [0057.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.docx") returned 0 [0057.940] lstrlenA (lpString="*.docx") returned 6 [0057.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.xls") returned 0 [0057.940] lstrlenA (lpString="*.xls") returned 5 [0057.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.xlsx") returned 0 [0057.940] lstrlenA (lpString="*.xlsx") returned 6 [0057.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.ppt") returned 0 [0057.940] lstrlenA (lpString="*.ppt") returned 5 [0057.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.pptx") returned 0 [0057.940] lstrlenA (lpString="*.pptx") returned 6 [0057.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.txt") returned 0 [0057.940] lstrlenA (lpString="*.txt") returned 5 [0057.941] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.pdf") returned 0 [0057.941] lstrlenA (lpString="*.pdf") returned 5 [0057.941] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.djvu") returned 0 [0057.941] lstrlenA (lpString="*.djvu") returned 6 [0057.941] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.htm") returned 0 [0057.941] lstrlenA (lpString="*.htm") returned 5 [0057.941] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.html") returned 0 [0057.941] lstrlenA (lpString="*.html") returned 6 [0057.941] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.mdb") returned 0 [0057.941] lstrlenA (lpString="*.mdb") returned 5 [0057.941] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.cer") returned 0 [0057.941] lstrlenA (lpString="*.cer") returned 5 [0057.941] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.p12") returned 0 [0057.941] lstrlenA (lpString="*.p12") returned 5 [0057.941] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.pfx") returned 0 [0057.941] lstrlenA (lpString="*.pfx") returned 5 [0057.941] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.kwm") returned 0 [0057.941] lstrlenA (lpString="*.kwm") returned 5 [0057.941] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.pwm") returned 0 [0057.941] lstrlenA (lpString="*.pwm") returned 5 [0057.941] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.1cd") returned 0 [0057.941] lstrlenA (lpString="*.1cd") returned 5 [0057.941] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.md") returned 0 [0057.941] lstrlenA (lpString="*.md") returned 4 [0057.941] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.mdf") returned 0 [0057.941] lstrlenA (lpString="*.mdf") returned 5 [0057.941] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.dbf") returned 0 [0057.941] lstrlenA (lpString="*.dbf") returned 5 [0057.941] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.odt") returned 0 [0057.941] lstrlenA (lpString="*.odt") returned 5 [0057.941] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.vob") returned 0 [0057.941] lstrlenA (lpString="*.vob") returned 5 [0057.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.ifo") returned 0 [0057.942] lstrlenA (lpString="*.ifo") returned 5 [0057.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.lnk") returned 0 [0057.942] lstrlenA (lpString="*.lnk") returned 5 [0057.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.torrent") returned 0 [0057.942] lstrlenA (lpString="*.torrent") returned 9 [0057.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.mov") returned 0 [0057.942] lstrlenA (lpString="*.mov") returned 5 [0057.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.m2v") returned 0 [0057.942] lstrlenA (lpString="*.m2v") returned 5 [0057.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.3gp") returned 0 [0057.942] lstrlenA (lpString="*.3gp") returned 5 [0057.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.mpeg") returned 0 [0057.942] lstrlenA (lpString="*.mpeg") returned 6 [0057.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.mpg") returned 0 [0057.942] lstrlenA (lpString="*.mpg") returned 5 [0057.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.flv") returned 0 [0057.942] lstrlenA (lpString="*.flv") returned 5 [0057.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.avi") returned 0 [0057.942] lstrlenA (lpString="*.avi") returned 5 [0057.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.mp4") returned 0 [0057.942] lstrlenA (lpString="*.mp4") returned 5 [0057.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.wmv") returned 0 [0057.942] lstrlenA (lpString="*.wmv") returned 5 [0057.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.divx") returned 0 [0057.942] lstrlenA (lpString="*.divx") returned 6 [0057.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.mkv") returned 0 [0057.942] lstrlenA (lpString="*.mkv") returned 5 [0057.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.mp3") returned 0 [0057.942] lstrlenA (lpString="*.mp3") returned 5 [0057.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.wav") returned 0 [0057.942] lstrlenA (lpString="*.wav") returned 5 [0057.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.flac") returned 0 [0057.942] lstrlenA (lpString="*.flac") returned 6 [0057.943] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.ape") returned 0 [0057.943] lstrlenA (lpString="*.ape") returned 5 [0057.943] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.wma") returned 0 [0057.943] lstrlenA (lpString="*.wma") returned 5 [0057.943] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.ac3") returned 0 [0057.943] lstrlenA (lpString="*.ac3") returned 5 [0057.943] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0057.943] FindClose (in: hFindFile=0x636b30 | out: hFindFile=0x636b30) returned 1 [0057.943] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0057.943] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.943] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oskmenu.xml") returned -1 [0057.943] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oskmenu.xml") returned -1 [0057.943] lstrcmpiA (lpString1="", lpString2="oskmenu.xml") returned -1 [0057.943] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0057.943] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" [0057.943] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="" [0057.943] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0057.943] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0057.943] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="oskmenu.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" [0057.943] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.zip") returned 0 [0057.943] lstrlenA (lpString="*.zip") returned 5 [0057.943] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.rar") returned 0 [0057.943] lstrlenA (lpString="*.rar") returned 5 [0057.943] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.7z") returned 0 [0057.943] lstrlenA (lpString="*.7z") returned 4 [0057.943] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.tar") returned 0 [0057.944] lstrlenA (lpString="*.tar") returned 5 [0057.944] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.gzip") returned 0 [0057.944] lstrlenA (lpString="*.gzip") returned 6 [0057.944] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.jpg") returned 0 [0057.944] lstrlenA (lpString="*.jpg") returned 5 [0057.944] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.jpeg") returned 0 [0057.944] lstrlenA (lpString="*.jpeg") returned 6 [0057.944] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.psd") returned 0 [0057.944] lstrlenA (lpString="*.psd") returned 5 [0057.944] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.cdr") returned 0 [0057.944] lstrlenA (lpString="*.cdr") returned 5 [0057.944] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.dwg") returned 0 [0057.944] lstrlenA (lpString="*.dwg") returned 5 [0057.944] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.max") returned 0 [0057.944] lstrlenA (lpString="*.max") returned 5 [0057.944] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.bmp") returned 0 [0057.944] lstrlenA (lpString="*.bmp") returned 5 [0057.944] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.gif") returned 0 [0057.944] lstrlenA (lpString="*.gif") returned 5 [0057.944] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.png") returned 0 [0057.944] lstrlenA (lpString="*.png") returned 5 [0057.944] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.doc") returned 0 [0057.944] lstrlenA (lpString="*.doc") returned 5 [0057.944] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.docx") returned 0 [0057.944] lstrlenA (lpString="*.docx") returned 6 [0057.944] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.xls") returned 0 [0057.944] lstrlenA (lpString="*.xls") returned 5 [0057.944] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.xlsx") returned 0 [0057.944] lstrlenA (lpString="*.xlsx") returned 6 [0057.944] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.ppt") returned 0 [0057.944] lstrlenA (lpString="*.ppt") returned 5 [0057.944] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.pptx") returned 0 [0057.944] lstrlenA (lpString="*.pptx") returned 6 [0057.944] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.txt") returned 0 [0057.945] lstrlenA (lpString="*.txt") returned 5 [0057.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.pdf") returned 0 [0057.945] lstrlenA (lpString="*.pdf") returned 5 [0057.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.djvu") returned 0 [0057.945] lstrlenA (lpString="*.djvu") returned 6 [0057.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.htm") returned 0 [0057.945] lstrlenA (lpString="*.htm") returned 5 [0057.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.html") returned 0 [0057.945] lstrlenA (lpString="*.html") returned 6 [0057.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.mdb") returned 0 [0057.945] lstrlenA (lpString="*.mdb") returned 5 [0057.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.cer") returned 0 [0057.945] lstrlenA (lpString="*.cer") returned 5 [0057.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.p12") returned 0 [0057.945] lstrlenA (lpString="*.p12") returned 5 [0057.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.pfx") returned 0 [0057.945] lstrlenA (lpString="*.pfx") returned 5 [0057.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.kwm") returned 0 [0057.945] lstrlenA (lpString="*.kwm") returned 5 [0057.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.pwm") returned 0 [0057.945] lstrlenA (lpString="*.pwm") returned 5 [0057.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.1cd") returned 0 [0057.945] lstrlenA (lpString="*.1cd") returned 5 [0057.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.md") returned 0 [0057.945] lstrlenA (lpString="*.md") returned 4 [0057.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.mdf") returned 0 [0057.945] lstrlenA (lpString="*.mdf") returned 5 [0057.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.dbf") returned 0 [0057.945] lstrlenA (lpString="*.dbf") returned 5 [0057.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.odt") returned 0 [0057.945] lstrlenA (lpString="*.odt") returned 5 [0057.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.vob") returned 0 [0057.946] lstrlenA (lpString="*.vob") returned 5 [0057.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.ifo") returned 0 [0057.946] lstrlenA (lpString="*.ifo") returned 5 [0057.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.lnk") returned 0 [0057.946] lstrlenA (lpString="*.lnk") returned 5 [0057.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.torrent") returned 0 [0057.946] lstrlenA (lpString="*.torrent") returned 9 [0057.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.mov") returned 0 [0057.946] lstrlenA (lpString="*.mov") returned 5 [0057.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.m2v") returned 0 [0057.946] lstrlenA (lpString="*.m2v") returned 5 [0057.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.3gp") returned 0 [0057.946] lstrlenA (lpString="*.3gp") returned 5 [0057.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.mpeg") returned 0 [0057.946] lstrlenA (lpString="*.mpeg") returned 6 [0057.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.mpg") returned 0 [0057.946] lstrlenA (lpString="*.mpg") returned 5 [0057.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.flv") returned 0 [0057.946] lstrlenA (lpString="*.flv") returned 5 [0057.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.avi") returned 0 [0057.946] lstrlenA (lpString="*.avi") returned 5 [0057.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.mp4") returned 0 [0057.946] lstrlenA (lpString="*.mp4") returned 5 [0057.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.wmv") returned 0 [0057.946] lstrlenA (lpString="*.wmv") returned 5 [0057.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.divx") returned 0 [0057.946] lstrlenA (lpString="*.divx") returned 6 [0057.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.mkv") returned 0 [0057.946] lstrlenA (lpString="*.mkv") returned 5 [0057.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.mp3") returned 0 [0057.946] lstrlenA (lpString="*.mp3") returned 5 [0057.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.wav") returned 0 [0057.947] lstrlenA (lpString="*.wav") returned 5 [0057.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.flac") returned 0 [0057.947] lstrlenA (lpString="*.flac") returned 6 [0057.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.ape") returned 0 [0057.947] lstrlenA (lpString="*.ape") returned 5 [0057.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.wma") returned 0 [0057.947] lstrlenA (lpString="*.wma") returned 5 [0057.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.ac3") returned 0 [0057.947] lstrlenA (lpString="*.ac3") returned 5 [0057.947] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="osknav", cAlternateFileName="")) returned 1 [0057.947] lstrcmpA (lpString1=".", lpString2="osknav") returned -1 [0057.947] lstrcmpA (lpString1="..", lpString2="osknav") returned -1 [0057.947] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned="oskmenu.xml" [0057.947] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="osknav" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav" [0057.947] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav") returned 71 [0057.947] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\*.*"), lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName=".", cAlternateFileName="")) returned 0x636b30 [0057.947] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.947] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName="..", cAlternateFileName="")) returned 1 [0057.947] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.947] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.947] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName="osknavbase.xml", cAlternateFileName="")) returned 1 [0057.947] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0057.947] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="osknavbase.xml") returned -1 [0057.947] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="osknavbase.xml") returned -1 [0057.948] lstrcmpiA (lpString1="", lpString2="osknavbase.xml") returned -1 [0057.948] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\*.*") returned="*.*" [0057.948] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\" [0057.948] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\") returned="" [0057.948] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\HOW TO DECRYPT FILES.txt" [0057.948] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\how to decrypt files.txt")) returned 0xffffffff [0057.948] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0057.948] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.948] WriteFile (in: hFile=0x1d4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.950] SetFileTime (hFile=0x1d4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.950] CloseHandle (hObject=0x1d4) returned 1 [0057.950] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\", lpString2="osknavbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" [0057.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.zip") returned 0 [0057.950] lstrlenA (lpString="*.zip") returned 5 [0057.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.rar") returned 0 [0057.950] lstrlenA (lpString="*.rar") returned 5 [0057.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.7z") returned 0 [0057.950] lstrlenA (lpString="*.7z") returned 4 [0057.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.tar") returned 0 [0057.950] lstrlenA (lpString="*.tar") returned 5 [0057.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.gzip") returned 0 [0057.950] lstrlenA (lpString="*.gzip") returned 6 [0057.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.jpg") returned 0 [0057.951] lstrlenA (lpString="*.jpg") returned 5 [0057.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.jpeg") returned 0 [0057.951] lstrlenA (lpString="*.jpeg") returned 6 [0057.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.psd") returned 0 [0057.951] lstrlenA (lpString="*.psd") returned 5 [0057.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.cdr") returned 0 [0057.951] lstrlenA (lpString="*.cdr") returned 5 [0057.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.dwg") returned 0 [0057.951] lstrlenA (lpString="*.dwg") returned 5 [0057.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.max") returned 0 [0057.951] lstrlenA (lpString="*.max") returned 5 [0057.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.bmp") returned 0 [0057.951] lstrlenA (lpString="*.bmp") returned 5 [0057.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.gif") returned 0 [0057.951] lstrlenA (lpString="*.gif") returned 5 [0057.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.png") returned 0 [0057.951] lstrlenA (lpString="*.png") returned 5 [0057.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.doc") returned 0 [0057.951] lstrlenA (lpString="*.doc") returned 5 [0057.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.docx") returned 0 [0057.951] lstrlenA (lpString="*.docx") returned 6 [0057.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.xls") returned 0 [0057.951] lstrlenA (lpString="*.xls") returned 5 [0057.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.xlsx") returned 0 [0057.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.ppt") returned 0 [0057.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.pptx") returned 0 [0057.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.txt") returned 0 [0057.952] FindNextFileA (in: hFindFile=0x636b30, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName="osknavbase.xml", cAlternateFileName="")) returned 0 [0057.952] FindClose (in: hFindFile=0x636b30 | out: hFindFile=0x636b30) returned 1 [0057.952] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="osknav.xml", cAlternateFileName="")) returned 1 [0057.952] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.952] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="osknav.xml") returned -1 [0057.952] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="osknav.xml") returned -1 [0057.952] lstrcmpiA (lpString1="", lpString2="osknav.xml") returned -1 [0057.952] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0057.952] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" [0057.952] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="" [0057.952] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0057.952] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0057.952] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="osknav.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" [0057.952] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0057.952] lstrcmpA (lpString1=".", lpString2="osknumpad") returned -1 [0057.952] lstrcmpA (lpString1="..", lpString2="osknumpad") returned -1 [0057.952] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned="osknav.xml" [0057.952] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="osknumpad" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad" [0057.952] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\*.*"), lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName=".", cAlternateFileName="")) returned 0x6365f0 [0057.953] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.953] FindNextFileA (in: hFindFile=0x6365f0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName="..", cAlternateFileName="")) returned 1 [0057.953] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.953] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.953] FindNextFileA (in: hFindFile=0x6365f0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0057.953] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0057.953] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="osknumpadbase.xml") returned -1 [0057.953] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="osknumpadbase.xml") returned -1 [0057.953] lstrcmpiA (lpString1="", lpString2="osknumpadbase.xml") returned -1 [0057.953] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\*.*") returned="*.*" [0057.954] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\" [0057.954] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned="" [0057.954] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\HOW TO DECRYPT FILES.txt" [0057.954] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\how to decrypt files.txt")) returned 0xffffffff [0057.954] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0057.954] WriteFile (in: hFile=0x1d4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.963] SetFileTime (hFile=0x1d4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.963] CloseHandle (hObject=0x1d4) returned 1 [0057.964] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\", lpString2="osknumpadbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" [0057.964] lstrlenA (lpString="*.zip") returned 5 [0057.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.rar") returned 0 [0057.964] lstrlenA (lpString="*.rar") returned 5 [0057.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.7z") returned 0 [0057.964] lstrlenA (lpString="*.7z") returned 4 [0057.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.tar") returned 0 [0057.964] lstrlenA (lpString="*.tar") returned 5 [0057.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.gzip") returned 0 [0057.964] lstrlenA (lpString="*.gzip") returned 6 [0057.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.jpg") returned 0 [0057.964] lstrlenA (lpString="*.jpg") returned 5 [0057.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.jpeg") returned 0 [0057.964] lstrlenA (lpString="*.jpeg") returned 6 [0057.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.psd") returned 0 [0057.964] lstrlenA (lpString="*.psd") returned 5 [0057.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.cdr") returned 0 [0057.964] lstrlenA (lpString="*.cdr") returned 5 [0057.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.dwg") returned 0 [0057.964] lstrlenA (lpString="*.dwg") returned 5 [0057.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.max") returned 0 [0057.964] lstrlenA (lpString="*.max") returned 5 [0057.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.bmp") returned 0 [0057.964] lstrlenA (lpString="*.bmp") returned 5 [0057.965] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.gif") returned 0 [0057.965] lstrlenA (lpString="*.gif") returned 5 [0057.965] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.png") returned 0 [0057.965] lstrlenA (lpString="*.png") returned 5 [0057.965] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.doc") returned 0 [0057.965] lstrlenA (lpString="*.doc") returned 5 [0057.965] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.docx") returned 0 [0057.965] lstrlenA (lpString="*.docx") returned 6 [0057.965] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.xls") returned 0 [0057.965] lstrlenA (lpString="*.xls") returned 5 [0057.965] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.xlsx") returned 0 [0057.965] lstrlenA (lpString="*.xlsx") returned 6 [0057.965] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.ppt") returned 0 [0057.965] lstrlenA (lpString="*.ppt") returned 5 [0057.965] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.pptx") returned 0 [0057.965] lstrlenA (lpString="*.pptx") returned 6 [0057.965] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.txt") returned 0 [0057.965] lstrlenA (lpString="*.txt") returned 5 [0057.965] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.pdf") returned 0 [0057.965] lstrlenA (lpString="*.pdf") returned 5 [0057.965] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.djvu") returned 0 [0057.965] lstrlenA (lpString="*.djvu") returned 6 [0057.965] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.htm") returned 0 [0057.965] lstrlenA (lpString="*.htm") returned 5 [0057.965] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.html") returned 0 [0057.965] lstrlenA (lpString="*.html") returned 6 [0057.965] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.mdb") returned 0 [0057.965] lstrlenA (lpString="*.mdb") returned 5 [0057.965] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.cer") returned 0 [0057.965] lstrlenA (lpString="*.cer") returned 5 [0057.965] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.p12") returned 0 [0057.966] lstrlenA (lpString="*.p12") returned 5 [0057.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.pfx") returned 0 [0057.966] lstrlenA (lpString="*.pfx") returned 5 [0057.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.kwm") returned 0 [0057.966] lstrlenA (lpString="*.kwm") returned 5 [0057.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.pwm") returned 0 [0057.966] lstrlenA (lpString="*.pwm") returned 5 [0057.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.1cd") returned 0 [0057.966] lstrlenA (lpString="*.1cd") returned 5 [0057.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.md") returned 0 [0057.966] lstrlenA (lpString="*.md") returned 4 [0057.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.mdf") returned 0 [0057.966] lstrlenA (lpString="*.mdf") returned 5 [0057.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.dbf") returned 0 [0057.966] lstrlenA (lpString="*.dbf") returned 5 [0057.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.odt") returned 0 [0057.966] lstrlenA (lpString="*.odt") returned 5 [0057.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.vob") returned 0 [0057.966] lstrlenA (lpString="*.vob") returned 5 [0057.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.ifo") returned 0 [0057.966] lstrlenA (lpString="*.ifo") returned 5 [0057.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.lnk") returned 0 [0057.966] lstrlenA (lpString="*.lnk") returned 5 [0057.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.torrent") returned 0 [0057.966] lstrlenA (lpString="*.torrent") returned 9 [0057.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.mov") returned 0 [0057.966] lstrlenA (lpString="*.mov") returned 5 [0057.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.m2v") returned 0 [0057.966] lstrlenA (lpString="*.m2v") returned 5 [0057.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.3gp") returned 0 [0057.966] lstrlenA (lpString="*.3gp") returned 5 [0057.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.mpeg") returned 0 [0057.967] lstrlenA (lpString="*.mpeg") returned 6 [0057.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.mpg") returned 0 [0057.967] lstrlenA (lpString="*.mpg") returned 5 [0057.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.flv") returned 0 [0057.967] lstrlenA (lpString="*.flv") returned 5 [0057.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.avi") returned 0 [0057.967] lstrlenA (lpString="*.avi") returned 5 [0057.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.mp4") returned 0 [0057.967] lstrlenA (lpString="*.mp4") returned 5 [0057.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.wmv") returned 0 [0057.967] lstrlenA (lpString="*.wmv") returned 5 [0057.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.divx") returned 0 [0057.967] lstrlenA (lpString="*.divx") returned 6 [0057.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.mkv") returned 0 [0057.967] lstrlenA (lpString="*.mkv") returned 5 [0057.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.mp3") returned 0 [0057.967] lstrlenA (lpString="*.mp3") returned 5 [0057.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.wav") returned 0 [0057.967] lstrlenA (lpString="*.wav") returned 5 [0057.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.flac") returned 0 [0057.967] lstrlenA (lpString="*.flac") returned 6 [0057.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.ape") returned 0 [0057.967] lstrlenA (lpString="*.ape") returned 5 [0057.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.wma") returned 0 [0057.967] lstrlenA (lpString="*.wma") returned 5 [0057.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.ac3") returned 0 [0057.967] lstrlenA (lpString="*.ac3") returned 5 [0057.967] FindNextFileA (in: hFindFile=0x6365f0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0057.967] FindClose (in: hFindFile=0x6365f0 | out: hFindFile=0x6365f0) returned 1 [0057.968] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0057.968] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.968] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="osknumpad.xml") returned -1 [0057.968] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="osknumpad.xml") returned -1 [0057.968] lstrcmpiA (lpString1="", lpString2="osknumpad.xml") returned -1 [0057.968] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0057.968] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" [0057.968] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="" [0057.968] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0057.968] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0057.968] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="osknumpad.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" [0057.968] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.zip") returned 0 [0057.968] lstrlenA (lpString="*.zip") returned 5 [0057.968] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.rar") returned 0 [0057.968] lstrlenA (lpString="*.rar") returned 5 [0057.968] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.7z") returned 0 [0057.968] lstrlenA (lpString="*.7z") returned 4 [0057.968] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.tar") returned 0 [0057.968] lstrlenA (lpString="*.tar") returned 5 [0057.968] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.gzip") returned 0 [0057.968] lstrlenA (lpString="*.gzip") returned 6 [0057.968] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.jpg") returned 0 [0057.968] lstrlenA (lpString="*.jpg") returned 5 [0057.968] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.jpeg") returned 0 [0057.968] lstrlenA (lpString="*.jpeg") returned 6 [0057.968] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.psd") returned 0 [0057.968] lstrlenA (lpString="*.psd") returned 5 [0057.968] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.cdr") returned 0 [0057.968] lstrlenA (lpString="*.cdr") returned 5 [0057.969] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.dwg") returned 0 [0057.969] lstrlenA (lpString="*.dwg") returned 5 [0057.969] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.max") returned 0 [0057.969] lstrlenA (lpString="*.max") returned 5 [0057.969] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.bmp") returned 0 [0057.969] lstrlenA (lpString="*.bmp") returned 5 [0057.969] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.gif") returned 0 [0057.969] lstrlenA (lpString="*.gif") returned 5 [0057.969] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.png") returned 0 [0057.969] lstrlenA (lpString="*.png") returned 5 [0057.969] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.doc") returned 0 [0057.969] lstrlenA (lpString="*.doc") returned 5 [0057.969] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.docx") returned 0 [0057.969] lstrlenA (lpString="*.docx") returned 6 [0057.969] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.xls") returned 0 [0057.969] lstrlenA (lpString="*.xls") returned 5 [0057.969] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.xlsx") returned 0 [0057.969] lstrlenA (lpString="*.xlsx") returned 6 [0057.969] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.ppt") returned 0 [0057.969] lstrlenA (lpString="*.ppt") returned 5 [0057.969] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.pptx") returned 0 [0057.969] lstrlenA (lpString="*.pptx") returned 6 [0057.969] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.txt") returned 0 [0057.969] lstrlenA (lpString="*.txt") returned 5 [0057.969] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.pdf") returned 0 [0057.969] lstrlenA (lpString="*.pdf") returned 5 [0057.969] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.djvu") returned 0 [0057.969] lstrlenA (lpString="*.djvu") returned 6 [0057.969] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.htm") returned 0 [0057.969] lstrlenA (lpString="*.htm") returned 5 [0057.969] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.html") returned 0 [0057.969] lstrlenA (lpString="*.html") returned 6 [0057.969] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.mdb") returned 0 [0057.969] lstrlenA (lpString="*.mdb") returned 5 [0057.970] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.cer") returned 0 [0057.970] lstrlenA (lpString="*.cer") returned 5 [0057.970] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.p12") returned 0 [0057.970] lstrlenA (lpString="*.p12") returned 5 [0057.970] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.pfx") returned 0 [0057.970] lstrlenA (lpString="*.pfx") returned 5 [0057.970] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.kwm") returned 0 [0057.970] lstrlenA (lpString="*.kwm") returned 5 [0057.970] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.pwm") returned 0 [0057.970] lstrlenA (lpString="*.pwm") returned 5 [0057.970] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.1cd") returned 0 [0057.970] lstrlenA (lpString="*.1cd") returned 5 [0057.970] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.md") returned 0 [0057.970] lstrlenA (lpString="*.md") returned 4 [0057.970] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.mdf") returned 0 [0057.970] lstrlenA (lpString="*.mdf") returned 5 [0057.970] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.dbf") returned 0 [0057.970] lstrlenA (lpString="*.dbf") returned 5 [0057.970] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.odt") returned 0 [0057.970] lstrlenA (lpString="*.odt") returned 5 [0057.970] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.vob") returned 0 [0057.970] lstrlenA (lpString="*.vob") returned 5 [0057.970] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.ifo") returned 0 [0057.970] lstrlenA (lpString="*.ifo") returned 5 [0057.970] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.lnk") returned 0 [0057.970] lstrlenA (lpString="*.lnk") returned 5 [0057.970] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.torrent") returned 0 [0057.971] lstrlenA (lpString="*.torrent") returned 9 [0057.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.mov") returned 0 [0057.971] lstrlenA (lpString="*.mov") returned 5 [0057.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.m2v") returned 0 [0057.971] lstrlenA (lpString="*.m2v") returned 5 [0057.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.3gp") returned 0 [0057.971] lstrlenA (lpString="*.3gp") returned 5 [0057.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.mpeg") returned 0 [0057.971] lstrlenA (lpString="*.mpeg") returned 6 [0057.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.mpg") returned 0 [0057.971] lstrlenA (lpString="*.mpg") returned 5 [0057.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.flv") returned 0 [0057.971] lstrlenA (lpString="*.flv") returned 5 [0057.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.avi") returned 0 [0057.971] lstrlenA (lpString="*.avi") returned 5 [0057.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.mp4") returned 0 [0057.971] lstrlenA (lpString="*.mp4") returned 5 [0057.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.wmv") returned 0 [0057.971] lstrlenA (lpString="*.wmv") returned 5 [0057.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.divx") returned 0 [0057.971] lstrlenA (lpString="*.divx") returned 6 [0057.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.mkv") returned 0 [0057.971] lstrlenA (lpString="*.mkv") returned 5 [0057.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.mp3") returned 0 [0057.971] lstrlenA (lpString="*.mp3") returned 5 [0057.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.wav") returned 0 [0057.972] lstrlenA (lpString="*.wav") returned 5 [0057.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.flac") returned 0 [0057.972] lstrlenA (lpString="*.flac") returned 6 [0057.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.ape") returned 0 [0057.972] lstrlenA (lpString="*.ape") returned 5 [0057.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.wma") returned 0 [0057.972] lstrlenA (lpString="*.wma") returned 5 [0057.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.ac3") returned 0 [0057.972] lstrlenA (lpString="*.ac3") returned 5 [0057.972] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="oskpred", cAlternateFileName="")) returned 1 [0057.972] lstrcmpA (lpString1=".", lpString2="oskpred") returned -1 [0057.972] lstrcmpA (lpString1="..", lpString2="oskpred") returned -1 [0057.972] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned="osknumpad.xml" [0057.972] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="oskpred" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred" [0057.972] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred") returned 72 [0057.972] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\*.*"), lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName=".", cAlternateFileName="")) returned 0x6367f0 [0057.972] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.972] FindNextFileA (in: hFindFile=0x6367f0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName="..", cAlternateFileName="")) returned 1 [0057.972] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.972] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.972] FindNextFileA (in: hFindFile=0x6367f0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0057.973] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0057.973] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oskpredbase.xml") returned -1 [0057.973] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oskpredbase.xml") returned -1 [0057.973] lstrcmpiA (lpString1="", lpString2="oskpredbase.xml") returned -1 [0057.973] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\*.*") returned="*.*" [0057.973] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\" [0057.973] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned="" [0057.973] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\HOW TO DECRYPT FILES.txt" [0057.973] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\how to decrypt files.txt")) returned 0xffffffff [0057.973] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0057.973] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.973] WriteFile (in: hFile=0x1d4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.974] SetFileTime (hFile=0x1d4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.975] CloseHandle (hObject=0x1d4) returned 1 [0057.975] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\", lpString2="oskpredbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" [0057.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.zip") returned 0 [0057.975] lstrlenA (lpString="*.zip") returned 5 [0057.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.rar") returned 0 [0057.975] lstrlenA (lpString="*.rar") returned 5 [0057.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.7z") returned 0 [0057.975] lstrlenA (lpString="*.7z") returned 4 [0057.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.tar") returned 0 [0057.975] lstrlenA (lpString="*.tar") returned 5 [0057.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.gzip") returned 0 [0057.975] lstrlenA (lpString="*.gzip") returned 6 [0057.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.jpg") returned 0 [0057.975] lstrlenA (lpString="*.jpg") returned 5 [0057.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.jpeg") returned 0 [0057.975] lstrlenA (lpString="*.jpeg") returned 6 [0057.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.psd") returned 0 [0057.975] lstrlenA (lpString="*.psd") returned 5 [0057.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.cdr") returned 0 [0057.975] lstrlenA (lpString="*.cdr") returned 5 [0057.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.dwg") returned 0 [0057.975] lstrlenA (lpString="*.dwg") returned 5 [0057.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.max") returned 0 [0057.976] lstrlenA (lpString="*.max") returned 5 [0057.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.bmp") returned 0 [0057.976] lstrlenA (lpString="*.bmp") returned 5 [0057.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.gif") returned 0 [0057.976] lstrlenA (lpString="*.gif") returned 5 [0057.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.png") returned 0 [0057.976] lstrlenA (lpString="*.png") returned 5 [0057.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.doc") returned 0 [0057.976] lstrlenA (lpString="*.doc") returned 5 [0057.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.docx") returned 0 [0057.976] lstrlenA (lpString="*.docx") returned 6 [0057.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.xls") returned 0 [0057.976] lstrlenA (lpString="*.xls") returned 5 [0057.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.xlsx") returned 0 [0057.976] lstrlenA (lpString="*.xlsx") returned 6 [0057.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.ppt") returned 0 [0057.976] lstrlenA (lpString="*.ppt") returned 5 [0057.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.pptx") returned 0 [0057.976] lstrlenA (lpString="*.pptx") returned 6 [0057.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.txt") returned 0 [0057.976] lstrlenA (lpString="*.txt") returned 5 [0057.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.pdf") returned 0 [0057.976] lstrlenA (lpString="*.pdf") returned 5 [0057.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.djvu") returned 0 [0057.976] lstrlenA (lpString="*.djvu") returned 6 [0057.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.htm") returned 0 [0057.976] lstrlenA (lpString="*.htm") returned 5 [0057.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.html") returned 0 [0057.976] lstrlenA (lpString="*.html") returned 6 [0057.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.mdb") returned 0 [0057.976] lstrlenA (lpString="*.mdb") returned 5 [0057.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.cer") returned 0 [0057.977] lstrlenA (lpString="*.cer") returned 5 [0057.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.p12") returned 0 [0057.977] lstrlenA (lpString="*.p12") returned 5 [0057.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.pfx") returned 0 [0057.977] lstrlenA (lpString="*.pfx") returned 5 [0057.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.kwm") returned 0 [0057.977] lstrlenA (lpString="*.kwm") returned 5 [0057.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.pwm") returned 0 [0057.977] lstrlenA (lpString="*.pwm") returned 5 [0057.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.1cd") returned 0 [0057.977] lstrlenA (lpString="*.1cd") returned 5 [0057.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.md") returned 0 [0057.977] lstrlenA (lpString="*.md") returned 4 [0057.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.mdf") returned 0 [0057.977] lstrlenA (lpString="*.mdf") returned 5 [0057.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.dbf") returned 0 [0057.977] lstrlenA (lpString="*.dbf") returned 5 [0057.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.odt") returned 0 [0057.977] lstrlenA (lpString="*.odt") returned 5 [0057.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.vob") returned 0 [0057.977] lstrlenA (lpString="*.vob") returned 5 [0057.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.ifo") returned 0 [0057.977] lstrlenA (lpString="*.ifo") returned 5 [0057.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.lnk") returned 0 [0057.977] lstrlenA (lpString="*.lnk") returned 5 [0057.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.torrent") returned 0 [0057.977] lstrlenA (lpString="*.torrent") returned 9 [0057.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.mov") returned 0 [0057.977] lstrlenA (lpString="*.mov") returned 5 [0057.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.m2v") returned 0 [0057.977] lstrlenA (lpString="*.m2v") returned 5 [0057.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.3gp") returned 0 [0057.978] lstrlenA (lpString="*.3gp") returned 5 [0057.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.mpeg") returned 0 [0057.978] lstrlenA (lpString="*.mpeg") returned 6 [0057.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.mpg") returned 0 [0057.978] lstrlenA (lpString="*.mpg") returned 5 [0057.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.flv") returned 0 [0057.978] lstrlenA (lpString="*.flv") returned 5 [0057.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.avi") returned 0 [0057.978] lstrlenA (lpString="*.avi") returned 5 [0057.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.mp4") returned 0 [0057.978] lstrlenA (lpString="*.mp4") returned 5 [0057.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.wmv") returned 0 [0057.978] lstrlenA (lpString="*.wmv") returned 5 [0057.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.divx") returned 0 [0057.978] lstrlenA (lpString="*.divx") returned 6 [0057.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.mkv") returned 0 [0057.978] lstrlenA (lpString="*.mkv") returned 5 [0057.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.mp3") returned 0 [0057.978] lstrlenA (lpString="*.mp3") returned 5 [0057.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.wav") returned 0 [0057.978] lstrlenA (lpString="*.wav") returned 5 [0057.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.flac") returned 0 [0057.978] lstrlenA (lpString="*.flac") returned 6 [0057.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.ape") returned 0 [0057.978] lstrlenA (lpString="*.ape") returned 5 [0057.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.wma") returned 0 [0057.978] lstrlenA (lpString="*.wma") returned 5 [0057.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.ac3") returned 0 [0057.978] lstrlenA (lpString="*.ac3") returned 5 [0057.978] FindNextFileA (in: hFindFile=0x6367f0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0057.978] FindClose (in: hFindFile=0x6367f0 | out: hFindFile=0x6367f0) returned 1 [0057.979] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0057.979] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.979] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oskpred.xml") returned -1 [0057.979] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oskpred.xml") returned -1 [0057.979] lstrcmpiA (lpString1="", lpString2="oskpred.xml") returned -1 [0057.979] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0057.979] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" [0057.979] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="" [0057.979] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0057.979] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0057.979] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="oskpred.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" [0057.979] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.zip") returned 0 [0057.979] lstrlenA (lpString="*.zip") returned 5 [0057.979] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.rar") returned 0 [0057.979] lstrlenA (lpString="*.rar") returned 5 [0057.979] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.7z") returned 0 [0057.979] lstrlenA (lpString="*.7z") returned 4 [0057.979] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.tar") returned 0 [0057.979] lstrlenA (lpString="*.tar") returned 5 [0057.979] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.gzip") returned 0 [0057.979] lstrlenA (lpString="*.gzip") returned 6 [0057.979] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.jpg") returned 0 [0057.979] lstrlenA (lpString="*.jpg") returned 5 [0057.979] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.jpeg") returned 0 [0057.979] lstrlenA (lpString="*.jpeg") returned 6 [0057.979] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.psd") returned 0 [0057.979] lstrlenA (lpString="*.psd") returned 5 [0057.979] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.cdr") returned 0 [0057.979] lstrlenA (lpString="*.cdr") returned 5 [0057.980] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.dwg") returned 0 [0057.980] lstrlenA (lpString="*.dwg") returned 5 [0057.980] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.max") returned 0 [0057.980] lstrlenA (lpString="*.max") returned 5 [0057.980] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.bmp") returned 0 [0057.980] lstrlenA (lpString="*.bmp") returned 5 [0057.980] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.gif") returned 0 [0057.980] lstrlenA (lpString="*.gif") returned 5 [0057.980] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.png") returned 0 [0057.980] lstrlenA (lpString="*.png") returned 5 [0057.980] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.doc") returned 0 [0057.980] lstrlenA (lpString="*.doc") returned 5 [0057.980] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.docx") returned 0 [0057.980] lstrlenA (lpString="*.docx") returned 6 [0057.980] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.xls") returned 0 [0057.980] lstrlenA (lpString="*.xls") returned 5 [0057.980] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.xlsx") returned 0 [0057.980] lstrlenA (lpString="*.xlsx") returned 6 [0057.980] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.ppt") returned 0 [0057.980] lstrlenA (lpString="*.ppt") returned 5 [0057.980] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.pptx") returned 0 [0057.980] lstrlenA (lpString="*.pptx") returned 6 [0057.980] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.txt") returned 0 [0057.980] lstrlenA (lpString="*.txt") returned 5 [0057.980] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.pdf") returned 0 [0057.980] lstrlenA (lpString="*.pdf") returned 5 [0057.980] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.djvu") returned 0 [0057.980] lstrlenA (lpString="*.djvu") returned 6 [0057.980] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.htm") returned 0 [0057.980] lstrlenA (lpString="*.htm") returned 5 [0057.980] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.html") returned 0 [0057.980] lstrlenA (lpString="*.html") returned 6 [0057.980] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.mdb") returned 0 [0057.980] lstrlenA (lpString="*.mdb") returned 5 [0057.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.cer") returned 0 [0057.981] lstrlenA (lpString="*.cer") returned 5 [0057.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.p12") returned 0 [0057.981] lstrlenA (lpString="*.p12") returned 5 [0057.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.pfx") returned 0 [0057.981] lstrlenA (lpString="*.pfx") returned 5 [0057.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.kwm") returned 0 [0057.981] lstrlenA (lpString="*.kwm") returned 5 [0057.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.pwm") returned 0 [0057.981] lstrlenA (lpString="*.pwm") returned 5 [0057.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.1cd") returned 0 [0057.981] lstrlenA (lpString="*.1cd") returned 5 [0057.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.md") returned 0 [0057.981] lstrlenA (lpString="*.md") returned 4 [0057.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.mdf") returned 0 [0057.981] lstrlenA (lpString="*.mdf") returned 5 [0057.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.dbf") returned 0 [0057.981] lstrlenA (lpString="*.dbf") returned 5 [0057.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.odt") returned 0 [0057.981] lstrlenA (lpString="*.odt") returned 5 [0057.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.vob") returned 0 [0057.981] lstrlenA (lpString="*.vob") returned 5 [0057.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.ifo") returned 0 [0057.981] lstrlenA (lpString="*.ifo") returned 5 [0057.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.lnk") returned 0 [0057.981] lstrlenA (lpString="*.lnk") returned 5 [0057.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.torrent") returned 0 [0057.981] lstrlenA (lpString="*.torrent") returned 9 [0057.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.mov") returned 0 [0057.981] lstrlenA (lpString="*.mov") returned 5 [0057.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.m2v") returned 0 [0057.982] lstrlenA (lpString="*.m2v") returned 5 [0057.982] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.3gp") returned 0 [0057.982] lstrlenA (lpString="*.3gp") returned 5 [0057.982] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.mpeg") returned 0 [0057.982] lstrlenA (lpString="*.mpeg") returned 6 [0057.982] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.mpg") returned 0 [0057.982] lstrlenA (lpString="*.mpg") returned 5 [0057.982] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.flv") returned 0 [0057.982] lstrlenA (lpString="*.flv") returned 5 [0057.982] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.avi") returned 0 [0057.982] lstrlenA (lpString="*.avi") returned 5 [0057.982] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.mp4") returned 0 [0057.982] lstrlenA (lpString="*.mp4") returned 5 [0057.982] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.wmv") returned 0 [0057.982] lstrlenA (lpString="*.wmv") returned 5 [0057.982] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.divx") returned 0 [0057.982] lstrlenA (lpString="*.divx") returned 6 [0057.982] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.mkv") returned 0 [0057.982] lstrlenA (lpString="*.mkv") returned 5 [0057.982] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.mp3") returned 0 [0057.982] lstrlenA (lpString="*.mp3") returned 5 [0057.982] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.wav") returned 0 [0057.982] lstrlenA (lpString="*.wav") returned 5 [0057.982] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.flac") returned 0 [0057.982] lstrlenA (lpString="*.flac") returned 6 [0057.982] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.ape") returned 0 [0057.982] lstrlenA (lpString="*.ape") returned 5 [0057.982] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.wma") returned 0 [0057.982] lstrlenA (lpString="*.wma") returned 5 [0057.982] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.ac3") returned 0 [0057.982] lstrlenA (lpString="*.ac3") returned 5 [0057.982] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="symbols", cAlternateFileName="")) returned 1 [0057.982] lstrcmpA (lpString1=".", lpString2="symbols") returned -1 [0057.982] lstrcmpA (lpString1="..", lpString2="symbols") returned -1 [0057.983] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned="oskpred.xml" [0057.983] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="symbols" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols" [0057.983] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols") returned 72 [0057.983] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\*.*"), lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName=".", cAlternateFileName="")) returned 0x6367f0 [0057.983] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.983] FindNextFileA (in: hFindFile=0x6367f0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName="..", cAlternateFileName="")) returned 1 [0057.983] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.983] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.983] FindNextFileA (in: hFindFile=0x6367f0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2b6, dwReserved0=0xc8, dwReserved1=0x6202f8, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0057.983] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0057.983] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ea-sym.xml") returned -1 [0057.983] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ea-sym.xml") returned 1 [0057.983] lstrcmpiA (lpString1="", lpString2="ea-sym.xml") returned -1 [0057.983] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\*.*") returned="*.*" [0057.983] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\" [0057.983] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned="" [0057.983] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt" [0057.983] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\how to decrypt files.txt")) returned 0xffffffff [0057.983] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0057.984] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0057.984] WriteFile (in: hFile=0x1d4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.985] SetFileTime (hFile=0x1d4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.985] CloseHandle (hObject=0x1d4) returned 1 [0057.988] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\", lpString2="ea-sym.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" [0057.988] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.zip") returned 0 [0057.988] lstrlenA (lpString="*.zip") returned 5 [0057.988] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.rar") returned 0 [0057.988] lstrlenA (lpString="*.rar") returned 5 [0057.988] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.7z") returned 0 [0057.988] lstrlenA (lpString="*.7z") returned 4 [0057.988] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.tar") returned 0 [0057.988] lstrlenA (lpString="*.tar") returned 5 [0057.988] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.gzip") returned 0 [0057.988] lstrlenA (lpString="*.gzip") returned 6 [0057.988] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.jpg") returned 0 [0057.988] lstrlenA (lpString="*.jpg") returned 5 [0057.988] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.jpeg") returned 0 [0057.988] lstrlenA (lpString="*.jpeg") returned 6 [0057.988] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.psd") returned 0 [0057.988] lstrlenA (lpString="*.psd") returned 5 [0057.988] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.cdr") returned 0 [0057.988] lstrlenA (lpString="*.cdr") returned 5 [0057.988] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.dwg") returned 0 [0057.988] lstrlenA (lpString="*.dwg") returned 5 [0057.988] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.max") returned 0 [0057.988] lstrlenA (lpString="*.max") returned 5 [0057.988] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.bmp") returned 0 [0057.988] lstrlenA (lpString="*.bmp") returned 5 [0057.988] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.gif") returned 0 [0057.989] lstrlenA (lpString="*.gif") returned 5 [0057.989] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.png") returned 0 [0057.989] lstrlenA (lpString="*.png") returned 5 [0057.989] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.doc") returned 0 [0057.989] lstrlenA (lpString="*.doc") returned 5 [0057.989] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.docx") returned 0 [0057.989] lstrlenA (lpString="*.docx") returned 6 [0057.989] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.xls") returned 0 [0057.989] lstrlenA (lpString="*.xls") returned 5 [0057.989] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.xlsx") returned 0 [0057.989] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.ppt") returned 0 [0057.989] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.pptx") returned 0 [0057.989] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.txt") returned 0 [0057.989] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.pdf") returned 0 [0057.989] FindNextFileA (in: hFindFile=0x6367f0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0057.989] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0057.989] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ja-jp-sym.xml") returned -1 [0057.989] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ja-jp-sym.xml") returned -1 [0057.989] lstrcmpiA (lpString1="", lpString2="ja-jp-sym.xml") returned -1 [0057.989] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned="ea-sym.xml" [0057.989] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\" [0057.989] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned="" [0057.990] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt" [0057.990] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\how to decrypt files.txt")) returned 0x20 [0057.990] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\", lpString2="ja-jp-sym.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" [0057.990] FindNextFileA (in: hFindFile=0x6367f0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x520043, dwReserved1=0x500059, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0057.990] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0057.990] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="symbase.xml") returned -1 [0057.990] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="symbase.xml") returned -1 [0057.990] lstrcmpiA (lpString1="", lpString2="symbase.xml") returned -1 [0057.990] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned="ja-jp-sym.xml" [0057.990] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\" [0057.990] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned="" [0057.990] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt" [0057.990] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\how to decrypt files.txt")) returned 0x20 [0057.990] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\", lpString2="symbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" [0057.990] FindNextFileA (in: hFindFile=0x6367f0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x520043, dwReserved1=0x500059, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0057.990] FindClose (in: hFindFile=0x6367f0 | out: hFindFile=0x6367f0) returned 1 [0057.990] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0057.990] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.990] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="symbols.xml") returned -1 [0057.990] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="symbols.xml") returned -1 [0057.991] lstrcmpiA (lpString1="", lpString2="symbols.xml") returned -1 [0057.991] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0057.991] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" [0057.991] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="" [0057.991] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0057.991] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0057.991] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="symbols.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" [0057.991] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="symbols.xml", cAlternateFileName="")) returned 0 [0057.991] FindClose (in: hFindFile=0x6369f0 | out: hFindFile=0x6369f0) returned 1 [0057.991] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="he-IL", cAlternateFileName="")) returned 1 [0057.991] lstrcmpA (lpString1=".", lpString2="he-IL") returned -1 [0057.991] lstrcmpA (lpString1="..", lpString2="he-IL") returned -1 [0057.991] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0057.991] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="he-IL" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL" [0057.991] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName=".", cAlternateFileName="")) returned 0x636970 [0057.991] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.991] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="..", cAlternateFileName="")) returned 1 [0057.992] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.992] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.992] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0057.992] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0057.992] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0057.992] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0057.992] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0057.992] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\*.*") returned="*.*" [0057.992] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\" [0057.992] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\") returned="" [0057.992] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\HOW TO DECRYPT FILES.txt" [0057.992] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\how to decrypt files.txt")) returned 0xffffffff [0057.992] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.992] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0057.993] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.993] CloseHandle (hObject=0x1d0) returned 1 [0057.993] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" [0057.994] lstrlenA (lpString="*.zip") returned 5 [0057.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0057.994] lstrlenA (lpString="*.rar") returned 5 [0057.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0057.994] lstrlenA (lpString="*.7z") returned 4 [0057.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0057.994] lstrlenA (lpString="*.tar") returned 5 [0057.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0057.994] lstrlenA (lpString="*.gzip") returned 6 [0057.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0057.994] lstrlenA (lpString="*.jpg") returned 5 [0057.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0057.994] lstrlenA (lpString="*.jpeg") returned 6 [0057.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0057.994] lstrlenA (lpString="*.psd") returned 5 [0057.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0057.994] lstrlenA (lpString="*.cdr") returned 5 [0057.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0057.994] lstrlenA (lpString="*.dwg") returned 5 [0057.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0057.994] lstrlenA (lpString="*.max") returned 5 [0057.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0057.994] lstrlenA (lpString="*.bmp") returned 5 [0057.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0057.994] lstrlenA (lpString="*.gif") returned 5 [0057.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0057.994] lstrlenA (lpString="*.png") returned 5 [0057.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0057.994] lstrlenA (lpString="*.doc") returned 5 [0057.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0057.994] lstrlenA (lpString="*.docx") returned 6 [0057.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0057.995] lstrlenA (lpString="*.xls") returned 5 [0057.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0057.995] lstrlenA (lpString="*.xlsx") returned 6 [0057.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0057.995] lstrlenA (lpString="*.ppt") returned 5 [0057.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0057.995] lstrlenA (lpString="*.pptx") returned 6 [0057.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0057.995] lstrlenA (lpString="*.txt") returned 5 [0057.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0057.995] lstrlenA (lpString="*.pdf") returned 5 [0057.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0057.995] lstrlenA (lpString="*.djvu") returned 6 [0057.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0057.995] lstrlenA (lpString="*.htm") returned 5 [0057.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0057.995] lstrlenA (lpString="*.html") returned 6 [0057.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0057.995] lstrlenA (lpString="*.mdb") returned 5 [0057.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0057.995] lstrlenA (lpString="*.cer") returned 5 [0057.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0057.995] lstrlenA (lpString="*.p12") returned 5 [0057.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0057.995] lstrlenA (lpString="*.pfx") returned 5 [0057.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0057.995] lstrlenA (lpString="*.kwm") returned 5 [0057.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0057.995] lstrlenA (lpString="*.pwm") returned 5 [0057.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0057.995] lstrlenA (lpString="*.1cd") returned 5 [0057.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0057.995] lstrlenA (lpString="*.md") returned 4 [0057.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0057.996] lstrlenA (lpString="*.mdf") returned 5 [0057.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0057.996] lstrlenA (lpString="*.dbf") returned 5 [0057.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0057.996] lstrlenA (lpString="*.odt") returned 5 [0057.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0057.996] lstrlenA (lpString="*.vob") returned 5 [0057.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0057.996] lstrlenA (lpString="*.ifo") returned 5 [0057.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0057.996] lstrlenA (lpString="*.lnk") returned 5 [0057.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0057.996] lstrlenA (lpString="*.torrent") returned 9 [0057.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0057.996] lstrlenA (lpString="*.mov") returned 5 [0057.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0057.996] lstrlenA (lpString="*.m2v") returned 5 [0057.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0057.996] lstrlenA (lpString="*.3gp") returned 5 [0057.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0057.996] lstrlenA (lpString="*.mpeg") returned 6 [0057.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0057.996] lstrlenA (lpString="*.mpg") returned 5 [0057.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0057.996] lstrlenA (lpString="*.flv") returned 5 [0057.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0057.996] lstrlenA (lpString="*.avi") returned 5 [0057.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0057.996] lstrlenA (lpString="*.mp4") returned 5 [0057.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0057.997] lstrlenA (lpString="*.wmv") returned 5 [0057.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0057.997] lstrlenA (lpString="*.divx") returned 6 [0057.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0057.997] lstrlenA (lpString="*.mkv") returned 5 [0057.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0057.997] lstrlenA (lpString="*.mp3") returned 5 [0057.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0057.997] lstrlenA (lpString="*.wav") returned 5 [0057.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0057.997] lstrlenA (lpString="*.flac") returned 6 [0057.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0057.997] lstrlenA (lpString="*.ape") returned 5 [0057.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0057.997] lstrlenA (lpString="*.wma") returned 5 [0057.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0057.997] lstrlenA (lpString="*.ac3") returned 5 [0057.997] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0057.997] FindClose (in: hFindFile=0x636970 | out: hFindFile=0x636970) returned 1 [0057.997] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0057.997] lstrcmpA (lpString1=".", lpString2="hr-HR") returned -1 [0057.997] lstrcmpA (lpString1="..", lpString2="hr-HR") returned -1 [0057.997] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0057.997] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="hr-HR" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR" [0057.997] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR") returned 56 [0057.997] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName=".", cAlternateFileName="")) returned 0x636730 [0058.000] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.000] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="..", cAlternateFileName="")) returned 1 [0058.000] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.000] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.000] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.000] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.000] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.000] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.000] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.000] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\*.*") returned="*.*" [0058.000] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\" [0058.000] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\") returned="" [0058.000] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\HOW TO DECRYPT FILES.txt" [0058.000] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\how to decrypt files.txt")) returned 0xffffffff [0058.000] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.000] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0058.001] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0058.002] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.002] CloseHandle (hObject=0x1d0) returned 1 [0058.002] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" [0058.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0058.002] lstrlenA (lpString="*.zip") returned 5 [0058.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0058.002] lstrlenA (lpString="*.rar") returned 5 [0058.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0058.002] lstrlenA (lpString="*.7z") returned 4 [0058.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0058.003] lstrlenA (lpString="*.tar") returned 5 [0058.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0058.003] lstrlenA (lpString="*.gzip") returned 6 [0058.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0058.003] lstrlenA (lpString="*.jpg") returned 5 [0058.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0058.003] lstrlenA (lpString="*.jpeg") returned 6 [0058.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0058.003] lstrlenA (lpString="*.psd") returned 5 [0058.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0058.003] lstrlenA (lpString="*.cdr") returned 5 [0058.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0058.003] lstrlenA (lpString="*.dwg") returned 5 [0058.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0058.003] lstrlenA (lpString="*.max") returned 5 [0058.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0058.003] lstrlenA (lpString="*.bmp") returned 5 [0058.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0058.003] lstrlenA (lpString="*.gif") returned 5 [0058.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0058.003] lstrlenA (lpString="*.png") returned 5 [0058.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0058.003] lstrlenA (lpString="*.doc") returned 5 [0058.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0058.003] lstrlenA (lpString="*.docx") returned 6 [0058.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0058.003] lstrlenA (lpString="*.xls") returned 5 [0058.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0058.003] lstrlenA (lpString="*.xlsx") returned 6 [0058.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0058.003] lstrlenA (lpString="*.ppt") returned 5 [0058.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0058.004] lstrlenA (lpString="*.pptx") returned 6 [0058.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0058.004] lstrlenA (lpString="*.txt") returned 5 [0058.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0058.004] lstrlenA (lpString="*.pdf") returned 5 [0058.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0058.004] lstrlenA (lpString="*.djvu") returned 6 [0058.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0058.004] lstrlenA (lpString="*.htm") returned 5 [0058.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0058.004] lstrlenA (lpString="*.html") returned 6 [0058.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0058.004] lstrlenA (lpString="*.mdb") returned 5 [0058.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0058.004] lstrlenA (lpString="*.cer") returned 5 [0058.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0058.004] lstrlenA (lpString="*.p12") returned 5 [0058.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0058.004] lstrlenA (lpString="*.pfx") returned 5 [0058.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0058.004] lstrlenA (lpString="*.kwm") returned 5 [0058.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0058.004] lstrlenA (lpString="*.pwm") returned 5 [0058.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0058.004] lstrlenA (lpString="*.1cd") returned 5 [0058.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0058.004] lstrlenA (lpString="*.md") returned 4 [0058.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0058.004] lstrlenA (lpString="*.mdf") returned 5 [0058.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0058.004] lstrlenA (lpString="*.dbf") returned 5 [0058.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0058.004] lstrlenA (lpString="*.odt") returned 5 [0058.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0058.005] lstrlenA (lpString="*.vob") returned 5 [0058.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0058.005] lstrlenA (lpString="*.ifo") returned 5 [0058.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0058.005] lstrlenA (lpString="*.lnk") returned 5 [0058.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0058.005] lstrlenA (lpString="*.torrent") returned 9 [0058.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0058.005] lstrlenA (lpString="*.mov") returned 5 [0058.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0058.005] lstrlenA (lpString="*.m2v") returned 5 [0058.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0058.005] lstrlenA (lpString="*.3gp") returned 5 [0058.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0058.005] lstrlenA (lpString="*.mpeg") returned 6 [0058.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0058.005] lstrlenA (lpString="*.mpg") returned 5 [0058.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0058.005] lstrlenA (lpString="*.flv") returned 5 [0058.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0058.005] lstrlenA (lpString="*.avi") returned 5 [0058.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0058.005] lstrlenA (lpString="*.mp4") returned 5 [0058.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0058.005] lstrlenA (lpString="*.wmv") returned 5 [0058.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0058.005] lstrlenA (lpString="*.divx") returned 6 [0058.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0058.005] lstrlenA (lpString="*.mkv") returned 5 [0058.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0058.006] lstrlenA (lpString="*.mp3") returned 5 [0058.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0058.006] lstrlenA (lpString="*.wav") returned 5 [0058.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0058.006] lstrlenA (lpString="*.flac") returned 6 [0058.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0058.006] lstrlenA (lpString="*.ape") returned 5 [0058.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0058.006] lstrlenA (lpString="*.wma") returned 5 [0058.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0058.006] lstrlenA (lpString="*.ac3") returned 5 [0058.006] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.006] FindClose (in: hFindFile=0x636730 | out: hFindFile=0x636730) returned 1 [0058.006] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0058.006] lstrcmpA (lpString1=".", lpString2="hu-HU") returned -1 [0058.006] lstrcmpA (lpString1="..", lpString2="hu-HU") returned -1 [0058.006] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0058.006] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="hu-HU" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU" [0058.006] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU") returned 56 [0058.006] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName=".", cAlternateFileName="")) returned 0x636730 [0058.007] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.007] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="..", cAlternateFileName="")) returned 1 [0058.007] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.007] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.007] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.007] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.007] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.007] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.007] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.007] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\*.*") returned="*.*" [0058.007] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\" [0058.007] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\") returned="" [0058.007] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\HOW TO DECRYPT FILES.txt" [0058.007] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\how to decrypt files.txt")) returned 0xffffffff [0058.007] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.007] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0058.007] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0058.008] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.008] CloseHandle (hObject=0x1d0) returned 1 [0058.009] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" [0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0058.009] lstrlenA (lpString="*.zip") returned 5 [0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0058.009] lstrlenA (lpString="*.rar") returned 5 [0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0058.009] lstrlenA (lpString="*.7z") returned 4 [0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0058.009] lstrlenA (lpString="*.tar") returned 5 [0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0058.009] lstrlenA (lpString="*.gzip") returned 6 [0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0058.009] lstrlenA (lpString="*.jpg") returned 5 [0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0058.009] lstrlenA (lpString="*.jpeg") returned 6 [0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0058.009] lstrlenA (lpString="*.psd") returned 5 [0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0058.009] lstrlenA (lpString="*.cdr") returned 5 [0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0058.009] lstrlenA (lpString="*.dwg") returned 5 [0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0058.009] lstrlenA (lpString="*.max") returned 5 [0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0058.009] lstrlenA (lpString="*.bmp") returned 5 [0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0058.009] lstrlenA (lpString="*.gif") returned 5 [0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0058.010] lstrlenA (lpString="*.png") returned 5 [0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0058.010] lstrlenA (lpString="*.doc") returned 5 [0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0058.010] lstrlenA (lpString="*.docx") returned 6 [0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0058.010] lstrlenA (lpString="*.xls") returned 5 [0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0058.010] lstrlenA (lpString="*.xlsx") returned 6 [0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0058.010] lstrlenA (lpString="*.ppt") returned 5 [0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0058.010] lstrlenA (lpString="*.pptx") returned 6 [0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0058.010] lstrlenA (lpString="*.txt") returned 5 [0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0058.010] lstrlenA (lpString="*.pdf") returned 5 [0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0058.010] lstrlenA (lpString="*.djvu") returned 6 [0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0058.010] lstrlenA (lpString="*.htm") returned 5 [0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0058.010] lstrlenA (lpString="*.html") returned 6 [0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0058.010] lstrlenA (lpString="*.mdb") returned 5 [0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0058.010] lstrlenA (lpString="*.cer") returned 5 [0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0058.010] lstrlenA (lpString="*.p12") returned 5 [0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0058.010] lstrlenA (lpString="*.pfx") returned 5 [0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0058.011] lstrlenA (lpString="*.kwm") returned 5 [0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0058.011] lstrlenA (lpString="*.pwm") returned 5 [0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0058.011] lstrlenA (lpString="*.1cd") returned 5 [0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0058.011] lstrlenA (lpString="*.md") returned 4 [0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0058.011] lstrlenA (lpString="*.mdf") returned 5 [0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0058.011] lstrlenA (lpString="*.dbf") returned 5 [0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0058.011] lstrlenA (lpString="*.odt") returned 5 [0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0058.011] lstrlenA (lpString="*.vob") returned 5 [0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0058.011] lstrlenA (lpString="*.ifo") returned 5 [0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0058.011] lstrlenA (lpString="*.lnk") returned 5 [0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0058.011] lstrlenA (lpString="*.torrent") returned 9 [0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0058.011] lstrlenA (lpString="*.mov") returned 5 [0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0058.011] lstrlenA (lpString="*.m2v") returned 5 [0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0058.011] lstrlenA (lpString="*.3gp") returned 5 [0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0058.011] lstrlenA (lpString="*.mpeg") returned 6 [0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0058.011] lstrlenA (lpString="*.mpg") returned 5 [0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0058.012] lstrlenA (lpString="*.flv") returned 5 [0058.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0058.012] lstrlenA (lpString="*.avi") returned 5 [0058.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0058.012] lstrlenA (lpString="*.mp4") returned 5 [0058.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0058.012] lstrlenA (lpString="*.wmv") returned 5 [0058.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0058.012] lstrlenA (lpString="*.divx") returned 6 [0058.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0058.012] lstrlenA (lpString="*.mkv") returned 5 [0058.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0058.012] lstrlenA (lpString="*.mp3") returned 5 [0058.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0058.012] lstrlenA (lpString="*.wav") returned 5 [0058.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0058.012] lstrlenA (lpString="*.flac") returned 6 [0058.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0058.012] lstrlenA (lpString="*.ape") returned 5 [0058.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0058.012] lstrlenA (lpString="*.wma") returned 5 [0058.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0058.012] lstrlenA (lpString="*.ac3") returned 5 [0058.012] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.012] FindClose (in: hFindFile=0x636730 | out: hFindFile=0x636730) returned 1 [0058.012] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37dcf714, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x67f00a1f, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x67f00a1f, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0058.012] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.013] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hwrcommonlm.dat") returned -1 [0058.013] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hwrcommonlm.dat") returned -1 [0058.013] lstrcmpiA (lpString1="", lpString2="hwrcommonlm.dat") returned -1 [0058.013] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0058.013] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.013] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.013] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.013] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.013] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="hwrcommonlm.dat" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" [0058.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.zip") returned 0 [0058.013] lstrlenA (lpString="*.zip") returned 5 [0058.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.rar") returned 0 [0058.013] lstrlenA (lpString="*.rar") returned 5 [0058.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.7z") returned 0 [0058.013] lstrlenA (lpString="*.7z") returned 4 [0058.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.tar") returned 0 [0058.013] lstrlenA (lpString="*.tar") returned 5 [0058.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.gzip") returned 0 [0058.013] lstrlenA (lpString="*.gzip") returned 6 [0058.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.jpg") returned 0 [0058.013] lstrlenA (lpString="*.jpg") returned 5 [0058.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.jpeg") returned 0 [0058.013] lstrlenA (lpString="*.jpeg") returned 6 [0058.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.psd") returned 0 [0058.013] lstrlenA (lpString="*.psd") returned 5 [0058.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.cdr") returned 0 [0058.013] lstrlenA (lpString="*.cdr") returned 5 [0058.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.dwg") returned 0 [0058.013] lstrlenA (lpString="*.dwg") returned 5 [0058.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.max") returned 0 [0058.014] lstrlenA (lpString="*.max") returned 5 [0058.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.bmp") returned 0 [0058.014] lstrlenA (lpString="*.bmp") returned 5 [0058.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.gif") returned 0 [0058.014] lstrlenA (lpString="*.gif") returned 5 [0058.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.png") returned 0 [0058.014] lstrlenA (lpString="*.png") returned 5 [0058.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.doc") returned 0 [0058.014] lstrlenA (lpString="*.doc") returned 5 [0058.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.docx") returned 0 [0058.014] lstrlenA (lpString="*.docx") returned 6 [0058.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.xls") returned 0 [0058.014] lstrlenA (lpString="*.xls") returned 5 [0058.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.xlsx") returned 0 [0058.014] lstrlenA (lpString="*.xlsx") returned 6 [0058.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.ppt") returned 0 [0058.014] lstrlenA (lpString="*.ppt") returned 5 [0058.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.pptx") returned 0 [0058.014] lstrlenA (lpString="*.pptx") returned 6 [0058.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.txt") returned 0 [0058.014] lstrlenA (lpString="*.txt") returned 5 [0058.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.pdf") returned 0 [0058.014] lstrlenA (lpString="*.pdf") returned 5 [0058.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.djvu") returned 0 [0058.014] lstrlenA (lpString="*.djvu") returned 6 [0058.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.htm") returned 0 [0058.014] lstrlenA (lpString="*.htm") returned 5 [0058.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.html") returned 0 [0058.014] lstrlenA (lpString="*.html") returned 6 [0058.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.mdb") returned 0 [0058.014] lstrlenA (lpString="*.mdb") returned 5 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.cer") returned 0 [0058.015] lstrlenA (lpString="*.cer") returned 5 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.p12") returned 0 [0058.015] lstrlenA (lpString="*.p12") returned 5 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.pfx") returned 0 [0058.015] lstrlenA (lpString="*.pfx") returned 5 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.kwm") returned 0 [0058.015] lstrlenA (lpString="*.kwm") returned 5 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.pwm") returned 0 [0058.015] lstrlenA (lpString="*.pwm") returned 5 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.1cd") returned 0 [0058.015] lstrlenA (lpString="*.1cd") returned 5 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.md") returned 0 [0058.015] lstrlenA (lpString="*.md") returned 4 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.mdf") returned 0 [0058.015] lstrlenA (lpString="*.mdf") returned 5 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.dbf") returned 0 [0058.015] lstrlenA (lpString="*.dbf") returned 5 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.odt") returned 0 [0058.015] lstrlenA (lpString="*.odt") returned 5 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.vob") returned 0 [0058.015] lstrlenA (lpString="*.vob") returned 5 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.ifo") returned 0 [0058.015] lstrlenA (lpString="*.ifo") returned 5 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.lnk") returned 0 [0058.015] lstrlenA (lpString="*.lnk") returned 5 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.torrent") returned 0 [0058.015] lstrlenA (lpString="*.torrent") returned 9 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.mov") returned 0 [0058.015] lstrlenA (lpString="*.mov") returned 5 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.m2v") returned 0 [0058.016] lstrlenA (lpString="*.m2v") returned 5 [0058.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.3gp") returned 0 [0058.016] lstrlenA (lpString="*.3gp") returned 5 [0058.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.mpeg") returned 0 [0058.016] lstrlenA (lpString="*.mpeg") returned 6 [0058.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.mpg") returned 0 [0058.016] lstrlenA (lpString="*.mpg") returned 5 [0058.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.flv") returned 0 [0058.016] lstrlenA (lpString="*.flv") returned 5 [0058.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.avi") returned 0 [0058.016] lstrlenA (lpString="*.avi") returned 5 [0058.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.mp4") returned 0 [0058.016] lstrlenA (lpString="*.mp4") returned 5 [0058.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.wmv") returned 0 [0058.016] lstrlenA (lpString="*.wmv") returned 5 [0058.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.divx") returned 0 [0058.016] lstrlenA (lpString="*.divx") returned 6 [0058.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.mkv") returned 0 [0058.016] lstrlenA (lpString="*.mkv") returned 5 [0058.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.mp3") returned 0 [0058.016] lstrlenA (lpString="*.mp3") returned 5 [0058.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.wav") returned 0 [0058.016] lstrlenA (lpString="*.wav") returned 5 [0058.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.flac") returned 0 [0058.016] lstrlenA (lpString="*.flac") returned 6 [0058.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.ape") returned 0 [0058.016] lstrlenA (lpString="*.ape") returned 5 [0058.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.wma") returned 0 [0058.016] lstrlenA (lpString="*.wma") returned 5 [0058.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.ac3") returned 0 [0058.016] lstrlenA (lpString="*.ac3") returned 5 [0058.016] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0058.017] lstrcmpA (lpString1=".", lpString2="HWRCustomization") returned -1 [0058.017] lstrcmpA (lpString1="..", lpString2="HWRCustomization") returned -1 [0058.017] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned="hwrcommonlm.dat" [0058.017] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HWRCustomization" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization" [0058.017] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization") returned 67 [0058.017] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0xa0, cFileName=".", cAlternateFileName="")) returned 0x6367f0 [0058.017] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.017] FindNextFileA (in: hFindFile=0x6367f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0xa0, cFileName="..", cAlternateFileName="")) returned 1 [0058.017] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.017] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.017] FindNextFileA (in: hFindFile=0x6367f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0xa0, cFileName="..", cAlternateFileName="")) returned 0 [0058.017] FindClose (in: hFindFile=0x6367f0 | out: hFindFile=0x6367f0) returned 1 [0058.018] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f3614fe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xd31b567d, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xd31db8ce, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x77fd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0058.018] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.018] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hwrenclm.dat") returned -1 [0058.018] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hwrenclm.dat") returned -1 [0058.018] lstrcmpiA (lpString1="", lpString2="hwrenclm.dat") returned -1 [0058.018] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0058.018] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.018] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.018] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.018] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.018] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="hwrenclm.dat" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" [0058.018] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.zip") returned 0 [0058.018] lstrlenA (lpString="*.zip") returned 5 [0058.018] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.rar") returned 0 [0058.018] lstrlenA (lpString="*.rar") returned 5 [0058.018] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.7z") returned 0 [0058.018] lstrlenA (lpString="*.7z") returned 4 [0058.018] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.tar") returned 0 [0058.018] lstrlenA (lpString="*.tar") returned 5 [0058.018] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.gzip") returned 0 [0058.018] lstrlenA (lpString="*.gzip") returned 6 [0058.018] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.jpg") returned 0 [0058.019] lstrlenA (lpString="*.jpg") returned 5 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.jpeg") returned 0 [0058.019] lstrlenA (lpString="*.jpeg") returned 6 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.psd") returned 0 [0058.019] lstrlenA (lpString="*.psd") returned 5 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.cdr") returned 0 [0058.019] lstrlenA (lpString="*.cdr") returned 5 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.dwg") returned 0 [0058.019] lstrlenA (lpString="*.dwg") returned 5 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.max") returned 0 [0058.019] lstrlenA (lpString="*.max") returned 5 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.bmp") returned 0 [0058.019] lstrlenA (lpString="*.bmp") returned 5 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.gif") returned 0 [0058.019] lstrlenA (lpString="*.gif") returned 5 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.png") returned 0 [0058.019] lstrlenA (lpString="*.png") returned 5 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.doc") returned 0 [0058.019] lstrlenA (lpString="*.doc") returned 5 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.docx") returned 0 [0058.019] lstrlenA (lpString="*.docx") returned 6 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.xls") returned 0 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.xlsx") returned 0 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.ppt") returned 0 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.pptx") returned 0 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.txt") returned 0 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.pdf") returned 0 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.djvu") returned 0 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.htm") returned 0 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.html") returned 0 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.mdb") returned 0 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.cer") returned 0 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.p12") returned 0 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.pfx") returned 0 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.kwm") returned 0 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.pwm") returned 0 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.1cd") returned 0 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.md") returned 0 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.mdf") returned 0 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.dbf") returned 0 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.odt") returned 0 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.vob") returned 0 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.ifo") returned 0 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.lnk") returned 0 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.torrent") returned 0 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.mov") returned 0 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.m2v") returned 0 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.3gp") returned 0 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.mpeg") returned 0 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.mpg") returned 0 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.flv") returned 0 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.avi") returned 0 [0058.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.mp4") returned 0 [0058.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.wmv") returned 0 [0058.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.divx") returned 0 [0058.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.mkv") returned 0 [0058.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.mp3") returned 0 [0058.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.wav") returned 0 [0058.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.flac") returned 0 [0058.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.ape") returned 0 [0058.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.wma") returned 0 [0058.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.ac3") returned 0 [0058.021] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37dcf714, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x67f26c7e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x67fbf5f5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x10cb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0058.021] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.021] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hwrlatinlm.dat") returned -1 [0058.021] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hwrlatinlm.dat") returned -1 [0058.021] lstrcmpiA (lpString1="", lpString2="hwrlatinlm.dat") returned -1 [0058.021] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned="hwrenclm.dat" [0058.021] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.021] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.021] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.021] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.021] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="hwrlatinlm.dat" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" [0058.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.zip") returned 0 [0058.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.rar") returned 0 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.7z") returned 0 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.tar") returned 0 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.gzip") returned 0 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.jpg") returned 0 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.jpeg") returned 0 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.psd") returned 0 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.cdr") returned 0 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.dwg") returned 0 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.max") returned 0 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.bmp") returned 0 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.gif") returned 0 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.png") returned 0 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.doc") returned 0 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.docx") returned 0 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.xls") returned 0 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.xlsx") returned 0 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.ppt") returned 0 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.pptx") returned 0 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.txt") returned 0 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.pdf") returned 0 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.djvu") returned 0 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.htm") returned 0 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.html") returned 0 [0058.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.mdb") returned 0 [0058.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.cer") returned 0 [0058.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.p12") returned 0 [0058.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.pfx") returned 0 [0058.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.kwm") returned 0 [0058.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.pwm") returned 0 [0058.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.1cd") returned 0 [0058.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.md") returned 0 [0058.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.mdf") returned 0 [0058.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.dbf") returned 0 [0058.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.odt") returned 0 [0058.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.vob") returned 0 [0058.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.ifo") returned 0 [0058.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.lnk") returned 0 [0058.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.torrent") returned 0 [0058.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.mov") returned 0 [0058.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.m2v") returned 0 [0058.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.3gp") returned 0 [0058.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.mpeg") returned 0 [0058.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.mpg") returned 0 [0058.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.flv") returned 0 [0058.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.avi") returned 0 [0058.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.mp4") returned 0 [0058.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.wmv") returned 0 [0058.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.divx") returned 0 [0058.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.mkv") returned 0 [0058.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.mp3") returned 0 [0058.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.wav") returned 0 [0058.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.flac") returned 0 [0058.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.ape") returned 0 [0058.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.wma") returned 0 [0058.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.ac3") returned 0 [0058.024] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f4200b7, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xd3417c6c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xd3548f4a, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x2646a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0058.024] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.024] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hwrusalm.dat") returned -1 [0058.024] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hwrusalm.dat") returned -1 [0058.024] lstrcmpiA (lpString1="", lpString2="hwrusalm.dat") returned -1 [0058.024] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned="hwrlatinlm.dat" [0058.024] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.024] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.024] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.024] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.024] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="hwrusalm.dat" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" [0058.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.zip") returned 0 [0058.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.rar") returned 0 [0058.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.7z") returned 0 [0058.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.tar") returned 0 [0058.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.gzip") returned 0 [0058.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.jpg") returned 0 [0058.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.jpeg") returned 0 [0058.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.psd") returned 0 [0058.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.cdr") returned 0 [0058.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.dwg") returned 0 [0058.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.max") returned 0 [0058.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.bmp") returned 0 [0058.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.gif") returned 0 [0058.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.png") returned 0 [0058.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.doc") returned 0 [0058.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.docx") returned 0 [0058.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.xls") returned 0 [0058.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.xlsx") returned 0 [0058.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.ppt") returned 0 [0058.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.pptx") returned 0 [0058.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.txt") returned 0 [0058.026] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f3f9e60, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xd3227d93, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xd33cb79b, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x35ce20, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0058.026] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.026] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hwrusash.dat") returned -1 [0058.026] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hwrusash.dat") returned -1 [0058.026] lstrcmpiA (lpString1="", lpString2="hwrusash.dat") returned -1 [0058.026] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned="hwrusalm.dat" [0058.026] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.026] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.026] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.026] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.026] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="hwrusash.dat" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" [0058.026] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f256931, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f256931, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f256931, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0058.026] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.026] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InkDiv.dll") returned -1 [0058.026] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InkDiv.dll") returned -1 [0058.026] lstrcmpiA (lpString1="", lpString2="InkDiv.dll") returned -1 [0058.026] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned="hwrusash.dat" [0058.026] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.026] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.026] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.026] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.026] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="InkDiv.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" [0058.027] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f256931, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f256931, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f256931, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1fda00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0058.027] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.027] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InkObj.dll") returned -1 [0058.027] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InkObj.dll") returned -1 [0058.027] lstrcmpiA (lpString1="", lpString2="InkObj.dll") returned -1 [0058.027] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned="InkDiv.dll" [0058.027] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.027] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.027] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.027] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.027] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="InkObj.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" [0058.027] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e68076, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x691ed82a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x69213a47, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x5c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0058.027] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.027] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InputPersonalization.exe") returned -1 [0058.027] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InputPersonalization.exe") returned -1 [0058.027] lstrcmpiA (lpString1="", lpString2="InputPersonalization.exe") returned -1 [0058.027] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned="InkObj.dll" [0058.027] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.027] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.027] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.027] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.028] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="InputPersonalization.exe" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe" [0058.028] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x972, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsar.xml", cAlternateFileName="")) returned 1 [0058.028] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.028] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsar.xml") returned -1 [0058.028] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsar.xml") returned -1 [0058.028] lstrcmpiA (lpString1="", lpString2="ipsar.xml") returned -1 [0058.028] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe") returned="InputPersonalization.exe" [0058.028] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.028] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.028] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.028] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.028] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsar.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" [0058.028] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0058.028] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.028] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipscat.xml") returned -1 [0058.028] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipscat.xml") returned -1 [0058.028] lstrcmpiA (lpString1="", lpString2="ipscat.xml") returned -1 [0058.028] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned="ipsar.xml" [0058.029] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.029] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.029] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.029] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.029] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipscat.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" [0058.029] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0058.029] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.029] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipschs.xml") returned -1 [0058.029] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipschs.xml") returned -1 [0058.029] lstrcmpiA (lpString1="", lpString2="ipschs.xml") returned -1 [0058.029] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned="ipscat.xml" [0058.029] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.029] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.029] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.029] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.029] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipschs.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" [0058.029] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0058.029] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.029] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipscht.xml") returned -1 [0058.029] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipscht.xml") returned -1 [0058.029] lstrcmpiA (lpString1="", lpString2="ipscht.xml") returned -1 [0058.029] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned="ipschs.xml" [0058.030] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.030] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.030] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.030] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.030] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipscht.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" [0058.030] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0058.030] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.030] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipscsy.xml") returned -1 [0058.030] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipscsy.xml") returned -1 [0058.030] lstrcmpiA (lpString1="", lpString2="ipscsy.xml") returned -1 [0058.030] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned="ipscht.xml" [0058.030] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.030] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.030] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.030] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.030] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipscsy.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" [0058.030] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0058.030] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.030] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsdan.xml") returned -1 [0058.030] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsdan.xml") returned -1 [0058.030] lstrcmpiA (lpString1="", lpString2="ipsdan.xml") returned -1 [0058.030] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned="ipscsy.xml" [0058.030] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.030] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.031] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.031] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.031] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsdan.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" [0058.031] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0058.031] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.031] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsdeu.xml") returned -1 [0058.031] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsdeu.xml") returned -1 [0058.031] lstrcmpiA (lpString1="", lpString2="ipsdeu.xml") returned -1 [0058.031] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned="ipsdan.xml" [0058.031] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.031] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.031] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.031] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.031] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsdeu.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" [0058.031] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsel.xml", cAlternateFileName="")) returned 1 [0058.031] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.031] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsel.xml") returned -1 [0058.031] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsel.xml") returned -1 [0058.031] lstrcmpiA (lpString1="", lpString2="ipsel.xml") returned -1 [0058.031] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned="ipsdeu.xml" [0058.031] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.031] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.031] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.031] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.032] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsel.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" [0058.032] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0058.032] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.032] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsen.xml") returned -1 [0058.032] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsen.xml") returned -1 [0058.032] lstrcmpiA (lpString1="", lpString2="ipsen.xml") returned -1 [0058.032] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned="ipsel.xml" [0058.032] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.032] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.032] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.032] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.032] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsen.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" [0058.032] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0058.032] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.032] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsesp.xml") returned -1 [0058.032] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsesp.xml") returned -1 [0058.032] lstrcmpiA (lpString1="", lpString2="ipsesp.xml") returned -1 [0058.032] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned="ipsen.xml" [0058.032] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.032] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.032] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.032] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.032] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsesp.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" [0058.032] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e68076, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0058.033] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.033] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IPSEventLogMsg.dll") returned -1 [0058.033] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPSEventLogMsg.dll") returned -1 [0058.033] lstrcmpiA (lpString1="", lpString2="IPSEventLogMsg.dll") returned -1 [0058.033] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned="ipsesp.xml" [0058.033] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.033] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.033] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.033] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.051] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="IPSEventLogMsg.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" [0058.051] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0058.051] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.055] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsfin.xml") returned -1 [0058.055] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsfin.xml") returned -1 [0058.055] lstrcmpiA (lpString1="", lpString2="ipsfin.xml") returned -1 [0058.055] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned="IPSEventLogMsg.dll" [0058.055] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.055] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.055] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.055] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.055] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsfin.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" [0058.056] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0058.056] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.056] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsfra.xml") returned -1 [0058.056] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsfra.xml") returned -1 [0058.056] lstrcmpiA (lpString1="", lpString2="ipsfra.xml") returned -1 [0058.056] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned="ipsfin.xml" [0058.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.056] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.056] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.056] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.056] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsfra.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" [0058.056] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshe.xml", cAlternateFileName="")) returned 1 [0058.056] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.056] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipshe.xml") returned -1 [0058.056] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipshe.xml") returned -1 [0058.056] lstrcmpiA (lpString1="", lpString2="ipshe.xml") returned -1 [0058.056] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned="ipsfra.xml" [0058.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.056] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.056] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.056] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.056] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipshe.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" [0058.057] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshi.xml", cAlternateFileName="")) returned 1 [0058.057] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.057] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipshi.xml") returned -1 [0058.057] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipshi.xml") returned -1 [0058.057] lstrcmpiA (lpString1="", lpString2="ipshi.xml") returned -1 [0058.057] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned="ipshe.xml" [0058.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.057] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.057] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.057] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.057] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipshi.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" [0058.057] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0058.057] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.057] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipshrv.xml") returned -1 [0058.057] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipshrv.xml") returned -1 [0058.057] lstrcmpiA (lpString1="", lpString2="ipshrv.xml") returned -1 [0058.057] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned="ipshi.xml" [0058.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.057] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.057] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.057] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.057] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipshrv.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" [0058.058] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e68076, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e68076, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e68076, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsid.xml", cAlternateFileName="")) returned 1 [0058.058] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.058] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsid.xml") returned -1 [0058.058] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsid.xml") returned -1 [0058.058] lstrcmpiA (lpString1="", lpString2="ipsid.xml") returned -1 [0058.058] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned="ipshrv.xml" [0058.058] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.058] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.058] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.058] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.058] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsid.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" [0058.058] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0058.058] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.058] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsita.xml") returned -1 [0058.058] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsita.xml") returned -1 [0058.058] lstrcmpiA (lpString1="", lpString2="ipsita.xml") returned -1 [0058.058] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml") returned="ipsid.xml" [0058.058] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.058] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.058] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.058] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.058] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsita.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" [0058.058] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0058.058] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.059] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsjpn.xml") returned -1 [0058.059] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsjpn.xml") returned -1 [0058.059] lstrcmpiA (lpString1="", lpString2="ipsjpn.xml") returned -1 [0058.059] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml") returned="ipsita.xml" [0058.059] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.059] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.059] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.059] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.059] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsjpn.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" [0058.059] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0058.059] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.059] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipskor.xml") returned -1 [0058.059] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipskor.xml") returned -1 [0058.059] lstrcmpiA (lpString1="", lpString2="ipskor.xml") returned -1 [0058.059] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml") returned="ipsjpn.xml" [0058.059] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.059] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.059] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.059] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.059] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipskor.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" [0058.060] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6917b208, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6917b208, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0058.060] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.060] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IpsMigrationPlugin.dll") returned -1 [0058.060] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IpsMigrationPlugin.dll") returned -1 [0058.060] lstrcmpiA (lpString1="", lpString2="IpsMigrationPlugin.dll") returned -1 [0058.060] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml") returned="ipskor.xml" [0058.060] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.060] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.060] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.060] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.060] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="IpsMigrationPlugin.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" [0058.060] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0058.060] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.060] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsnld.xml") returned -1 [0058.060] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsnld.xml") returned -1 [0058.060] lstrcmpiA (lpString1="", lpString2="ipsnld.xml") returned -1 [0058.060] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned="IpsMigrationPlugin.dll" [0058.060] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.060] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.060] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.060] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.061] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsnld.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" [0058.061] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0058.061] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.061] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsnor.xml") returned -1 [0058.061] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsnor.xml") returned -1 [0058.061] lstrcmpiA (lpString1="", lpString2="ipsnor.xml") returned -1 [0058.061] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned="ipsnld.xml" [0058.061] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.061] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.061] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.061] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.061] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsnor.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" [0058.061] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0058.061] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.061] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsplk.xml") returned -1 [0058.061] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsplk.xml") returned -1 [0058.061] lstrcmpiA (lpString1="", lpString2="ipsplk.xml") returned -1 [0058.061] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned="ipsnor.xml" [0058.061] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.061] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.061] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.061] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.061] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsplk.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" [0058.062] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x691c76a3, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x691c76a3, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1dc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0058.062] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.062] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IpsPlugin.dll") returned -1 [0058.062] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IpsPlugin.dll") returned -1 [0058.062] lstrcmpiA (lpString1="", lpString2="IpsPlugin.dll") returned -1 [0058.062] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned="ipsplk.xml" [0058.062] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.062] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.062] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.062] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.062] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="IpsPlugin.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" [0058.062] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0058.062] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.062] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsptb.xml") returned -1 [0058.062] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsptb.xml") returned -1 [0058.062] lstrcmpiA (lpString1="", lpString2="ipsptb.xml") returned -1 [0058.062] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned="IpsPlugin.dll" [0058.062] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.062] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.062] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.062] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.062] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsptb.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" [0058.062] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0058.062] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.062] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsptg.xml") returned -1 [0058.063] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsptg.xml") returned -1 [0058.063] lstrcmpiA (lpString1="", lpString2="ipsptg.xml") returned -1 [0058.063] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned="ipsptb.xml" [0058.063] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.063] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.063] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.063] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.063] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsptg.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" [0058.063] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0058.063] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.063] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsrom.xml") returned -1 [0058.063] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsrom.xml") returned -1 [0058.063] lstrcmpiA (lpString1="", lpString2="ipsrom.xml") returned -1 [0058.063] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned="ipsptg.xml" [0058.063] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.063] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.063] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.063] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.063] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsrom.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" [0058.063] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0058.063] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.063] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsrus.xml") returned -1 [0058.063] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsrus.xml") returned -1 [0058.063] lstrcmpiA (lpString1="", lpString2="ipsrus.xml") returned -1 [0058.063] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml") returned="ipsrom.xml" [0058.063] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.064] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.064] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.064] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.064] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsrus.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" [0058.064] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0058.064] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.064] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipssrb.xml") returned -1 [0058.064] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipssrb.xml") returned -1 [0058.064] lstrcmpiA (lpString1="", lpString2="ipssrb.xml") returned -1 [0058.064] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned="ipsrus.xml" [0058.064] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.064] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.064] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.064] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.064] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipssrb.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" [0058.064] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0058.064] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.064] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipssrl.xml") returned -1 [0058.064] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipssrl.xml") returned -1 [0058.064] lstrcmpiA (lpString1="", lpString2="ipssrl.xml") returned -1 [0058.064] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned="ipssrb.xml" [0058.064] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.064] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.064] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.064] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.065] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipssrl.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" [0058.065] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0058.065] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.065] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipssve.xml") returned -1 [0058.065] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipssve.xml") returned -1 [0058.065] lstrcmpiA (lpString1="", lpString2="ipssve.xml") returned -1 [0058.065] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned="ipssrl.xml" [0058.065] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.065] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.065] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.065] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.065] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipssve.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" [0058.065] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipstr.xml", cAlternateFileName="")) returned 1 [0058.065] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.065] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipstr.xml") returned -1 [0058.065] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipstr.xml") returned -1 [0058.065] lstrcmpiA (lpString1="", lpString2="ipstr.xml") returned -1 [0058.065] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned="ipssve.xml" [0058.065] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.065] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.065] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.065] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.065] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipstr.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" [0058.066] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0058.066] lstrcmpA (lpString1=".", lpString2="it-IT") returned -1 [0058.066] lstrcmpA (lpString1="..", lpString2="it-IT") returned -1 [0058.066] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned="ipstr.xml" [0058.066] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="it-IT" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT" [0058.066] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0xa0, cFileName=".", cAlternateFileName="")) returned 0x636530 [0058.066] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.066] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0xa0, cFileName="..", cAlternateFileName="")) returned 1 [0058.066] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.066] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.066] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x77792cf0, dwReserved1=0xa0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.066] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.066] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.066] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.066] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.066] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\*.*") returned="*.*" [0058.066] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\" [0058.066] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\") returned="" [0058.066] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\HOW TO DECRYPT FILES.txt" [0058.066] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\how to decrypt files.txt")) returned 0xffffffff [0058.067] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.067] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0058.068] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.068] CloseHandle (hObject=0x1d0) returned 1 [0058.069] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" [0058.069] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x77792cf0, dwReserved1=0xa0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.069] FindClose (in: hFindFile=0x636530 | out: hFindFile=0x636530) returned 1 [0058.069] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0058.069] lstrcmpA (lpString1=".", lpString2="ja-JP") returned -1 [0058.069] lstrcmpA (lpString1="..", lpString2="ja-JP") returned -1 [0058.069] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0058.069] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ja-JP" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP" [0058.069] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP") returned 56 [0058.069] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName=".", cAlternateFileName="")) returned 0x636730 [0058.070] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.070] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="..", cAlternateFileName="")) returned 1 [0058.070] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.070] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.070] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166b6187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166b6187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166b6187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.070] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.070] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.070] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.070] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.070] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\*.*") returned="*.*" [0058.070] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\" [0058.070] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\") returned="" [0058.070] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\HOW TO DECRYPT FILES.txt" [0058.070] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\how to decrypt files.txt")) returned 0xffffffff [0058.070] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.071] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0058.071] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0058.072] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.072] CloseHandle (hObject=0x1d0) returned 1 [0058.072] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" [0058.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0058.072] lstrlenA (lpString="*.zip") returned 5 [0058.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0058.072] lstrlenA (lpString="*.rar") returned 5 [0058.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0058.072] lstrlenA (lpString="*.7z") returned 4 [0058.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0058.072] lstrlenA (lpString="*.tar") returned 5 [0058.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0058.072] lstrlenA (lpString="*.gzip") returned 6 [0058.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0058.072] lstrlenA (lpString="*.jpg") returned 5 [0058.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0058.072] lstrlenA (lpString="*.jpeg") returned 6 [0058.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0058.073] lstrlenA (lpString="*.psd") returned 5 [0058.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0058.073] lstrlenA (lpString="*.cdr") returned 5 [0058.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0058.073] lstrlenA (lpString="*.dwg") returned 5 [0058.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0058.073] lstrlenA (lpString="*.max") returned 5 [0058.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0058.073] lstrlenA (lpString="*.bmp") returned 5 [0058.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0058.073] lstrlenA (lpString="*.gif") returned 5 [0058.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0058.073] lstrlenA (lpString="*.png") returned 5 [0058.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0058.073] lstrlenA (lpString="*.doc") returned 5 [0058.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0058.073] lstrlenA (lpString="*.docx") returned 6 [0058.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0058.073] lstrlenA (lpString="*.xls") returned 5 [0058.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0058.073] lstrlenA (lpString="*.xlsx") returned 6 [0058.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0058.073] lstrlenA (lpString="*.ppt") returned 5 [0058.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0058.073] lstrlenA (lpString="*.pptx") returned 6 [0058.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0058.073] lstrlenA (lpString="*.txt") returned 5 [0058.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0058.073] lstrlenA (lpString="*.pdf") returned 5 [0058.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0058.073] lstrlenA (lpString="*.djvu") returned 6 [0058.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0058.074] lstrlenA (lpString="*.htm") returned 5 [0058.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0058.074] lstrlenA (lpString="*.html") returned 6 [0058.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0058.074] lstrlenA (lpString="*.mdb") returned 5 [0058.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0058.074] lstrlenA (lpString="*.cer") returned 5 [0058.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0058.074] lstrlenA (lpString="*.p12") returned 5 [0058.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0058.074] lstrlenA (lpString="*.pfx") returned 5 [0058.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0058.074] lstrlenA (lpString="*.kwm") returned 5 [0058.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0058.074] lstrlenA (lpString="*.pwm") returned 5 [0058.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0058.074] lstrlenA (lpString="*.1cd") returned 5 [0058.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0058.074] lstrlenA (lpString="*.md") returned 4 [0058.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0058.074] lstrlenA (lpString="*.mdf") returned 5 [0058.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0058.074] lstrlenA (lpString="*.dbf") returned 5 [0058.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0058.074] lstrlenA (lpString="*.odt") returned 5 [0058.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0058.075] lstrlenA (lpString="*.vob") returned 5 [0058.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0058.075] lstrlenA (lpString="*.ifo") returned 5 [0058.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0058.075] lstrlenA (lpString="*.lnk") returned 5 [0058.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0058.075] lstrlenA (lpString="*.torrent") returned 9 [0058.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0058.075] lstrlenA (lpString="*.mov") returned 5 [0058.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0058.075] lstrlenA (lpString="*.m2v") returned 5 [0058.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0058.075] lstrlenA (lpString="*.3gp") returned 5 [0058.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0058.075] lstrlenA (lpString="*.mpeg") returned 6 [0058.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0058.075] lstrlenA (lpString="*.mpg") returned 5 [0058.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0058.075] lstrlenA (lpString="*.flv") returned 5 [0058.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0058.075] lstrlenA (lpString="*.avi") returned 5 [0058.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0058.075] lstrlenA (lpString="*.mp4") returned 5 [0058.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0058.075] lstrlenA (lpString="*.wmv") returned 5 [0058.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0058.075] lstrlenA (lpString="*.divx") returned 6 [0058.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0058.075] lstrlenA (lpString="*.mkv") returned 5 [0058.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0058.075] lstrlenA (lpString="*.mp3") returned 5 [0058.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0058.076] lstrlenA (lpString="*.wav") returned 5 [0058.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0058.076] lstrlenA (lpString="*.flac") returned 6 [0058.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0058.076] lstrlenA (lpString="*.ape") returned 5 [0058.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0058.076] lstrlenA (lpString="*.wma") returned 5 [0058.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0058.076] lstrlenA (lpString="*.ac3") returned 5 [0058.076] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166b6187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166b6187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166b6187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.076] FindClose (in: hFindFile=0x636730 | out: hFindFile=0x636730) returned 1 [0058.076] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f2306d6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f2306d6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f2306d6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x136a00, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0058.076] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.076] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="journal.dll") returned -1 [0058.076] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="journal.dll") returned -1 [0058.076] lstrcmpiA (lpString1="", lpString2="journal.dll") returned -1 [0058.076] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0058.076] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.076] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.076] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.076] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.076] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="journal.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll" [0058.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.zip") returned 0 [0058.076] lstrlenA (lpString="*.zip") returned 5 [0058.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.rar") returned 0 [0058.076] lstrlenA (lpString="*.rar") returned 5 [0058.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.7z") returned 0 [0058.076] lstrlenA (lpString="*.7z") returned 4 [0058.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.tar") returned 0 [0058.077] lstrlenA (lpString="*.tar") returned 5 [0058.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.gzip") returned 0 [0058.077] lstrlenA (lpString="*.gzip") returned 6 [0058.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.jpg") returned 0 [0058.077] lstrlenA (lpString="*.jpg") returned 5 [0058.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.jpeg") returned 0 [0058.077] lstrlenA (lpString="*.jpeg") returned 6 [0058.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.psd") returned 0 [0058.077] lstrlenA (lpString="*.psd") returned 5 [0058.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.cdr") returned 0 [0058.077] lstrlenA (lpString="*.cdr") returned 5 [0058.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.dwg") returned 0 [0058.077] lstrlenA (lpString="*.dwg") returned 5 [0058.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.max") returned 0 [0058.077] lstrlenA (lpString="*.max") returned 5 [0058.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.bmp") returned 0 [0058.077] lstrlenA (lpString="*.bmp") returned 5 [0058.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.gif") returned 0 [0058.077] lstrlenA (lpString="*.gif") returned 5 [0058.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.png") returned 0 [0058.077] lstrlenA (lpString="*.png") returned 5 [0058.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.doc") returned 0 [0058.077] lstrlenA (lpString="*.doc") returned 5 [0058.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.docx") returned 0 [0058.077] lstrlenA (lpString="*.docx") returned 6 [0058.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.xls") returned 0 [0058.077] lstrlenA (lpString="*.xls") returned 5 [0058.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.xlsx") returned 0 [0058.077] lstrlenA (lpString="*.xlsx") returned 6 [0058.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.ppt") returned 0 [0058.077] lstrlenA (lpString="*.ppt") returned 5 [0058.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.pptx") returned 0 [0058.078] lstrlenA (lpString="*.pptx") returned 6 [0058.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.txt") returned 0 [0058.078] lstrlenA (lpString="*.txt") returned 5 [0058.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.pdf") returned 0 [0058.078] lstrlenA (lpString="*.pdf") returned 5 [0058.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.djvu") returned 0 [0058.078] lstrlenA (lpString="*.djvu") returned 6 [0058.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.htm") returned 0 [0058.078] lstrlenA (lpString="*.htm") returned 5 [0058.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.html") returned 0 [0058.078] lstrlenA (lpString="*.html") returned 6 [0058.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.mdb") returned 0 [0058.078] lstrlenA (lpString="*.mdb") returned 5 [0058.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.cer") returned 0 [0058.078] lstrlenA (lpString="*.cer") returned 5 [0058.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.p12") returned 0 [0058.078] lstrlenA (lpString="*.p12") returned 5 [0058.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.pfx") returned 0 [0058.078] lstrlenA (lpString="*.pfx") returned 5 [0058.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.kwm") returned 0 [0058.078] lstrlenA (lpString="*.kwm") returned 5 [0058.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.pwm") returned 0 [0058.078] lstrlenA (lpString="*.pwm") returned 5 [0058.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.1cd") returned 0 [0058.078] lstrlenA (lpString="*.1cd") returned 5 [0058.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.md") returned 0 [0058.078] lstrlenA (lpString="*.md") returned 4 [0058.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.mdf") returned 0 [0058.078] lstrlenA (lpString="*.mdf") returned 5 [0058.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.dbf") returned 0 [0058.078] lstrlenA (lpString="*.dbf") returned 5 [0058.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.odt") returned 0 [0058.078] lstrlenA (lpString="*.odt") returned 5 [0058.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.vob") returned 0 [0058.078] lstrlenA (lpString="*.vob") returned 5 [0058.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.ifo") returned 0 [0058.079] lstrlenA (lpString="*.ifo") returned 5 [0058.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.lnk") returned 0 [0058.079] lstrlenA (lpString="*.lnk") returned 5 [0058.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.torrent") returned 0 [0058.079] lstrlenA (lpString="*.torrent") returned 9 [0058.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.mov") returned 0 [0058.079] lstrlenA (lpString="*.mov") returned 5 [0058.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.m2v") returned 0 [0058.079] lstrlenA (lpString="*.m2v") returned 5 [0058.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.3gp") returned 0 [0058.079] lstrlenA (lpString="*.3gp") returned 5 [0058.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.mpeg") returned 0 [0058.079] lstrlenA (lpString="*.mpeg") returned 6 [0058.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.mpg") returned 0 [0058.079] lstrlenA (lpString="*.mpg") returned 5 [0058.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.flv") returned 0 [0058.079] lstrlenA (lpString="*.flv") returned 5 [0058.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.avi") returned 0 [0058.079] lstrlenA (lpString="*.avi") returned 5 [0058.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.mp4") returned 0 [0058.079] lstrlenA (lpString="*.mp4") returned 5 [0058.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.wmv") returned 0 [0058.079] lstrlenA (lpString="*.wmv") returned 5 [0058.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.divx") returned 0 [0058.079] lstrlenA (lpString="*.divx") returned 6 [0058.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.mkv") returned 0 [0058.079] lstrlenA (lpString="*.mkv") returned 5 [0058.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.mp3") returned 0 [0058.079] lstrlenA (lpString="*.mp3") returned 5 [0058.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.wav") returned 0 [0058.079] lstrlenA (lpString="*.wav") returned 5 [0058.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.flac") returned 0 [0058.079] lstrlenA (lpString="*.flac") returned 6 [0058.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.ape") returned 0 [0058.080] lstrlenA (lpString="*.ape") returned 5 [0058.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.wma") returned 0 [0058.080] lstrlenA (lpString="*.wma") returned 5 [0058.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll", pszSpec="*.ac3") returned 0 [0058.080] lstrlenA (lpString="*.ac3") returned 5 [0058.080] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0058.080] lstrcmpA (lpString1=".", lpString2="ko-KR") returned -1 [0058.080] lstrcmpA (lpString1="..", lpString2="ko-KR") returned -1 [0058.080] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll") returned="journal.dll" [0058.080] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ko-KR" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR" [0058.080] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR") returned 56 [0058.080] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0xa0, cFileName=".", cAlternateFileName="")) returned 0x636b70 [0058.080] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.080] FindNextFileA (in: hFindFile=0x636b70, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0xa0, cFileName="..", cAlternateFileName="")) returned 1 [0058.080] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.080] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.080] FindNextFileA (in: hFindFile=0x636b70, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166b6187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166b6187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166b6187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x77792cf0, dwReserved1=0xa0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.080] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.080] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.080] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.080] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.080] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\*.*") returned="*.*" [0058.081] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\" [0058.081] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\") returned="" [0058.081] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\HOW TO DECRYPT FILES.txt" [0058.081] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\how to decrypt files.txt")) returned 0xffffffff [0058.081] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.081] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0058.081] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0058.082] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.082] CloseHandle (hObject=0x1d0) returned 1 [0058.083] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" [0058.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0058.083] lstrlenA (lpString="*.zip") returned 5 [0058.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0058.083] lstrlenA (lpString="*.rar") returned 5 [0058.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0058.083] lstrlenA (lpString="*.7z") returned 4 [0058.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0058.083] lstrlenA (lpString="*.tar") returned 5 [0058.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0058.083] lstrlenA (lpString="*.gzip") returned 6 [0058.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0058.083] lstrlenA (lpString="*.jpg") returned 5 [0058.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0058.083] lstrlenA (lpString="*.jpeg") returned 6 [0058.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0058.083] lstrlenA (lpString="*.psd") returned 5 [0058.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0058.083] lstrlenA (lpString="*.cdr") returned 5 [0058.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0058.083] lstrlenA (lpString="*.dwg") returned 5 [0058.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0058.083] lstrlenA (lpString="*.max") returned 5 [0058.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0058.083] lstrlenA (lpString="*.bmp") returned 5 [0058.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0058.083] lstrlenA (lpString="*.gif") returned 5 [0058.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0058.083] lstrlenA (lpString="*.png") returned 5 [0058.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0058.083] lstrlenA (lpString="*.doc") returned 5 [0058.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0058.084] lstrlenA (lpString="*.docx") returned 6 [0058.084] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0058.084] lstrlenA (lpString="*.xls") returned 5 [0058.084] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0058.084] lstrlenA (lpString="*.xlsx") returned 6 [0058.084] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0058.084] lstrlenA (lpString="*.ppt") returned 5 [0058.084] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0058.084] lstrlenA (lpString="*.pptx") returned 6 [0058.084] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0058.084] lstrlenA (lpString="*.txt") returned 5 [0058.084] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0058.084] lstrlenA (lpString="*.pdf") returned 5 [0058.084] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0058.084] lstrlenA (lpString="*.djvu") returned 6 [0058.084] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0058.084] lstrlenA (lpString="*.htm") returned 5 [0058.084] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0058.084] lstrlenA (lpString="*.html") returned 6 [0058.084] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0058.084] lstrlenA (lpString="*.mdb") returned 5 [0058.084] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0058.084] lstrlenA (lpString="*.cer") returned 5 [0058.084] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0058.084] lstrlenA (lpString="*.p12") returned 5 [0058.084] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0058.084] lstrlenA (lpString="*.pfx") returned 5 [0058.084] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0058.084] lstrlenA (lpString="*.kwm") returned 5 [0058.084] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0058.084] lstrlenA (lpString="*.pwm") returned 5 [0058.084] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0058.084] lstrlenA (lpString="*.1cd") returned 5 [0058.084] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0058.085] lstrlenA (lpString="*.md") returned 4 [0058.085] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0058.085] lstrlenA (lpString="*.mdf") returned 5 [0058.085] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0058.085] lstrlenA (lpString="*.dbf") returned 5 [0058.085] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0058.085] lstrlenA (lpString="*.odt") returned 5 [0058.085] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0058.085] lstrlenA (lpString="*.vob") returned 5 [0058.085] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0058.085] lstrlenA (lpString="*.ifo") returned 5 [0058.085] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0058.085] lstrlenA (lpString="*.lnk") returned 5 [0058.085] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0058.085] lstrlenA (lpString="*.torrent") returned 9 [0058.085] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0058.085] lstrlenA (lpString="*.mov") returned 5 [0058.085] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0058.085] lstrlenA (lpString="*.m2v") returned 5 [0058.085] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0058.085] lstrlenA (lpString="*.3gp") returned 5 [0058.085] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0058.085] lstrlenA (lpString="*.mpeg") returned 6 [0058.085] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0058.085] lstrlenA (lpString="*.mpg") returned 5 [0058.085] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0058.085] lstrlenA (lpString="*.flv") returned 5 [0058.085] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0058.085] lstrlenA (lpString="*.avi") returned 5 [0058.085] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0058.085] lstrlenA (lpString="*.mp4") returned 5 [0058.085] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0058.085] lstrlenA (lpString="*.wmv") returned 5 [0058.085] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0058.086] lstrlenA (lpString="*.divx") returned 6 [0058.086] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0058.086] lstrlenA (lpString="*.mkv") returned 5 [0058.086] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0058.086] lstrlenA (lpString="*.mp3") returned 5 [0058.086] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0058.086] lstrlenA (lpString="*.wav") returned 5 [0058.086] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0058.086] lstrlenA (lpString="*.flac") returned 6 [0058.086] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0058.086] lstrlenA (lpString="*.ape") returned 5 [0058.086] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0058.086] lstrlenA (lpString="*.wma") returned 5 [0058.086] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0058.086] lstrlenA (lpString="*.ac3") returned 5 [0058.086] FindNextFileA (in: hFindFile=0x636b70, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166b6187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166b6187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166b6187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x77792cf0, dwReserved1=0xa0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.086] FindClose (in: hFindFile=0x636b70 | out: hFindFile=0x636b70) returned 1 [0058.086] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1 [0058.086] lstrcmpA (lpString1=".", lpString2="LanguageModel") returned -1 [0058.086] lstrcmpA (lpString1="..", lpString2="LanguageModel") returned -1 [0058.086] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0058.086] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="LanguageModel" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel" [0058.086] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel") returned 64 [0058.086] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName=".", cAlternateFileName="")) returned 0x6369f0 [0058.087] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.087] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="..", cAlternateFileName="")) returned 1 [0058.087] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.087] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.087] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="chstic.dgml", cAlternateFileName="")) returned 1 [0058.087] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.087] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="chstic.dgml") returned 1 [0058.087] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chstic.dgml") returned 1 [0058.087] lstrcmpiA (lpString1="", lpString2="chstic.dgml") returned -1 [0058.087] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\*.*") returned="*.*" [0058.087] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\" [0058.087] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\") returned="" [0058.087] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\HOW TO DECRYPT FILES.txt" [0058.087] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\how to decrypt files.txt")) returned 0xffffffff [0058.087] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.087] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0058.087] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0058.094] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.094] CloseHandle (hObject=0x1d0) returned 1 [0058.094] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\", lpString2="chstic.dgml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" [0058.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.zip") returned 0 [0058.094] lstrlenA (lpString="*.zip") returned 5 [0058.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.rar") returned 0 [0058.094] lstrlenA (lpString="*.rar") returned 5 [0058.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.7z") returned 0 [0058.094] lstrlenA (lpString="*.7z") returned 4 [0058.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.tar") returned 0 [0058.094] lstrlenA (lpString="*.tar") returned 5 [0058.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.gzip") returned 0 [0058.094] lstrlenA (lpString="*.gzip") returned 6 [0058.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.jpg") returned 0 [0058.095] lstrlenA (lpString="*.jpg") returned 5 [0058.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.jpeg") returned 0 [0058.095] lstrlenA (lpString="*.jpeg") returned 6 [0058.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.psd") returned 0 [0058.095] lstrlenA (lpString="*.psd") returned 5 [0058.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.cdr") returned 0 [0058.095] lstrlenA (lpString="*.cdr") returned 5 [0058.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.dwg") returned 0 [0058.095] lstrlenA (lpString="*.dwg") returned 5 [0058.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.max") returned 0 [0058.095] lstrlenA (lpString="*.max") returned 5 [0058.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.bmp") returned 0 [0058.095] lstrlenA (lpString="*.bmp") returned 5 [0058.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.gif") returned 0 [0058.095] lstrlenA (lpString="*.gif") returned 5 [0058.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.png") returned 0 [0058.095] lstrlenA (lpString="*.png") returned 5 [0058.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.doc") returned 0 [0058.095] lstrlenA (lpString="*.doc") returned 5 [0058.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.docx") returned 0 [0058.095] lstrlenA (lpString="*.docx") returned 6 [0058.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.xls") returned 0 [0058.095] lstrlenA (lpString="*.xls") returned 5 [0058.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.xlsx") returned 0 [0058.095] lstrlenA (lpString="*.xlsx") returned 6 [0058.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.ppt") returned 0 [0058.095] lstrlenA (lpString="*.ppt") returned 5 [0058.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.pptx") returned 0 [0058.096] lstrlenA (lpString="*.pptx") returned 6 [0058.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.txt") returned 0 [0058.096] lstrlenA (lpString="*.txt") returned 5 [0058.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.pdf") returned 0 [0058.096] lstrlenA (lpString="*.pdf") returned 5 [0058.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.djvu") returned 0 [0058.096] lstrlenA (lpString="*.djvu") returned 6 [0058.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.htm") returned 0 [0058.096] lstrlenA (lpString="*.htm") returned 5 [0058.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.html") returned 0 [0058.096] lstrlenA (lpString="*.html") returned 6 [0058.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.mdb") returned 0 [0058.096] lstrlenA (lpString="*.mdb") returned 5 [0058.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.cer") returned 0 [0058.096] lstrlenA (lpString="*.cer") returned 5 [0058.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.p12") returned 0 [0058.096] lstrlenA (lpString="*.p12") returned 5 [0058.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.pfx") returned 0 [0058.096] lstrlenA (lpString="*.pfx") returned 5 [0058.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.kwm") returned 0 [0058.096] lstrlenA (lpString="*.kwm") returned 5 [0058.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.pwm") returned 0 [0058.096] lstrlenA (lpString="*.pwm") returned 5 [0058.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.1cd") returned 0 [0058.096] lstrlenA (lpString="*.1cd") returned 5 [0058.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.md") returned 0 [0058.096] lstrlenA (lpString="*.md") returned 4 [0058.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.mdf") returned 0 [0058.096] lstrlenA (lpString="*.mdf") returned 5 [0058.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.dbf") returned 0 [0058.096] lstrlenA (lpString="*.dbf") returned 5 [0058.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.odt") returned 0 [0058.096] lstrlenA (lpString="*.odt") returned 5 [0058.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.vob") returned 0 [0058.097] lstrlenA (lpString="*.vob") returned 5 [0058.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.ifo") returned 0 [0058.097] lstrlenA (lpString="*.ifo") returned 5 [0058.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.lnk") returned 0 [0058.097] lstrlenA (lpString="*.lnk") returned 5 [0058.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.torrent") returned 0 [0058.097] lstrlenA (lpString="*.torrent") returned 9 [0058.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.mov") returned 0 [0058.097] lstrlenA (lpString="*.mov") returned 5 [0058.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.m2v") returned 0 [0058.097] lstrlenA (lpString="*.m2v") returned 5 [0058.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.3gp") returned 0 [0058.097] lstrlenA (lpString="*.3gp") returned 5 [0058.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.mpeg") returned 0 [0058.097] lstrlenA (lpString="*.mpeg") returned 6 [0058.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.mpg") returned 0 [0058.097] lstrlenA (lpString="*.mpg") returned 5 [0058.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.flv") returned 0 [0058.097] lstrlenA (lpString="*.flv") returned 5 [0058.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.avi") returned 0 [0058.097] lstrlenA (lpString="*.avi") returned 5 [0058.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.mp4") returned 0 [0058.097] lstrlenA (lpString="*.mp4") returned 5 [0058.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.wmv") returned 0 [0058.097] lstrlenA (lpString="*.wmv") returned 5 [0058.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.divx") returned 0 [0058.097] lstrlenA (lpString="*.divx") returned 6 [0058.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.mkv") returned 0 [0058.097] lstrlenA (lpString="*.mkv") returned 5 [0058.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.mp3") returned 0 [0058.097] lstrlenA (lpString="*.mp3") returned 5 [0058.098] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.wav") returned 0 [0058.098] lstrlenA (lpString="*.wav") returned 5 [0058.098] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.flac") returned 0 [0058.098] lstrlenA (lpString="*.flac") returned 6 [0058.098] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.ape") returned 0 [0058.098] lstrlenA (lpString="*.ape") returned 5 [0058.098] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.wma") returned 0 [0058.098] lstrlenA (lpString="*.wma") returned 5 [0058.098] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", pszSpec="*.ac3") returned 0 [0058.098] lstrlenA (lpString="*.ac3") returned 5 [0058.098] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="chstic.dgml", cAlternateFileName="")) returned 0 [0058.098] FindClose (in: hFindFile=0x6369f0 | out: hFindFile=0x6369f0) returned 1 [0058.098] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0058.098] lstrcmpA (lpString1=".", lpString2="lt-LT") returned -1 [0058.098] lstrcmpA (lpString1="..", lpString2="lt-LT") returned -1 [0058.098] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0058.098] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="lt-LT" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT" [0058.098] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT") returned 56 [0058.098] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x6369f0 [0058.098] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.098] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0058.098] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.098] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.098] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1668ff40, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1668ff40, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1668ff40, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.099] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.099] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.099] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.099] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.099] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\*.*") returned="*.*" [0058.099] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\" [0058.099] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\") returned="" [0058.099] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\HOW TO DECRYPT FILES.txt" [0058.099] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\how to decrypt files.txt")) returned 0xffffffff [0058.099] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.099] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0058.099] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0058.100] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.100] CloseHandle (hObject=0x1d0) returned 1 [0058.101] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" [0058.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0058.101] lstrlenA (lpString="*.zip") returned 5 [0058.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0058.101] lstrlenA (lpString="*.rar") returned 5 [0058.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0058.101] lstrlenA (lpString="*.7z") returned 4 [0058.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0058.101] lstrlenA (lpString="*.tar") returned 5 [0058.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0058.101] lstrlenA (lpString="*.gzip") returned 6 [0058.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0058.101] lstrlenA (lpString="*.jpg") returned 5 [0058.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0058.101] lstrlenA (lpString="*.jpeg") returned 6 [0058.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0058.101] lstrlenA (lpString="*.psd") returned 5 [0058.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0058.101] lstrlenA (lpString="*.cdr") returned 5 [0058.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0058.101] lstrlenA (lpString="*.dwg") returned 5 [0058.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0058.101] lstrlenA (lpString="*.max") returned 5 [0058.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0058.101] lstrlenA (lpString="*.bmp") returned 5 [0058.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0058.101] lstrlenA (lpString="*.gif") returned 5 [0058.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0058.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0058.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0058.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0058.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0058.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0058.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0058.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0058.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0058.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0058.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0058.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0058.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0058.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0058.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0058.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0058.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0058.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0058.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0058.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0058.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0058.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0058.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0058.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0058.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0058.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0058.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0058.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0058.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0058.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0058.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0058.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0058.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0058.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0058.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0058.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0058.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0058.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0058.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0058.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0058.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0058.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0058.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0058.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0058.103] FindNextFileA (in: hFindFile=0x6369f0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1668ff40, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1668ff40, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1668ff40, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.103] FindClose (in: hFindFile=0x6369f0 | out: hFindFile=0x6369f0) returned 1 [0058.103] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0058.103] lstrcmpA (lpString1=".", lpString2="lv-LV") returned -1 [0058.103] lstrcmpA (lpString1="..", lpString2="lv-LV") returned -1 [0058.103] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0058.103] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="lv-LV" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV" [0058.104] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\*.*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName=".", cAlternateFileName="")) returned 0x636430 [0058.104] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.104] FindNextFileA (in: hFindFile=0x636430, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="..", cAlternateFileName="")) returned 1 [0058.104] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.104] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.104] FindNextFileA (in: hFindFile=0x636430, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1668ff40, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1668ff40, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1668ff40, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.104] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.105] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.105] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.105] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.105] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\*.*") returned="*.*" [0058.105] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\" [0058.105] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\") returned="" [0058.105] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\HOW TO DECRYPT FILES.txt" [0058.105] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\how to decrypt files.txt")) returned 0xffffffff [0058.105] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.105] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0058.107] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.107] CloseHandle (hObject=0x1d0) returned 1 [0058.107] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" [0058.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0058.107] lstrlenA (lpString="*.zip") returned 5 [0058.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0058.107] lstrlenA (lpString="*.rar") returned 5 [0058.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0058.107] lstrlenA (lpString="*.7z") returned 4 [0058.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0058.107] lstrlenA (lpString="*.tar") returned 5 [0058.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0058.107] lstrlenA (lpString="*.gzip") returned 6 [0058.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0058.107] lstrlenA (lpString="*.jpg") returned 5 [0058.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0058.107] lstrlenA (lpString="*.jpeg") returned 6 [0058.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0058.107] lstrlenA (lpString="*.psd") returned 5 [0058.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0058.108] lstrlenA (lpString="*.cdr") returned 5 [0058.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0058.108] lstrlenA (lpString="*.dwg") returned 5 [0058.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0058.108] lstrlenA (lpString="*.max") returned 5 [0058.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0058.108] lstrlenA (lpString="*.bmp") returned 5 [0058.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0058.108] lstrlenA (lpString="*.gif") returned 5 [0058.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0058.108] lstrlenA (lpString="*.png") returned 5 [0058.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0058.108] lstrlenA (lpString="*.doc") returned 5 [0058.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0058.108] lstrlenA (lpString="*.docx") returned 6 [0058.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0058.108] lstrlenA (lpString="*.xls") returned 5 [0058.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0058.108] lstrlenA (lpString="*.xlsx") returned 6 [0058.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0058.108] lstrlenA (lpString="*.ppt") returned 5 [0058.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0058.108] lstrlenA (lpString="*.pptx") returned 6 [0058.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0058.108] lstrlenA (lpString="*.txt") returned 5 [0058.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0058.108] lstrlenA (lpString="*.pdf") returned 5 [0058.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0058.108] lstrlenA (lpString="*.djvu") returned 6 [0058.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0058.108] lstrlenA (lpString="*.htm") returned 5 [0058.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0058.108] lstrlenA (lpString="*.html") returned 6 [0058.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0058.109] lstrlenA (lpString="*.mdb") returned 5 [0058.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0058.109] lstrlenA (lpString="*.cer") returned 5 [0058.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0058.109] lstrlenA (lpString="*.p12") returned 5 [0058.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0058.109] lstrlenA (lpString="*.pfx") returned 5 [0058.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0058.109] lstrlenA (lpString="*.kwm") returned 5 [0058.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0058.109] lstrlenA (lpString="*.pwm") returned 5 [0058.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0058.109] lstrlenA (lpString="*.1cd") returned 5 [0058.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0058.109] lstrlenA (lpString="*.md") returned 4 [0058.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0058.109] lstrlenA (lpString="*.mdf") returned 5 [0058.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0058.109] lstrlenA (lpString="*.dbf") returned 5 [0058.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0058.109] lstrlenA (lpString="*.odt") returned 5 [0058.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0058.109] lstrlenA (lpString="*.vob") returned 5 [0058.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0058.109] lstrlenA (lpString="*.ifo") returned 5 [0058.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0058.109] lstrlenA (lpString="*.lnk") returned 5 [0058.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0058.109] lstrlenA (lpString="*.torrent") returned 9 [0058.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0058.109] lstrlenA (lpString="*.mov") returned 5 [0058.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0058.109] lstrlenA (lpString="*.m2v") returned 5 [0058.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0058.110] lstrlenA (lpString="*.3gp") returned 5 [0058.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0058.110] lstrlenA (lpString="*.mpeg") returned 6 [0058.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0058.110] lstrlenA (lpString="*.mpg") returned 5 [0058.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0058.110] lstrlenA (lpString="*.flv") returned 5 [0058.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0058.110] lstrlenA (lpString="*.avi") returned 5 [0058.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0058.110] lstrlenA (lpString="*.mp4") returned 5 [0058.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0058.110] lstrlenA (lpString="*.wmv") returned 5 [0058.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0058.110] lstrlenA (lpString="*.divx") returned 6 [0058.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0058.110] lstrlenA (lpString="*.mkv") returned 5 [0058.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0058.110] lstrlenA (lpString="*.mp3") returned 5 [0058.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0058.110] lstrlenA (lpString="*.wav") returned 5 [0058.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0058.110] lstrlenA (lpString="*.flac") returned 6 [0058.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0058.110] lstrlenA (lpString="*.ape") returned 5 [0058.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0058.110] lstrlenA (lpString="*.wma") returned 5 [0058.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0058.110] lstrlenA (lpString="*.ac3") returned 5 [0058.110] FindNextFileA (in: hFindFile=0x636430, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1668ff40, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1668ff40, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1668ff40, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.110] FindClose (in: hFindFile=0x636430 | out: hFindFile=0x636430) returned 1 [0058.111] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x584f7138, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b8f5213, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b98dcaf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1a9c00, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0058.111] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.111] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="micaut.dll") returned -1 [0058.111] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="micaut.dll") returned -1 [0058.111] lstrcmpiA (lpString1="", lpString2="micaut.dll") returned -1 [0058.111] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0058.111] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.111] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.111] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.111] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.111] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="micaut.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" [0058.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.zip") returned 0 [0058.111] lstrlenA (lpString="*.zip") returned 5 [0058.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.rar") returned 0 [0058.111] lstrlenA (lpString="*.rar") returned 5 [0058.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.7z") returned 0 [0058.111] lstrlenA (lpString="*.7z") returned 4 [0058.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.tar") returned 0 [0058.111] lstrlenA (lpString="*.tar") returned 5 [0058.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.gzip") returned 0 [0058.111] lstrlenA (lpString="*.gzip") returned 6 [0058.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.jpg") returned 0 [0058.111] lstrlenA (lpString="*.jpg") returned 5 [0058.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.jpeg") returned 0 [0058.112] lstrlenA (lpString="*.jpeg") returned 6 [0058.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.psd") returned 0 [0058.112] lstrlenA (lpString="*.psd") returned 5 [0058.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.cdr") returned 0 [0058.112] lstrlenA (lpString="*.cdr") returned 5 [0058.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.dwg") returned 0 [0058.112] lstrlenA (lpString="*.dwg") returned 5 [0058.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.max") returned 0 [0058.112] lstrlenA (lpString="*.max") returned 5 [0058.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.bmp") returned 0 [0058.112] lstrlenA (lpString="*.bmp") returned 5 [0058.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.gif") returned 0 [0058.112] lstrlenA (lpString="*.gif") returned 5 [0058.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.png") returned 0 [0058.112] lstrlenA (lpString="*.png") returned 5 [0058.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.doc") returned 0 [0058.112] lstrlenA (lpString="*.doc") returned 5 [0058.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.docx") returned 0 [0058.112] lstrlenA (lpString="*.docx") returned 6 [0058.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.xls") returned 0 [0058.112] lstrlenA (lpString="*.xls") returned 5 [0058.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.xlsx") returned 0 [0058.112] lstrlenA (lpString="*.xlsx") returned 6 [0058.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.ppt") returned 0 [0058.112] lstrlenA (lpString="*.ppt") returned 5 [0058.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.pptx") returned 0 [0058.112] lstrlenA (lpString="*.pptx") returned 6 [0058.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.txt") returned 0 [0058.112] lstrlenA (lpString="*.txt") returned 5 [0058.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.pdf") returned 0 [0058.112] lstrlenA (lpString="*.pdf") returned 5 [0058.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.djvu") returned 0 [0058.112] lstrlenA (lpString="*.djvu") returned 6 [0058.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.htm") returned 0 [0058.113] lstrlenA (lpString="*.htm") returned 5 [0058.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.html") returned 0 [0058.113] lstrlenA (lpString="*.html") returned 6 [0058.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.mdb") returned 0 [0058.113] lstrlenA (lpString="*.mdb") returned 5 [0058.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.cer") returned 0 [0058.113] lstrlenA (lpString="*.cer") returned 5 [0058.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.p12") returned 0 [0058.113] lstrlenA (lpString="*.p12") returned 5 [0058.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.pfx") returned 0 [0058.113] lstrlenA (lpString="*.pfx") returned 5 [0058.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.kwm") returned 0 [0058.113] lstrlenA (lpString="*.kwm") returned 5 [0058.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.pwm") returned 0 [0058.113] lstrlenA (lpString="*.pwm") returned 5 [0058.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.1cd") returned 0 [0058.113] lstrlenA (lpString="*.1cd") returned 5 [0058.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.md") returned 0 [0058.113] lstrlenA (lpString="*.md") returned 4 [0058.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.mdf") returned 0 [0058.113] lstrlenA (lpString="*.mdf") returned 5 [0058.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.dbf") returned 0 [0058.113] lstrlenA (lpString="*.dbf") returned 5 [0058.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.odt") returned 0 [0058.113] lstrlenA (lpString="*.odt") returned 5 [0058.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.vob") returned 0 [0058.113] lstrlenA (lpString="*.vob") returned 5 [0058.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.ifo") returned 0 [0058.113] lstrlenA (lpString="*.ifo") returned 5 [0058.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.lnk") returned 0 [0058.113] lstrlenA (lpString="*.lnk") returned 5 [0058.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.torrent") returned 0 [0058.114] lstrlenA (lpString="*.torrent") returned 9 [0058.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.mov") returned 0 [0058.114] lstrlenA (lpString="*.mov") returned 5 [0058.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.m2v") returned 0 [0058.114] lstrlenA (lpString="*.m2v") returned 5 [0058.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.3gp") returned 0 [0058.114] lstrlenA (lpString="*.3gp") returned 5 [0058.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.mpeg") returned 0 [0058.114] lstrlenA (lpString="*.mpeg") returned 6 [0058.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.mpg") returned 0 [0058.114] lstrlenA (lpString="*.mpg") returned 5 [0058.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.flv") returned 0 [0058.114] lstrlenA (lpString="*.flv") returned 5 [0058.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.avi") returned 0 [0058.114] lstrlenA (lpString="*.avi") returned 5 [0058.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.mp4") returned 0 [0058.114] lstrlenA (lpString="*.mp4") returned 5 [0058.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.wmv") returned 0 [0058.114] lstrlenA (lpString="*.wmv") returned 5 [0058.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.divx") returned 0 [0058.114] lstrlenA (lpString="*.divx") returned 6 [0058.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.mkv") returned 0 [0058.114] lstrlenA (lpString="*.mkv") returned 5 [0058.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.mp3") returned 0 [0058.114] lstrlenA (lpString="*.mp3") returned 5 [0058.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.wav") returned 0 [0058.114] lstrlenA (lpString="*.wav") returned 5 [0058.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.flac") returned 0 [0058.114] lstrlenA (lpString="*.flac") returned 6 [0058.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.ape") returned 0 [0058.114] lstrlenA (lpString="*.ape") returned 5 [0058.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.wma") returned 0 [0058.114] lstrlenA (lpString="*.wma") returned 5 [0058.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", pszSpec="*.ac3") returned 0 [0058.115] lstrlenA (lpString="*.ac3") returned 5 [0058.115] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fad53c8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5fad53c8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5fad53c8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0058.115] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.115] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Ink.dll") returned -1 [0058.115] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Ink.dll") returned -1 [0058.115] lstrcmpiA (lpString1="", lpString2="Microsoft.Ink.dll") returned -1 [0058.115] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned="micaut.dll" [0058.115] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.115] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.115] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.115] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.115] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="Microsoft.Ink.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" [0058.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.zip") returned 0 [0058.115] lstrlenA (lpString="*.zip") returned 5 [0058.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.rar") returned 0 [0058.115] lstrlenA (lpString="*.rar") returned 5 [0058.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.7z") returned 0 [0058.115] lstrlenA (lpString="*.7z") returned 4 [0058.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.tar") returned 0 [0058.115] lstrlenA (lpString="*.tar") returned 5 [0058.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.gzip") returned 0 [0058.115] lstrlenA (lpString="*.gzip") returned 6 [0058.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.jpg") returned 0 [0058.115] lstrlenA (lpString="*.jpg") returned 5 [0058.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.jpeg") returned 0 [0058.115] lstrlenA (lpString="*.jpeg") returned 6 [0058.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.psd") returned 0 [0058.115] lstrlenA (lpString="*.psd") returned 5 [0058.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.cdr") returned 0 [0058.116] lstrlenA (lpString="*.cdr") returned 5 [0058.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.dwg") returned 0 [0058.116] lstrlenA (lpString="*.dwg") returned 5 [0058.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.max") returned 0 [0058.116] lstrlenA (lpString="*.max") returned 5 [0058.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.bmp") returned 0 [0058.116] lstrlenA (lpString="*.bmp") returned 5 [0058.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.gif") returned 0 [0058.116] lstrlenA (lpString="*.gif") returned 5 [0058.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.png") returned 0 [0058.116] lstrlenA (lpString="*.png") returned 5 [0058.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.doc") returned 0 [0058.116] lstrlenA (lpString="*.doc") returned 5 [0058.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.docx") returned 0 [0058.116] lstrlenA (lpString="*.docx") returned 6 [0058.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.xls") returned 0 [0058.116] lstrlenA (lpString="*.xls") returned 5 [0058.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.xlsx") returned 0 [0058.116] lstrlenA (lpString="*.xlsx") returned 6 [0058.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.ppt") returned 0 [0058.116] lstrlenA (lpString="*.ppt") returned 5 [0058.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.pptx") returned 0 [0058.116] lstrlenA (lpString="*.pptx") returned 6 [0058.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.txt") returned 0 [0058.116] lstrlenA (lpString="*.txt") returned 5 [0058.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.pdf") returned 0 [0058.116] lstrlenA (lpString="*.pdf") returned 5 [0058.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.djvu") returned 0 [0058.116] lstrlenA (lpString="*.djvu") returned 6 [0058.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.htm") returned 0 [0058.116] lstrlenA (lpString="*.htm") returned 5 [0058.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.html") returned 0 [0058.116] lstrlenA (lpString="*.html") returned 6 [0058.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.mdb") returned 0 [0058.116] lstrlenA (lpString="*.mdb") returned 5 [0058.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.cer") returned 0 [0058.117] lstrlenA (lpString="*.cer") returned 5 [0058.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.p12") returned 0 [0058.117] lstrlenA (lpString="*.p12") returned 5 [0058.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.pfx") returned 0 [0058.117] lstrlenA (lpString="*.pfx") returned 5 [0058.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.kwm") returned 0 [0058.117] lstrlenA (lpString="*.kwm") returned 5 [0058.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.pwm") returned 0 [0058.117] lstrlenA (lpString="*.pwm") returned 5 [0058.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.1cd") returned 0 [0058.117] lstrlenA (lpString="*.1cd") returned 5 [0058.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.md") returned 0 [0058.117] lstrlenA (lpString="*.md") returned 4 [0058.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.mdf") returned 0 [0058.117] lstrlenA (lpString="*.mdf") returned 5 [0058.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.dbf") returned 0 [0058.117] lstrlenA (lpString="*.dbf") returned 5 [0058.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.odt") returned 0 [0058.117] lstrlenA (lpString="*.odt") returned 5 [0058.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.vob") returned 0 [0058.117] lstrlenA (lpString="*.vob") returned 5 [0058.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.ifo") returned 0 [0058.117] lstrlenA (lpString="*.ifo") returned 5 [0058.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.lnk") returned 0 [0058.117] lstrlenA (lpString="*.lnk") returned 5 [0058.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.torrent") returned 0 [0058.117] lstrlenA (lpString="*.torrent") returned 9 [0058.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.mov") returned 0 [0058.117] lstrlenA (lpString="*.mov") returned 5 [0058.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.m2v") returned 0 [0058.117] lstrlenA (lpString="*.m2v") returned 5 [0058.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.3gp") returned 0 [0058.118] lstrlenA (lpString="*.3gp") returned 5 [0058.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.mpeg") returned 0 [0058.118] lstrlenA (lpString="*.mpeg") returned 6 [0058.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.mpg") returned 0 [0058.118] lstrlenA (lpString="*.mpg") returned 5 [0058.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.flv") returned 0 [0058.118] lstrlenA (lpString="*.flv") returned 5 [0058.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.avi") returned 0 [0058.118] lstrlenA (lpString="*.avi") returned 5 [0058.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.mp4") returned 0 [0058.118] lstrlenA (lpString="*.mp4") returned 5 [0058.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.wmv") returned 0 [0058.118] lstrlenA (lpString="*.wmv") returned 5 [0058.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.divx") returned 0 [0058.118] lstrlenA (lpString="*.divx") returned 6 [0058.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.mkv") returned 0 [0058.118] lstrlenA (lpString="*.mkv") returned 5 [0058.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.mp3") returned 0 [0058.118] lstrlenA (lpString="*.mp3") returned 5 [0058.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.wav") returned 0 [0058.118] lstrlenA (lpString="*.wav") returned 5 [0058.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.flac") returned 0 [0058.118] lstrlenA (lpString="*.flac") returned 6 [0058.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.ape") returned 0 [0058.118] lstrlenA (lpString="*.ape") returned 5 [0058.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.wma") returned 0 [0058.118] lstrlenA (lpString="*.wma") returned 5 [0058.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", pszSpec="*.ac3") returned 0 [0058.118] lstrlenA (lpString="*.ac3") returned 5 [0058.118] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5851d393, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5daeeef5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5db87a6d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x183e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0058.118] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.118] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mip.exe") returned -1 [0058.118] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mip.exe") returned -1 [0058.119] lstrcmpiA (lpString1="", lpString2="mip.exe") returned -1 [0058.119] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned="Microsoft.Ink.dll" [0058.119] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.119] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.119] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.119] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.119] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="mip.exe" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" [0058.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe", pszSpec="*.zip") returned 0 [0058.119] lstrlenA (lpString="*.zip") returned 5 [0058.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe", pszSpec="*.rar") returned 0 [0058.119] lstrlenA (lpString="*.rar") returned 5 [0058.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe", pszSpec="*.7z") returned 0 [0058.119] lstrlenA (lpString="*.7z") returned 4 [0058.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe", pszSpec="*.tar") returned 0 [0058.119] lstrlenA (lpString="*.tar") returned 5 [0058.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe", pszSpec="*.gzip") returned 0 [0058.119] lstrlenA (lpString="*.gzip") returned 6 [0058.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe", pszSpec="*.jpg") returned 0 [0058.119] lstrlenA (lpString="*.jpg") returned 5 [0058.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe", pszSpec="*.jpeg") returned 0 [0058.119] lstrlenA (lpString="*.jpeg") returned 6 [0058.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe", pszSpec="*.psd") returned 0 [0058.119] lstrlenA (lpString="*.psd") returned 5 [0058.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe", pszSpec="*.cdr") returned 0 [0058.119] lstrlenA (lpString="*.cdr") returned 5 [0058.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe", pszSpec="*.dwg") returned 0 [0058.119] lstrlenA (lpString="*.dwg") returned 5 [0058.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe", pszSpec="*.max") returned 0 [0058.119] lstrlenA (lpString="*.max") returned 5 [0058.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe", pszSpec="*.bmp") returned 0 [0058.119] lstrlenA (lpString="*.bmp") returned 5 [0058.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe", pszSpec="*.gif") returned 0 [0058.120] lstrlenA (lpString="*.gif") returned 5 [0058.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe", pszSpec="*.png") returned 0 [0058.120] lstrlenA (lpString="*.png") returned 5 [0058.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe", pszSpec="*.doc") returned 0 [0058.120] lstrlenA (lpString="*.doc") returned 5 [0058.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe", pszSpec="*.docx") returned 0 [0058.120] lstrlenA (lpString="*.docx") returned 6 [0058.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe", pszSpec="*.xls") returned 0 [0058.120] lstrlenA (lpString="*.xls") returned 5 [0058.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe", pszSpec="*.xlsx") returned 0 [0058.120] lstrlenA (lpString="*.xlsx") returned 6 [0058.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe", pszSpec="*.ppt") returned 0 [0058.120] lstrlenA (lpString="*.ppt") returned 5 [0058.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe", pszSpec="*.pptx") returned 0 [0058.120] lstrlenA (lpString="*.pptx") returned 6 [0058.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe", pszSpec="*.txt") returned 0 [0058.120] lstrlenA (lpString="*.txt") returned 5 [0058.120] lstrlenA (lpString="*.pdf") returned 5 [0058.120] lstrlenA (lpString="*.djvu") returned 6 [0058.120] lstrlenA (lpString="*.htm") returned 5 [0058.120] lstrlenA (lpString="*.html") returned 6 [0058.121] lstrlenA (lpString="*.mdb") returned 5 [0058.121] lstrlenA (lpString="*.cer") returned 5 [0058.121] lstrlenA (lpString="*.p12") returned 5 [0058.121] lstrlenA (lpString="*.pfx") returned 5 [0058.121] lstrlenA (lpString="*.kwm") returned 5 [0058.121] lstrlenA (lpString="*.pwm") returned 5 [0058.121] lstrlenA (lpString="*.1cd") returned 5 [0058.121] lstrlenA (lpString="*.md") returned 4 [0058.121] lstrlenA (lpString="*.mdf") returned 5 [0058.121] lstrlenA (lpString="*.dbf") returned 5 [0058.121] lstrlenA (lpString="*.odt") returned 5 [0058.121] lstrlenA (lpString="*.vob") returned 5 [0058.121] lstrlenA (lpString="*.ifo") returned 5 [0058.121] lstrlenA (lpString="*.lnk") returned 5 [0058.121] lstrlenA (lpString="*.torrent") returned 9 [0058.121] lstrlenA (lpString="*.mov") returned 5 [0058.121] lstrlenA (lpString="*.m2v") returned 5 [0058.121] lstrlenA (lpString="*.3gp") returned 5 [0058.121] lstrlenA (lpString="*.mpeg") returned 6 [0058.121] lstrlenA (lpString="*.mpg") returned 5 [0058.121] lstrlenA (lpString="*.flv") returned 5 [0058.121] lstrlenA (lpString="*.avi") returned 5 [0058.122] lstrlenA (lpString="*.mp4") returned 5 [0058.122] lstrlenA (lpString="*.wmv") returned 5 [0058.122] lstrlenA (lpString="*.divx") returned 6 [0058.122] lstrlenA (lpString="*.mkv") returned 5 [0058.122] lstrlenA (lpString="*.mp3") returned 5 [0058.122] lstrlenA (lpString="*.wav") returned 5 [0058.122] lstrlenA (lpString="*.flac") returned 6 [0058.122] lstrlenA (lpString="*.ape") returned 5 [0058.122] lstrlenA (lpString="*.wma") returned 5 [0058.122] lstrlenA (lpString="*.ac3") returned 5 [0058.122] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.122] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mraut.dll") returned -1 [0058.122] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mraut.dll") returned -1 [0058.122] lstrcmpiA (lpString1="", lpString2="mraut.dll") returned -1 [0058.122] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned="mip.exe" [0058.122] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.122] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.122] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.122] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.122] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="mraut.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" [0058.122] lstrlenA (lpString="*.zip") returned 5 [0058.122] lstrlenA (lpString="*.rar") returned 5 [0058.122] lstrlenA (lpString="*.7z") returned 4 [0058.122] lstrlenA (lpString="*.tar") returned 5 [0058.122] lstrlenA (lpString="*.gzip") returned 6 [0058.123] lstrlenA (lpString="*.jpg") returned 5 [0058.123] lstrlenA (lpString="*.jpeg") returned 6 [0058.123] lstrlenA (lpString="*.psd") returned 5 [0058.123] lstrlenA (lpString="*.cdr") returned 5 [0058.123] lstrlenA (lpString="*.dwg") returned 5 [0058.123] lstrlenA (lpString="*.max") returned 5 [0058.123] lstrlenA (lpString="*.bmp") returned 5 [0058.123] lstrlenA (lpString="*.gif") returned 5 [0058.123] lstrlenA (lpString="*.png") returned 5 [0058.123] lstrlenA (lpString="*.doc") returned 5 [0058.123] lstrlenA (lpString="*.docx") returned 6 [0058.123] lstrlenA (lpString="*.xls") returned 5 [0058.123] lstrlenA (lpString="*.xlsx") returned 6 [0058.123] lstrlenA (lpString="*.ppt") returned 5 [0058.123] lstrlenA (lpString="*.pptx") returned 6 [0058.123] lstrlenA (lpString="*.txt") returned 5 [0058.123] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.123] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mshwgst.dll") returned -1 [0058.123] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mshwgst.dll") returned -1 [0058.123] lstrcmpiA (lpString1="", lpString2="mshwgst.dll") returned -1 [0058.123] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned="mraut.dll" [0058.123] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.123] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.123] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.124] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.124] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="mshwgst.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" [0058.124] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.124] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mshwLatin.dll") returned -1 [0058.124] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mshwLatin.dll") returned -1 [0058.124] lstrcmpiA (lpString1="", lpString2="mshwLatin.dll") returned -1 [0058.124] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned="mshwgst.dll" [0058.124] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.124] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.124] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.124] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.124] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="mshwLatin.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" [0058.124] lstrcmpA (lpString1=".", lpString2="nb-NO") returned -1 [0058.124] lstrcmpA (lpString1="..", lpString2="nb-NO") returned -1 [0058.124] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned="mshwLatin.dll" [0058.124] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="nb-NO" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO" [0058.140] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.140] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.140] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.140] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.140] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.141] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.141] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.141] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\*.*") returned="*.*" [0058.141] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\" [0058.141] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\") returned="" [0058.141] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\HOW TO DECRYPT FILES.txt" [0058.141] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\how to decrypt files.txt")) returned 0xffffffff [0058.141] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.143] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.143] CloseHandle (hObject=0x1d0) returned 1 [0058.144] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" [0058.144] lstrcmpA (lpString1=".", lpString2="nl-NL") returned -1 [0058.144] lstrcmpA (lpString1="..", lpString2="nl-NL") returned -1 [0058.144] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0058.144] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="nl-NL" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL" [0058.144] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.144] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.144] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.145] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.145] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.145] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.145] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.145] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\*.*") returned="*.*" [0058.145] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\" [0058.145] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\") returned="" [0058.145] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\HOW TO DECRYPT FILES.txt" [0058.145] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\how to decrypt files.txt")) returned 0xffffffff [0058.145] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.146] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.147] CloseHandle (hObject=0x1d0) returned 1 [0058.147] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" [0058.150] lstrcmpA (lpString1=".", lpString2="pl-PL") returned -1 [0058.150] lstrcmpA (lpString1="..", lpString2="pl-PL") returned -1 [0058.150] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0058.150] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="pl-PL" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL" [0058.150] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.150] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.150] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.150] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.150] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.150] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.150] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.150] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\*.*") returned="*.*" [0058.151] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\" [0058.151] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\") returned="" [0058.151] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\HOW TO DECRYPT FILES.txt" [0058.151] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\how to decrypt files.txt")) returned 0xffffffff [0058.151] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.152] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" [0058.152] lstrcmpA (lpString1=".", lpString2="pt-BR") returned -1 [0058.152] lstrcmpA (lpString1="..", lpString2="pt-BR") returned -1 [0058.152] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0058.152] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="pt-BR" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR" [0058.154] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.154] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.154] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.154] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.154] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.154] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.154] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.154] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\*.*") returned="*.*" [0058.154] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\" [0058.154] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\") returned="" [0058.155] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\HOW TO DECRYPT FILES.txt" [0058.155] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\how to decrypt files.txt")) returned 0xffffffff [0058.155] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.156] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" [0058.156] lstrcmpA (lpString1=".", lpString2="pt-PT") returned -1 [0058.156] lstrcmpA (lpString1="..", lpString2="pt-PT") returned -1 [0058.156] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0058.156] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="pt-PT" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT" [0058.156] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.156] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.156] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.156] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.156] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.156] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.157] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.157] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\*.*") returned="*.*" [0058.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\" [0058.157] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\") returned="" [0058.157] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\HOW TO DECRYPT FILES.txt" [0058.157] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\how to decrypt files.txt")) returned 0xffffffff [0058.157] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.158] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" [0058.158] lstrcmpA (lpString1=".", lpString2="ro-RO") returned -1 [0058.158] lstrcmpA (lpString1="..", lpString2="ro-RO") returned -1 [0058.158] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0058.158] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ro-RO" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO" [0058.159] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.159] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.159] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.159] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.159] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.159] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.159] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.159] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\*.*") returned="*.*" [0058.159] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\" [0058.159] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\") returned="" [0058.159] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\HOW TO DECRYPT FILES.txt" [0058.159] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\how to decrypt files.txt")) returned 0xffffffff [0058.159] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.161] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" [0058.161] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.161] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtscom.dll") returned -1 [0058.161] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtscom.dll") returned -1 [0058.161] lstrcmpiA (lpString1="", lpString2="rtscom.dll") returned -1 [0058.161] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0058.161] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.161] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.161] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.161] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.161] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="rtscom.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" [0058.161] lstrcmpA (lpString1=".", lpString2="ru-RU") returned -1 [0058.162] lstrcmpA (lpString1="..", lpString2="ru-RU") returned -1 [0058.162] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned="rtscom.dll" [0058.162] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ru-RU" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU" [0058.162] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.162] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.162] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.162] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.162] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.162] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.162] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.162] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\*.*") returned="*.*" [0058.162] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\" [0058.162] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\") returned="" [0058.162] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\HOW TO DECRYPT FILES.txt" [0058.162] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\how to decrypt files.txt")) returned 0xffffffff [0058.162] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.164] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" [0058.165] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.165] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ShapeCollector.exe") returned -1 [0058.165] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ShapeCollector.exe") returned -1 [0058.165] lstrcmpiA (lpString1="", lpString2="ShapeCollector.exe") returned -1 [0058.165] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0058.165] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.165] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.165] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.165] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.165] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ShapeCollector.exe" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" [0058.165] lstrcmpA (lpString1=".", lpString2="sk-SK") returned -1 [0058.165] lstrcmpA (lpString1="..", lpString2="sk-SK") returned -1 [0058.165] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned="ShapeCollector.exe" [0058.165] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="sk-SK" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK" [0058.166] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.166] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.166] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.166] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.166] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.166] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.166] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.166] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\*.*") returned="*.*" [0058.166] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\" [0058.167] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\") returned="" [0058.167] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\HOW TO DECRYPT FILES.txt" [0058.167] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\how to decrypt files.txt")) returned 0xffffffff [0058.167] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.168] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" [0058.168] lstrcmpA (lpString1=".", lpString2="sl-SI") returned -1 [0058.168] lstrcmpA (lpString1="..", lpString2="sl-SI") returned -1 [0058.168] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0058.168] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="sl-SI" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI" [0058.169] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.169] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.169] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.169] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.169] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.169] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.169] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.169] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\*.*") returned="*.*" [0058.169] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\" [0058.169] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\") returned="" [0058.169] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\HOW TO DECRYPT FILES.txt" [0058.169] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\how to decrypt files.txt")) returned 0xffffffff [0058.169] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.170] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" [0058.171] lstrcmpA (lpString1=".", lpString2="sr-Latn-CS") returned -1 [0058.171] lstrcmpA (lpString1="..", lpString2="sr-Latn-CS") returned -1 [0058.171] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0058.171] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="sr-Latn-CS" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-CS") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-CS" [0058.171] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.171] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.171] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.171] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.171] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.171] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.171] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.171] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-CS\\*.*") returned="*.*" [0058.171] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-CS\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-CS\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-CS\\" [0058.171] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-CS\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-CS\\") returned="" [0058.171] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-CS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-CS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-CS\\HOW TO DECRYPT FILES.txt" [0058.171] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-CS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\how to decrypt files.txt")) returned 0xffffffff [0058.171] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-CS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.173] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-CS\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-CS\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" [0058.173] lstrcmpA (lpString1=".", lpString2="sr-Latn-RS") returned -1 [0058.173] lstrcmpA (lpString1="..", lpString2="sr-Latn-RS") returned -1 [0058.173] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0058.173] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="sr-Latn-RS" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS" [0058.173] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.174] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.174] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.174] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.174] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.174] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.174] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.174] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\*.*") returned="*.*" [0058.174] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\" [0058.174] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\") returned="" [0058.174] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\HOW TO DECRYPT FILES.txt" [0058.174] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\how to decrypt files.txt")) returned 0xffffffff [0058.174] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.176] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" [0058.176] lstrcmpA (lpString1=".", lpString2="sv-SE") returned -1 [0058.176] lstrcmpA (lpString1="..", lpString2="sv-SE") returned -1 [0058.176] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0058.176] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="sv-SE" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE" [0058.201] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.201] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.201] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.201] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.201] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.201] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.201] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.201] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\*.*") returned="*.*" [0058.201] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\" [0058.201] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\") returned="" [0058.201] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\HOW TO DECRYPT FILES.txt" [0058.201] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\how to decrypt files.txt")) returned 0xffffffff [0058.201] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.203] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" [0058.203] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.203] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TabIpsps.dll") returned -1 [0058.203] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TabIpsps.dll") returned -1 [0058.203] lstrcmpiA (lpString1="", lpString2="TabIpsps.dll") returned -1 [0058.203] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0058.203] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.203] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.203] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.203] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.203] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="TabIpsps.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" [0058.204] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.204] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tabskb.dll") returned -1 [0058.204] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tabskb.dll") returned -1 [0058.204] lstrcmpiA (lpString1="", lpString2="tabskb.dll") returned -1 [0058.204] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned="TabIpsps.dll" [0058.204] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.204] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.204] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.204] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.204] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="tabskb.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" [0058.204] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.204] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TabTip.exe") returned -1 [0058.204] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TabTip.exe") returned -1 [0058.204] lstrcmpiA (lpString1="", lpString2="TabTip.exe") returned -1 [0058.204] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned="tabskb.dll" [0058.204] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.204] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.204] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.204] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.204] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="TabTip.exe" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe" [0058.204] lstrcmpA (lpString1=".", lpString2="th-TH") returned -1 [0058.204] lstrcmpA (lpString1="..", lpString2="th-TH") returned -1 [0058.204] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe") returned="TabTip.exe" [0058.205] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="th-TH" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH" [0058.205] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.205] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.205] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.205] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.205] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.205] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.205] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.205] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\*.*") returned="*.*" [0058.205] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\" [0058.205] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\") returned="" [0058.205] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\HOW TO DECRYPT FILES.txt" [0058.205] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\how to decrypt files.txt")) returned 0xffffffff [0058.206] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.207] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" [0058.207] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.207] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TipRes.dll") returned -1 [0058.207] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipRes.dll") returned -1 [0058.207] lstrcmpiA (lpString1="", lpString2="TipRes.dll") returned -1 [0058.207] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0058.207] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.207] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.207] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.207] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.207] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="TipRes.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll" [0058.207] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.207] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll") returned -1 [0058.208] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll") returned -1 [0058.208] lstrcmpiA (lpString1="", lpString2="tipresx.dll") returned -1 [0058.208] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll") returned="TipRes.dll" [0058.208] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.208] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.208] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.208] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.208] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="tipresx.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll" [0058.208] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.208] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipskins.dll") returned -1 [0058.208] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipskins.dll") returned -1 [0058.208] lstrcmpiA (lpString1="", lpString2="tipskins.dll") returned -1 [0058.208] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll") returned="tipresx.dll" [0058.208] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.208] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.208] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.208] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.208] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="tipskins.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll" [0058.208] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.208] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tiptsf.dll") returned -1 [0058.208] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tiptsf.dll") returned -1 [0058.208] lstrcmpiA (lpString1="", lpString2="tiptsf.dll") returned -1 [0058.208] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll") returned="tipskins.dll" [0058.208] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.208] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.209] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.209] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.209] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="tiptsf.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll" [0058.209] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.209] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tpcps.dll") returned -1 [0058.209] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tpcps.dll") returned -1 [0058.209] lstrcmpiA (lpString1="", lpString2="tpcps.dll") returned -1 [0058.209] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll") returned="tiptsf.dll" [0058.209] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0058.209] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0058.209] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.209] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.209] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="tpcps.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll" [0058.209] lstrcmpA (lpString1=".", lpString2="tr-TR") returned -1 [0058.209] lstrcmpA (lpString1="..", lpString2="tr-TR") returned -1 [0058.209] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll") returned="tpcps.dll" [0058.209] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="tr-TR" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR" [0058.209] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.210] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.210] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.210] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.210] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.210] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.210] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.210] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\*.*") returned="*.*" [0058.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\" [0058.210] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\") returned="" [0058.210] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\HOW TO DECRYPT FILES.txt" [0058.210] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\how to decrypt files.txt")) returned 0xffffffff [0058.210] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.211] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui" [0058.211] lstrcmpA (lpString1=".", lpString2="uk-UA") returned -1 [0058.211] lstrcmpA (lpString1="..", lpString2="uk-UA") returned -1 [0058.211] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0058.211] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="uk-UA" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA" [0058.211] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.212] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.212] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.212] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.212] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.212] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.212] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.212] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\*.*") returned="*.*" [0058.212] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\" [0058.212] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\") returned="" [0058.212] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\HOW TO DECRYPT FILES.txt" [0058.212] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\how to decrypt files.txt")) returned 0xffffffff [0058.212] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.213] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" [0058.213] lstrcmpA (lpString1=".", lpString2="zh-CN") returned -1 [0058.213] lstrcmpA (lpString1="..", lpString2="zh-CN") returned -1 [0058.213] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0058.213] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="zh-CN" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN" [0058.214] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.214] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.214] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.214] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.214] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.214] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.215] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.215] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\*.*") returned="*.*" [0058.215] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\" [0058.215] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\") returned="" [0058.215] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\HOW TO DECRYPT FILES.txt" [0058.215] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\how to decrypt files.txt")) returned 0xffffffff [0058.215] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.216] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" [0058.216] lstrcmpA (lpString1=".", lpString2="zh-HK") returned -1 [0058.216] lstrcmpA (lpString1="..", lpString2="zh-HK") returned -1 [0058.216] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0058.216] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="zh-HK" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-HK") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-HK" [0058.216] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.216] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.216] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.216] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.216] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.216] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.217] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.217] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-HK\\*.*") returned="*.*" [0058.217] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-HK\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-HK\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-HK\\" [0058.217] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-HK\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-HK\\") returned="" [0058.217] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-HK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-HK\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-HK\\HOW TO DECRYPT FILES.txt" [0058.217] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-HK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-hk\\how to decrypt files.txt")) returned 0xffffffff [0058.217] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-HK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-hk\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.218] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-HK\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-HK\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-HK\\tipresx.dll.mui" [0058.218] lstrcmpA (lpString1=".", lpString2="zh-TW") returned -1 [0058.218] lstrcmpA (lpString1="..", lpString2="zh-TW") returned -1 [0058.218] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0058.218] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="zh-TW" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW" [0058.219] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.219] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.219] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.219] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.219] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.219] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.219] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.219] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\*.*") returned="*.*" [0058.219] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\" [0058.219] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\") returned="" [0058.219] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\HOW TO DECRYPT FILES.txt" [0058.219] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\how to decrypt files.txt")) returned 0xffffffff [0058.219] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.221] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" [0058.221] lstrcmpA (lpString1=".", lpString2="MSInfo") returned -1 [0058.221] lstrcmpA (lpString1="..", lpString2="MSInfo") returned -1 [0058.221] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\*.*") returned="*.*" [0058.221] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\", lpString2="MSInfo" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo") returned="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo" [0058.221] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.221] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.221] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.221] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0058.221] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0058.221] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\*.*") returned="*.*" [0058.221] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US") returned="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US" [0058.222] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.222] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.222] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.222] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.222] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msinfo32.exe.mui") returned -1 [0058.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msinfo32.exe.mui") returned -1 [0058.222] lstrcmpiA (lpString1="", lpString2="msinfo32.exe.mui") returned -1 [0058.222] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\*.*") returned="*.*" [0058.222] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\" [0058.222] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\") returned="" [0058.222] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\HOW TO DECRYPT FILES.txt" [0058.222] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0058.222] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.224] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\", lpString2="msinfo32.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" [0058.224] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.224] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msinfo32.exe") returned -1 [0058.224] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msinfo32.exe") returned -1 [0058.224] lstrcmpiA (lpString1="", lpString2="msinfo32.exe") returned -1 [0058.224] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\*.*") returned="*.*" [0058.224] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\" [0058.224] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\") returned="" [0058.224] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\HOW TO DECRYPT FILES.txt" [0058.224] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\how to decrypt files.txt")) returned 0xffffffff [0058.225] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0058.231] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\", lpString2="msinfo32.exe" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe") returned="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" [0058.232] lstrcmpA (lpString1=".", lpString2="OFFICE16") returned -1 [0058.232] lstrcmpA (lpString1="..", lpString2="OFFICE16") returned -1 [0058.232] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\*.*") returned="*.*" [0058.232] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\", lpString2="OFFICE16" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16" [0058.232] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.232] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.233] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.233] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.233] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CMigrate.exe") returned 1 [0058.233] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CMigrate.exe") returned 1 [0058.233] lstrcmpiA (lpString1="", lpString2="CMigrate.exe") returned -1 [0058.233] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\*.*") returned="*.*" [0058.233] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" [0058.233] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\") returned="" [0058.233] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\HOW TO DECRYPT FILES.txt" [0058.233] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\how to decrypt files.txt")) returned 0xffffffff [0058.233] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0058.247] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\", lpString2="CMigrate.exe" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\CMigrate.exe") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\CMigrate.exe" [0058.247] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.247] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Csi.dll") returned 1 [0058.247] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Csi.dll") returned 1 [0058.247] lstrcmpiA (lpString1="", lpString2="Csi.dll") returned -1 [0058.247] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\CMigrate.exe") returned="CMigrate.exe" [0058.247] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" [0058.247] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\") returned="" [0058.247] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\HOW TO DECRYPT FILES.txt" [0058.247] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\how to decrypt files.txt")) returned 0x20 [0058.247] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\", lpString2="Csi.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Csi.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Csi.dll" [0058.247] lstrcmpA (lpString1=".", lpString2="Cultures") returned -1 [0058.247] lstrcmpA (lpString1="..", lpString2="Cultures") returned -1 [0058.247] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Csi.dll") returned="Csi.dll" [0058.247] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\", lpString2="Cultures" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Cultures") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Cultures" [0058.248] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.248] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.248] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.248] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.248] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OFFICE.ODF") returned -1 [0058.248] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OFFICE.ODF") returned -1 [0058.248] lstrcmpiA (lpString1="", lpString2="OFFICE.ODF") returned -1 [0058.248] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Cultures\\*.*") returned="*.*" [0058.248] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Cultures\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Cultures\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Cultures\\" [0058.248] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Cultures\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Cultures\\") returned="" [0058.248] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Cultures\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Cultures\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Cultures\\HOW TO DECRYPT FILES.txt" [0058.248] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Cultures\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\cultures\\how to decrypt files.txt")) returned 0xffffffff [0058.248] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Cultures\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\cultures\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.250] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Cultures\\", lpString2="OFFICE.ODF" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Cultures\\OFFICE.ODF") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Cultures\\OFFICE.ODF" [0058.250] lstrcmpA (lpString1=".", lpString2="en-us") returned -1 [0058.251] lstrcmpA (lpString1="..", lpString2="en-us") returned -1 [0058.251] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\*.*") returned="*.*" [0058.251] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\", lpString2="en-us" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\en-us") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\en-us" [0058.251] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.251] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.251] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.251] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.251] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oregres.dll.mui") returned -1 [0058.251] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oregres.dll.mui") returned -1 [0058.251] lstrcmpiA (lpString1="", lpString2="oregres.dll.mui") returned -1 [0058.251] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\en-us\\*.*") returned="*.*" [0058.251] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\en-us\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\en-us\\" [0058.251] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\en-us\\") returned="" [0058.251] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\en-us\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\en-us\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\en-us\\HOW TO DECRYPT FILES.txt" [0058.251] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\en-us\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0058.251] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\en-us\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.253] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\en-us\\", lpString2="oregres.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\en-us\\oregres.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\en-us\\oregres.dll.mui" [0058.253] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.253] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Mso20win32client.dll") returned -1 [0058.253] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Mso20win32client.dll") returned -1 [0058.253] lstrcmpiA (lpString1="", lpString2="Mso20win32client.dll") returned -1 [0058.253] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\*.*") returned="*.*" [0058.253] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" [0058.253] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\") returned="" [0058.253] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\HOW TO DECRYPT FILES.txt" [0058.253] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\how to decrypt files.txt")) returned 0x20 [0058.253] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\", lpString2="Mso20win32client.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Mso20win32client.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Mso20win32client.dll" [0058.253] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.253] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Mso30win32client.dll") returned -1 [0058.253] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Mso30win32client.dll") returned -1 [0058.253] lstrcmpiA (lpString1="", lpString2="Mso30win32client.dll") returned -1 [0058.253] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Mso20win32client.dll") returned="Mso20win32client.dll" [0058.254] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" [0058.254] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\") returned="" [0058.254] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\HOW TO DECRYPT FILES.txt" [0058.254] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\how to decrypt files.txt")) returned 0x20 [0058.254] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.254] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Mso40UIwin32client.dll") returned -1 [0058.254] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Mso40UIwin32client.dll") returned -1 [0058.254] lstrcmpiA (lpString1="", lpString2="Mso40UIwin32client.dll") returned -1 [0058.254] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Mso30win32client.dll") returned="Mso30win32client.dll" [0058.254] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" [0058.254] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\") returned="" [0058.254] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.254] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Mso99Lwin32client.dll") returned -1 [0058.254] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Mso99Lwin32client.dll") returned -1 [0058.254] lstrcmpiA (lpString1="", lpString2="Mso99Lwin32client.dll") returned -1 [0058.254] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Mso40UIwin32client.dll") returned="Mso40UIwin32client.dll" [0058.254] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" [0058.254] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\") returned="" [0058.255] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.255] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msoshext.dll") returned -1 [0058.255] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msoshext.dll") returned -1 [0058.255] lstrcmpiA (lpString1="", lpString2="msoshext.dll") returned -1 [0058.255] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Mso99Lwin32client.dll") returned="Mso99Lwin32client.dll" [0058.255] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" [0058.255] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\") returned="" [0058.255] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.255] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOXEV.DLL") returned -1 [0058.255] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOXEV.DLL") returned -1 [0058.255] lstrcmpiA (lpString1="", lpString2="MSOXEV.DLL") returned -1 [0058.255] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\msoshext.dll") returned="msoshext.dll" [0058.255] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" [0058.255] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\") returned="" [0058.255] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.255] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOXMLED.EXE") returned -1 [0058.256] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOXMLED.EXE") returned -1 [0058.256] lstrcmpiA (lpString1="", lpString2="MSOXMLED.EXE") returned -1 [0058.256] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\MSOXEV.DLL") returned="MSOXEV.DLL" [0058.256] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" [0058.256] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\") returned="" [0058.256] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.256] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOXMLMF.DLL") returned -1 [0058.256] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOXMLMF.DLL") returned -1 [0058.256] lstrcmpiA (lpString1="", lpString2="MSOXMLMF.DLL") returned -1 [0058.256] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\MSOXMLED.EXE") returned="MSOXMLED.EXE" [0058.256] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" [0058.256] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\") returned="" [0058.256] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.256] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oregres.dll") returned -1 [0058.256] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oregres.dll") returned -1 [0058.256] lstrcmpiA (lpString1="", lpString2="oregres.dll") returned -1 [0058.256] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\MSOXMLMF.DLL") returned="MSOXMLMF.DLL" [0058.256] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" [0058.256] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\") returned="" [0058.257] lstrcmpA (lpString1=".", lpString2="Stationery") returned -1 [0058.257] lstrcmpA (lpString1="..", lpString2="Stationery") returned -1 [0058.257] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\*.*") returned="*.*" [0058.258] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.259] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.259] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.259] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.259] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Bears.htm") returned 1 [0058.259] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Bears.htm") returned 1 [0058.259] lstrcmpiA (lpString1="", lpString2="Bears.htm") returned -1 [0058.259] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\*.*") returned="*.*" [0058.259] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.259] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.261] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" [0058.261] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" [0058.262] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.262] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Bears.jpg") returned 1 [0058.262] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Bears.jpg") returned 1 [0058.262] lstrcmpiA (lpString1="", lpString2="Bears.jpg") returned -1 [0058.262] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned="Bears.htm" [0058.262] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.262] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.262] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" [0058.262] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" [0058.262] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.262] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Blue_Gradient.jpg") returned 1 [0058.262] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Blue_Gradient.jpg") returned 1 [0058.262] lstrcmpiA (lpString1="", lpString2="Blue_Gradient.jpg") returned -1 [0058.262] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned="Bears.jpg" [0058.262] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.263] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.263] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Blue_Gradient.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Blue_Gradient.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Blue_Gradient.jpg" [0058.263] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Blue_Gradient.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Blue_Gradient.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Blue_Gradient.jpg" [0058.263] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.263] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Cave_Drawings.gif") returned 1 [0058.263] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Cave_Drawings.gif") returned 1 [0058.263] lstrcmpiA (lpString1="", lpString2="Cave_Drawings.gif") returned -1 [0058.263] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Blue_Gradient.jpg") returned="Blue_Gradient.jpg" [0058.263] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.263] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.263] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Cave_Drawings.gif" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Cave_Drawings.gif") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Cave_Drawings.gif" [0058.263] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Cave_Drawings.gif" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Cave_Drawings.gif") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Cave_Drawings.gif" [0058.264] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.264] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Connectivity.gif") returned 1 [0058.264] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Connectivity.gif") returned 1 [0058.264] lstrcmpiA (lpString1="", lpString2="Connectivity.gif") returned -1 [0058.264] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Cave_Drawings.gif") returned="Cave_Drawings.gif" [0058.264] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.264] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.264] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Connectivity.gif" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Connectivity.gif") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Connectivity.gif" [0058.264] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Connectivity.gif" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Connectivity.gif") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Connectivity.gif" [0058.264] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.264] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Desktop.ini") returned 1 [0058.264] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Desktop.ini") returned 1 [0058.264] lstrcmpiA (lpString1="", lpString2="Desktop.ini") returned -1 [0058.264] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Connectivity.gif") returned="Connectivity.gif" [0058.264] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.264] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.265] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.265] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Dotted_Lines.emf") returned 1 [0058.265] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Dotted_Lines.emf") returned 1 [0058.265] lstrcmpiA (lpString1="", lpString2="Dotted_Lines.emf") returned -1 [0058.265] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned="Desktop.ini" [0058.265] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.265] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.265] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.265] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Garden.htm") returned -1 [0058.265] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Garden.htm") returned 1 [0058.265] lstrcmpiA (lpString1="", lpString2="Garden.htm") returned -1 [0058.265] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Dotted_Lines.emf") returned="Dotted_Lines.emf" [0058.265] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.265] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.265] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" [0058.265] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" [0058.266] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.266] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Garden.jpg") returned -1 [0058.266] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Garden.jpg") returned 1 [0058.266] lstrcmpiA (lpString1="", lpString2="Garden.jpg") returned -1 [0058.266] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned="Garden.htm" [0058.266] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.266] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.266] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" [0058.266] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" [0058.267] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.267] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Genko_1.emf") returned -1 [0058.267] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Genko_1.emf") returned 1 [0058.267] lstrcmpiA (lpString1="", lpString2="Genko_1.emf") returned -1 [0058.267] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned="Garden.jpg" [0058.267] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.267] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.267] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.267] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Genko_2.emf") returned -1 [0058.267] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Genko_2.emf") returned 1 [0058.267] lstrcmpiA (lpString1="", lpString2="Genko_2.emf") returned -1 [0058.267] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Genko_1.emf") returned="Genko_1.emf" [0058.267] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.267] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.268] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.268] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Graph.emf") returned -1 [0058.268] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Graph.emf") returned 1 [0058.268] lstrcmpiA (lpString1="", lpString2="Graph.emf") returned -1 [0058.268] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Genko_2.emf") returned="Genko_2.emf" [0058.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.268] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.268] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.268] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Green Bubbles.htm") returned -1 [0058.268] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Green Bubbles.htm") returned 1 [0058.268] lstrcmpiA (lpString1="", lpString2="Green Bubbles.htm") returned -1 [0058.268] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Graph.emf") returned="Graph.emf" [0058.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.268] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.268] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" [0058.268] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" [0058.269] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.269] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GreenBubbles.jpg") returned -1 [0058.269] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GreenBubbles.jpg") returned 1 [0058.269] lstrcmpiA (lpString1="", lpString2="GreenBubbles.jpg") returned -1 [0058.269] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned="Green Bubbles.htm" [0058.269] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.269] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.269] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" [0058.269] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" [0058.270] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.270] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="grid_(cm).wmf") returned -1 [0058.270] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="grid_(cm).wmf") returned 1 [0058.270] lstrcmpiA (lpString1="", lpString2="grid_(cm).wmf") returned -1 [0058.270] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned="GreenBubbles.jpg" [0058.270] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.270] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.270] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.270] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="grid_(inch).wmf") returned -1 [0058.270] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="grid_(inch).wmf") returned 1 [0058.270] lstrcmpiA (lpString1="", lpString2="grid_(inch).wmf") returned -1 [0058.271] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\grid_(cm).wmf") returned="grid_(cm).wmf" [0058.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.271] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.271] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.271] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Hand Prints.htm") returned -1 [0058.271] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Hand Prints.htm") returned 1 [0058.271] lstrcmpiA (lpString1="", lpString2="Hand Prints.htm") returned -1 [0058.271] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\grid_(inch).wmf") returned="grid_(inch).wmf" [0058.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.271] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.271] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" [0058.271] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" [0058.271] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.271] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HandPrints.jpg") returned -1 [0058.271] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HandPrints.jpg") returned 1 [0058.271] lstrcmpiA (lpString1="", lpString2="HandPrints.jpg") returned -1 [0058.271] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned="Hand Prints.htm" [0058.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.271] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.271] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" [0058.271] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" [0058.272] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.272] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Memo.emf") returned -1 [0058.272] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Memo.emf") returned -1 [0058.272] lstrcmpiA (lpString1="", lpString2="Memo.emf") returned -1 [0058.272] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned="HandPrints.jpg" [0058.272] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.272] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.272] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.272] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Monet.jpg") returned -1 [0058.272] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Monet.jpg") returned -1 [0058.272] lstrcmpiA (lpString1="", lpString2="Monet.jpg") returned -1 [0058.272] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Memo.emf") returned="Memo.emf" [0058.272] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.273] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.273] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Monet.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Monet.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Monet.jpg" [0058.273] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Monet.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Monet.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Monet.jpg" [0058.273] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.273] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Month_Calendar.emf") returned -1 [0058.273] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Month_Calendar.emf") returned -1 [0058.273] lstrcmpiA (lpString1="", lpString2="Month_Calendar.emf") returned -1 [0058.273] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Monet.jpg") returned="Monet.jpg" [0058.273] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.273] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.273] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.305] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Music.emf") returned -1 [0058.305] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Music.emf") returned -1 [0058.305] lstrcmpiA (lpString1="", lpString2="Music.emf") returned -1 [0058.306] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Month_Calendar.emf") returned="Month_Calendar.emf" [0058.306] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.306] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.306] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.306] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Notebook.jpg") returned -1 [0058.306] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Notebook.jpg") returned -1 [0058.306] lstrcmpiA (lpString1="", lpString2="Notebook.jpg") returned -1 [0058.306] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Music.emf") returned="Music.emf" [0058.306] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.306] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.306] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Notebook.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Notebook.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Notebook.jpg" [0058.306] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Notebook.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Notebook.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Notebook.jpg" [0058.307] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.307] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Orange Circles.htm") returned -1 [0058.307] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Orange Circles.htm") returned -1 [0058.307] lstrcmpiA (lpString1="", lpString2="Orange Circles.htm") returned -1 [0058.307] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Notebook.jpg") returned="Notebook.jpg" [0058.307] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.307] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.307] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" [0058.307] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" [0058.307] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.307] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OrangeCircles.jpg") returned -1 [0058.307] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OrangeCircles.jpg") returned -1 [0058.307] lstrcmpiA (lpString1="", lpString2="OrangeCircles.jpg") returned -1 [0058.307] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned="Orange Circles.htm" [0058.307] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.307] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.308] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" [0058.308] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" [0058.308] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.308] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Peacock.htm") returned -1 [0058.308] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Peacock.htm") returned -1 [0058.308] lstrcmpiA (lpString1="", lpString2="Peacock.htm") returned -1 [0058.308] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned="OrangeCircles.jpg" [0058.308] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.308] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.308] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" [0058.309] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" [0058.309] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.309] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Peacock.jpg") returned -1 [0058.309] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Peacock.jpg") returned -1 [0058.309] lstrcmpiA (lpString1="", lpString2="Peacock.jpg") returned -1 [0058.309] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned="Peacock.htm" [0058.309] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.309] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.309] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" [0058.309] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" [0058.310] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.310] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Pine_Lumber.jpg") returned -1 [0058.310] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Pine_Lumber.jpg") returned -1 [0058.310] lstrcmpiA (lpString1="", lpString2="Pine_Lumber.jpg") returned -1 [0058.310] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned="Peacock.jpg" [0058.310] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.310] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.310] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Pine_Lumber.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Pine_Lumber.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Pine_Lumber.jpg" [0058.310] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Pine_Lumber.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Pine_Lumber.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Pine_Lumber.jpg" [0058.310] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.310] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Pretty_Peacock.jpg") returned -1 [0058.311] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Pretty_Peacock.jpg") returned -1 [0058.311] lstrcmpiA (lpString1="", lpString2="Pretty_Peacock.jpg") returned -1 [0058.311] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.311] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.311] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Pretty_Peacock.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Pretty_Peacock.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Pretty_Peacock.jpg" [0058.311] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Pretty_Peacock.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Pretty_Peacock.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Pretty_Peacock.jpg" [0058.311] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.311] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Psychedelic.jpg") returned -1 [0058.311] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Psychedelic.jpg") returned -1 [0058.311] lstrcmpiA (lpString1="", lpString2="Psychedelic.jpg") returned -1 [0058.311] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.311] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.311] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Psychedelic.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Psychedelic.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Psychedelic.jpg" [0058.311] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Psychedelic.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Psychedelic.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Psychedelic.jpg" [0058.311] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.311] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Roses.htm") returned -1 [0058.311] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Roses.htm") returned -1 [0058.311] lstrcmpiA (lpString1="", lpString2="Roses.htm") returned -1 [0058.311] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.311] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.312] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" [0058.312] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" [0058.312] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.312] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Roses.jpg") returned -1 [0058.312] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Roses.jpg") returned -1 [0058.312] lstrcmpiA (lpString1="", lpString2="Roses.jpg") returned -1 [0058.312] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.312] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.312] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" [0058.312] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" [0058.312] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.312] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Sand_Paper.jpg") returned -1 [0058.312] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Sand_Paper.jpg") returned -1 [0058.312] lstrcmpiA (lpString1="", lpString2="Sand_Paper.jpg") returned -1 [0058.312] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.312] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.312] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Sand_Paper.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Sand_Paper.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Sand_Paper.jpg" [0058.312] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Sand_Paper.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Sand_Paper.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Sand_Paper.jpg" [0058.312] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.312] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.313] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.313] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.313] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.313] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.313] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" [0058.313] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" [0058.313] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.314] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.314] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.314] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" [0058.314] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" [0058.314] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.314] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.315] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.315] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.315] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.315] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.315] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Small_News.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Small_News.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Small_News.jpg" [0058.315] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Small_News.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Small_News.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Small_News.jpg" [0058.315] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.315] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.315] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.315] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" [0058.315] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" [0058.315] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.315] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.315] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.315] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" [0058.315] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" [0058.316] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.316] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.316] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.316] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" [0058.316] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" [0058.317] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.317] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.317] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.317] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" [0058.317] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" [0058.318] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.318] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.318] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.318] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stucco.gif" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stucco.gif") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stucco.gif" [0058.318] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stucco.gif" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stucco.gif") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stucco.gif" [0058.318] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.318] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.318] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.318] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Tanspecks.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Tanspecks.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Tanspecks.jpg" [0058.318] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Tanspecks.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Tanspecks.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Tanspecks.jpg" [0058.318] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.318] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.318] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.318] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Tiki.gif" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Tiki.gif") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Tiki.gif" [0058.318] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Tiki.gif" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Tiki.gif") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Tiki.gif" [0058.318] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.318] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.319] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.319] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.319] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.319] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.319] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\White_Chocolate.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\White_Chocolate.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\White_Chocolate.jpg" [0058.319] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\White_Chocolate.jpg" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\White_Chocolate.jpg") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\White_Chocolate.jpg" [0058.319] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.319] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0058.319] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0058.319] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Wrinkled_Paper.gif" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Wrinkled_Paper.gif") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Wrinkled_Paper.gif" [0058.319] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Wrinkled_Paper.gif" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Wrinkled_Paper.gif") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Wrinkled_Paper.gif" [0058.320] lstrcmpA (lpString1=".", lpString2="TextConv") returned -1 [0058.320] lstrcmpA (lpString1="..", lpString2="TextConv") returned -1 [0058.320] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.320] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.320] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.320] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0058.320] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0058.320] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.320] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.320] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.320] lstrcmpA (lpString1=".", lpString2="Triedit") returned -1 [0058.320] lstrcmpA (lpString1="..", lpString2="Triedit") returned -1 [0058.321] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.321] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.321] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.321] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0058.321] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0058.321] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.321] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.321] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.322] lstrcmpA (lpString1=".", lpString2="VC") returned -1 [0058.322] lstrcmpA (lpString1="..", lpString2="VC") returned -1 [0058.323] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.323] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.323] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.323] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.323] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\VC\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\VC\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\VC\\" [0058.323] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VC\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VC\\") returned="" [0058.324] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.324] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\VC\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\VC\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\VC\\" [0058.324] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VC\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VC\\") returned="" [0058.325] lstrcmpA (lpString1=".", lpString2="VGX") returned -1 [0058.325] lstrcmpA (lpString1="..", lpString2="VGX") returned -1 [0058.325] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.325] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.325] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.325] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.325] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\" [0058.325] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\") returned="" [0058.327] lstrcmpA (lpString1=".", lpString2="VSTO") returned -1 [0058.327] lstrcmpA (lpString1="..", lpString2="VSTO") returned -1 [0058.327] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.327] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.327] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.327] lstrcmpA (lpString1=".", lpString2="10.0") returned -1 [0058.327] lstrcmpA (lpString1="..", lpString2="10.0") returned -1 [0058.368] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.369] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.369] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.369] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0058.369] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0058.369] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.369] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.369] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.370] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0058.370] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\" [0058.370] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\") returned="" [0058.373] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0058.373] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\" [0058.374] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\") returned="" [0058.374] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.374] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\" [0058.374] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\") returned="" [0058.375] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.375] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\" [0058.375] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\") returned="" [0058.375] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.375] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\" [0058.375] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\") returned="" [0058.376] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.376] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\" [0058.376] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\") returned="" [0058.379] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.379] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\" [0058.379] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\") returned="" [0058.379] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.379] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\" [0058.379] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\") returned="" [0058.379] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0058.379] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0058.380] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.380] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.380] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.380] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0058.380] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Services\\" | out: lpString1="C:\\Program Files\\Common Files\\Services\\") returned="C:\\Program Files\\Common Files\\Services\\" [0058.380] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Services\\" | out: pszPath="C:\\Program Files\\Common Files\\Services\\") returned="" [0058.381] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Services\\verisign.bmp" | out: lpString1="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned="C:\\Program Files\\Common Files\\Services\\verisign.bmp" [0058.381] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Services\\verisign.bmp" | out: lpString1="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned="C:\\Program Files\\Common Files\\Services\\verisign.bmp" [0058.382] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0058.382] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\" | out: lpString1="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0058.382] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\" | out: pszPath="C:\\Program Files\\Common Files\\") returned="" [0058.382] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\sQxya1bDnxSO-cuS.bmp" | out: lpString1="C:\\Program Files\\Common Files\\sQxya1bDnxSO-cuS.bmp") returned="C:\\Program Files\\Common Files\\sQxya1bDnxSO-cuS.bmp" [0058.382] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\sQxya1bDnxSO-cuS.bmp" | out: lpString1="C:\\Program Files\\Common Files\\sQxya1bDnxSO-cuS.bmp") returned="C:\\Program Files\\Common Files\\sQxya1bDnxSO-cuS.bmp" [0058.384] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\sQxya1bDnxSO-cuS.bmp" (normalized: "c:\\program files\\common files\\sqxya1bdnxso-cus.bmp"), lpNewFileName="C:\\Program Files\\Common Files\\sQxya1bDnxSO-cuS.bmp.BD" (normalized: "c:\\program files\\common files\\sqxya1bdnxso-cus.bmp.bd")) returned 1 [0058.385] lstrcmpA (lpString1=".", lpString2="System") returned -1 [0058.385] lstrcmpA (lpString1="..", lpString2="System") returned -1 [0058.385] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.385] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.385] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.385] lstrcmpA (lpString1=".", lpString2="ado") returned -1 [0058.385] lstrcmpA (lpString1="..", lpString2="ado") returned -1 [0058.388] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.388] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.388] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.388] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.388] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0058.388] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0058.395] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.395] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0058.395] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0058.395] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0058.395] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0058.395] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.395] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.395] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.395] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.395] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\ado\\en-US\\" [0058.395] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\en-US\\") returned="" [0058.397] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0058.397] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0058.397] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0058.397] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0058.397] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0058.397] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0058.397] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0058.397] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0058.398] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0058.398] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0058.398] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0058.398] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0058.398] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0058.398] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0058.398] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0058.398] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0058.398] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0058.398] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0058.398] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0058.398] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0058.399] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.399] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0058.399] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0058.399] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.399] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0058.399] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0058.399] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.399] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0058.399] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0058.399] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.399] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0058.399] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0058.399] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.399] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0058.399] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0058.399] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.400] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0058.400] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0058.400] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0058.400] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\") returned="C:\\Program Files\\Common Files\\System\\" [0058.400] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\") returned="" [0058.401] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0058.401] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0058.402] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.402] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.402] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.402] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.402] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\en-US\\" [0058.402] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\en-US\\") returned="" [0058.405] lstrcmpA (lpString1=".", lpString2="msadc") returned -1 [0058.405] lstrcmpA (lpString1="..", lpString2="msadc") returned -1 [0058.407] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.407] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.407] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.407] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.407] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0058.407] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0058.409] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.409] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0058.409] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0058.409] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0058.409] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0058.409] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.409] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.409] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.409] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.409] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" [0058.409] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="" [0058.413] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" [0058.413] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="" [0058.413] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" [0058.413] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="" [0058.413] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" [0058.413] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="" [0058.413] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" [0058.413] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="" [0058.413] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0058.414] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0058.414] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.414] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0058.414] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0058.414] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.414] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0058.414] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0058.414] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.414] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0058.414] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0058.414] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.414] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0058.414] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0058.414] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.414] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0058.414] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0058.414] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.415] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0058.415] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0058.415] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.415] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0058.415] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0058.415] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.415] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0058.415] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0058.415] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.415] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0058.415] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0058.415] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.415] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0058.415] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0058.415] lstrcmpA (lpString1=".", lpString2="Ole DB") returned -1 [0058.415] lstrcmpA (lpString1="..", lpString2="Ole DB") returned -1 [0058.417] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.417] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.417] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.417] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0058.417] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0058.417] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.417] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.417] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.417] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.417] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" [0058.417] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="" [0058.421] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.421] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" [0058.421] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="" [0058.421] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.421] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" [0058.421] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="" [0058.421] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.421] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" [0058.421] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="" [0058.422] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.422] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0058.422] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0058.423] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.423] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0058.423] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0058.423] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.423] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0058.423] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0058.424] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.424] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0058.424] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0058.424] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.424] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0058.424] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0058.424] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.424] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0058.424] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0058.424] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.424] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0058.424] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0058.424] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.424] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0058.424] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0058.424] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.424] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0058.425] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0058.425] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.425] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0058.425] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0058.425] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.425] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0058.425] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0058.425] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.425] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0058.425] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0058.425] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.425] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0058.425] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0058.425] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.425] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0058.425] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0058.426] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0058.426] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\") returned="C:\\Program Files\\Common Files\\System\\" [0058.426] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\") returned="" [0058.426] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0058.426] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\") returned="C:\\Program Files\\Common Files\\System\\" [0058.426] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\") returned="" [0058.426] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0058.426] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0058.426] PathAddBackslashA (in: pszPath="C:\\Program Files\\" | out: pszPath="C:\\Program Files\\") returned="" [0058.429] lstrcmpA (lpString1=".", lpString2="Internet Explorer") returned -1 [0058.429] lstrcmpA (lpString1="..", lpString2="Internet Explorer") returned -1 [0058.429] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.429] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.429] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.429] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0058.429] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0058.429] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.429] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.429] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.429] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0058.431] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Internet Explorer\\en-US\\" | out: lpString1="C:\\Program Files\\Internet Explorer\\en-US\\") returned="C:\\Program Files\\Internet Explorer\\en-US\\" [0058.431] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\en-US\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\en-US\\") returned="" [0058.433] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0058.433] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Internet Explorer\\en-US\\" | out: lpString1="C:\\Program Files\\Internet Explorer\\en-US\\") returned="C:\\Program Files\\Internet Explorer\\en-US\\" [0058.433] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\en-US\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\en-US\\") returned="" [0058.433] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0058.433] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Internet Explorer\\en-US\\" | out: lpString1="C:\\Program Files\\Internet Explorer\\en-US\\") returned="C:\\Program Files\\Internet Explorer\\en-US\\" [0058.433] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\en-US\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\en-US\\") returned="" [0058.433] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0058.433] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Internet Explorer\\" | out: lpString1="C:\\Program Files\\Internet Explorer\\") returned="C:\\Program Files\\Internet Explorer\\" [0058.433] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\") returned="" [0058.435] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0058.435] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\") returned="" [0058.435] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0058.435] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\") returned="" [0058.435] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0058.435] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\") returned="" [0058.435] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0058.435] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\") returned="" [0058.435] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0058.435] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\") returned="" [0058.435] lstrcmpA (lpString1=".", lpString2="images") returned -1 [0058.435] lstrcmpA (lpString1="..", lpString2="images") returned -1 [0058.436] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.436] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.436] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.436] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0058.436] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\images\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\images\\") returned="" [0058.437] lstrcmpA (lpString1=".", lpString2="SIGNUP") returned -1 [0058.437] lstrcmpA (lpString1="..", lpString2="SIGNUP") returned -1 [0058.437] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.437] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.437] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.437] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0058.437] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\SIGNUP\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\SIGNUP\\") returned="" [0058.440] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0058.440] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\") returned="" [0058.440] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0058.440] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\") returned="" [0058.440] lstrcmpA (lpString1=".", lpString2="Java") returned -1 [0058.440] lstrcmpA (lpString1="..", lpString2="Java") returned -1 [0058.440] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.440] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.440] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.440] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0058.440] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\" | out: pszPath="C:\\Program Files\\Java\\") returned="" [0058.442] lstrcmpA (lpString1=".", lpString2="jre1.8.0_171") returned -1 [0058.442] lstrcmpA (lpString1="..", lpString2="jre1.8.0_171") returned -1 [0058.442] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.442] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.443] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.443] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.444] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.444] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.445] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.445] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.445] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.445] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.445] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.445] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.445] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.445] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.445] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.445] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.445] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.445] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.446] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.446] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.446] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.446] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.446] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.446] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.446] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.446] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.446] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.446] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.446] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.446] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.447] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.447] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.447] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.447] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.447] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.447] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.447] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.447] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.447] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.447] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.447] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.447] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.448] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.448] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.448] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.448] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.448] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.448] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.448] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.448] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.448] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.448] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.448] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.449] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.449] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.449] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.449] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.449] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.449] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.449] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.449] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.449] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.449] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.449] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.449] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.449] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.450] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.450] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.450] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.450] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.450] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.450] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.450] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.450] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.450] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.450] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.450] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.450] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.451] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.451] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.451] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.451] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.451] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.451] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.451] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.451] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.451] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.451] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.451] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.451] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.451] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.452] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.452] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.452] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.452] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.452] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\dtplugin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\dtplugin\\") returned="" [0058.456] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0058.456] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\dtplugin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\dtplugin\\") returned="" [0058.456] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.456] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.456] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.456] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.457] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.457] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.457] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.457] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.457] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.457] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.457] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.457] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.458] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.458] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.458] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.458] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.458] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.458] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.458] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.458] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.458] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.458] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.458] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.458] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.458] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.459] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.459] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.459] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.459] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.459] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0058.459] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.459] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\") returned="" [0058.470] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_171\\bin\\server\\xusage.txt"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_171\\bin\\server\\Xusage.txt.BD" (normalized: "c:\\program files\\java\\jre1.8.0_171\\bin\\server\\xusage.txt.bd")) returned 1 [0058.485] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\ffjcext.zip"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\ffjcext.zip.BD" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\ffjcext.zip.bd")) returned 1 [0058.489] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash.gif.BD" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash.gif.bd")) returned 1 [0058.492] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash@2x.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash@2x.gif.BD" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash@2x.gif.bd")) returned 1 [0058.495] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash_11-lic.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash_11-lic.gif.BD" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash_11-lic.gif.bd")) returned 1 [0058.499] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash_11@2x-lic.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash_11@2x-lic.gif.BD" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash_11@2x-lic.gif.bd")) returned 1 [0058.519] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\invalid32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\invalid32x32.gif.BD" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\invalid32x32.gif.bd")) returned 1 [0058.521] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_copydrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.BD" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_copydrop32x32.gif.bd")) returned 1 [0058.523] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.BD" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_copynodrop32x32.gif.bd")) returned 1 [0058.525] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.BD" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_linkdrop32x32.gif.bd")) returned 1 [0058.527] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.BD" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_linknodrop32x32.gif.bd")) returned 1 [0058.529] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_movedrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.BD" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_movedrop32x32.gif.bd")) returned 1 [0058.531] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.BD" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_movenodrop32x32.gif.bd")) returned 1 [0058.557] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_171\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\jvm.hprof.txt"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_171\\lib\\jvm.hprof.txt.BD" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\jvm.hprof.txt.bd")) returned 1 [0058.579] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_171\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_171\\readme.txt"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_171\\README.txt.BD" (normalized: "c:\\program files\\java\\jre1.8.0_171\\readme.txt.bd")) returned 1 [0058.593] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_171\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_171\\thirdpartylicensereadme-javafx.txt"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_171\\THIRDPARTYLICENSEREADME-JAVAFX.txt.BD" (normalized: "c:\\program files\\java\\jre1.8.0_171\\thirdpartylicensereadme-javafx.txt.bd")) returned 1 [0058.602] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_171\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_171\\thirdpartylicensereadme.txt"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_171\\THIRDPARTYLICENSEREADME.txt.BD" (normalized: "c:\\program files\\java\\jre1.8.0_171\\thirdpartylicensereadme.txt.bd")) returned 1 [0058.605] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_171\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_171\\welcome.html"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_171\\Welcome.html.BD" (normalized: "c:\\program files\\java\\jre1.8.0_171\\welcome.html.bd")) returned 1 [0058.608] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office16\\1033\\Mso Example Intl Setup File A.txt" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\mso example intl setup file a.txt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office16\\1033\\Mso Example Intl Setup File A.txt.BD" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\mso example intl setup file a.txt.bd")) returned 1 [0058.609] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office16\\1033\\Mso Example Intl Setup File B.txt" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\mso example intl setup file b.txt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office16\\1033\\Mso Example Intl Setup File B.txt.BD" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\mso example intl setup file b.txt.bd")) returned 1 [0058.664] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office16\\Mso Example Setup File A.txt" (normalized: "c:\\program files\\microsoft office\\office16\\mso example setup file a.txt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office16\\Mso Example Setup File A.txt.BD" (normalized: "c:\\program files\\microsoft office\\office16\\mso example setup file a.txt.bd")) returned 1 [0063.195] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\ms.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\ms.gif.bd")) returned 1 [0063.200] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\ms.jpg"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\ms.jpg.bd")) returned 1 [0063.203] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\ms.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\ms.png.bd")) returned 1 [0063.304] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\1033\\README.HTM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\1033\\readme.htm"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\1033\\README.HTM.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\1033\\readme.htm.bd")) returned 1 [0063.446] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.bd")) returned 1 [0063.561] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\metconv.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\metconv.txt.bd")) returned 1 [0063.591] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\aftrnoon\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\AFTRNOON\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\aftrnoon\\preview.gif.bd")) returned 1 [0063.598] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\aftrnoon\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\AFTRNOON\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\aftrnoon\\thmbnail.png.bd")) returned 1 [0063.607] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\arctic\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ARCTIC\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\arctic\\preview.gif.bd")) returned 1 [0063.647] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\arctic\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ARCTIC\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\arctic\\thmbnail.png.bd")) returned 1 [0063.653] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\axis\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\AXIS\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\axis\\preview.gif.bd")) returned 1 [0063.662] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\axis\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\AXIS\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\axis\\thmbnail.png.bd")) returned 1 [0063.669] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\blends\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLENDS\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\blends\\preview.gif.bd")) returned 1 [0063.684] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\blends\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLENDS\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\blends\\thmbnail.png.bd")) returned 1 [0063.692] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\bluecalm\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLUECALM\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\bluecalm\\preview.gif.bd")) returned 1 [0063.697] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\bluecalm\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLUECALM\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\bluecalm\\thmbnail.png.bd")) returned 1 [0063.703] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\blueprnt\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLUEPRNT\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\blueprnt\\preview.gif.bd")) returned 1 [0063.707] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\blueprnt\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLUEPRNT\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\blueprnt\\thmbnail.png.bd")) returned 1 [0063.713] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\boldstri\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BOLDSTRI\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\boldstri\\preview.gif.bd")) returned 1 [0063.717] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\boldstri\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BOLDSTRI\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\boldstri\\thmbnail.png.bd")) returned 1 [0063.721] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\breeze\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BREEZE\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\breeze\\preview.gif.bd")) returned 1 [0063.728] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\breeze\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BREEZE\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\breeze\\thmbnail.png.bd")) returned 1 [0063.735] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\canyon\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CANYON\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\canyon\\preview.gif.bd")) returned 1 [0063.742] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\canyon\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CANYON\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\canyon\\thmbnail.png.bd")) returned 1 [0063.749] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\capsules\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CAPSULES\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\capsules\\preview.gif.bd")) returned 1 [0063.753] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\capsules\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CAPSULES\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\capsules\\thmbnail.png.bd")) returned 1 [0063.758] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\cascade\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CASCADE\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\cascade\\preview.gif.bd")) returned 1 [0063.764] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\cascade\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CASCADE\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\cascade\\thmbnail.png.bd")) returned 1 [0063.770] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\compass\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\COMPASS\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\compass\\preview.gif.bd")) returned 1 [0063.775] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\compass\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\COMPASS\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\compass\\thmbnail.png.bd")) returned 1 [0063.781] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\concrete\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CONCRETE\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\concrete\\preview.gif.bd")) returned 1 [0063.784] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\concrete\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CONCRETE\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\concrete\\thmbnail.png.bd")) returned 1 [0063.791] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\deepblue\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\DEEPBLUE\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\deepblue\\preview.gif.bd")) returned 1 [0063.800] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\deepblue\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\DEEPBLUE\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\deepblue\\thmbnail.png.bd")) returned 1 [0063.806] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\echo\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ECHO\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\echo\\preview.gif.bd")) returned 1 [0063.811] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\echo\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ECHO\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\echo\\thmbnail.png.bd")) returned 1 [0063.816] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\eclipse\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ECLIPSE\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\eclipse\\preview.gif.bd")) returned 1 [0063.822] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\eclipse\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ECLIPSE\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\eclipse\\thmbnail.png.bd")) returned 1 [0063.829] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\edge\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EDGE\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\edge\\preview.gif.bd")) returned 1 [0063.843] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\edge\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EDGE\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\edge\\thmbnail.png.bd")) returned 1 [0063.849] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\evrgreen\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EVRGREEN\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\evrgreen\\preview.gif.bd")) returned 1 [0063.853] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\evrgreen\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EVRGREEN\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\evrgreen\\thmbnail.png.bd")) returned 1 [0063.863] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\expeditn\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EXPEDITN\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\expeditn\\preview.gif.bd")) returned 1 [0063.874] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\expeditn\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EXPEDITN\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\expeditn\\thmbnail.png.bd")) returned 1 [0063.879] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ice\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ICE\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ice\\preview.gif.bd")) returned 1 [0063.884] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ice\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ICE\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ice\\thmbnail.png.bd")) returned 1 [0063.889] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\indust\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\INDUST\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\indust\\preview.gif.bd")) returned 1 [0063.893] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\indust\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\INDUST\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\indust\\thmbnail.png.bd")) returned 1 [0063.899] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\iris\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\IRIS\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\iris\\preview.gif.bd")) returned 1 [0063.903] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\iris\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\IRIS\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\iris\\thmbnail.png.bd")) returned 1 [0063.919] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\journal\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\JOURNAL\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\journal\\preview.gif.bd")) returned 1 [0063.926] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\journal\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\JOURNAL\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\journal\\thmbnail.png.bd")) returned 1 [0063.932] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\layers\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\LAYERS\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\layers\\preview.gif.bd")) returned 1 [0063.938] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\layers\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\LAYERS\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\layers\\thmbnail.png.bd")) returned 1 [0063.944] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\level\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\LEVEL\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\level\\preview.gif.bd")) returned 1 [0063.950] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\level\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\LEVEL\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\level\\thmbnail.png.bd")) returned 1 [0063.955] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\network\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\NETWORK\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\network\\preview.gif.bd")) returned 1 [0063.963] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\network\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\NETWORK\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\network\\thmbnail.png.bd")) returned 1 [0063.968] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\papyrus\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PAPYRUS\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\papyrus\\preview.gif.bd")) returned 1 [0063.973] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\papyrus\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PAPYRUS\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\papyrus\\thmbnail.png.bd")) returned 1 [0063.979] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\pixel\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PIXEL\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\pixel\\preview.gif.bd")) returned 1 [0063.984] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\pixel\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PIXEL\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\pixel\\thmbnail.png.bd")) returned 1 [0063.988] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\profile\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PROFILE\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\profile\\preview.gif.bd")) returned 1 [0063.995] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\profile\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PROFILE\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\profile\\thmbnail.png.bd")) returned 1 [0064.001] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\quad\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\QUAD\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\quad\\preview.gif.bd")) returned 1 [0064.007] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\quad\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\QUAD\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\quad\\thmbnail.png.bd")) returned 1 [0064.011] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\radial\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RADIAL\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\radial\\preview.gif.bd")) returned 1 [0064.016] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\radial\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RADIAL\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\radial\\thmbnail.png.bd")) returned 1 [0064.020] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\refined\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\REFINED\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\refined\\preview.gif.bd")) returned 1 [0064.025] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\refined\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\REFINED\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\refined\\thmbnail.png.bd")) returned 1 [0064.032] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ricepapr\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RICEPAPR\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ricepapr\\preview.gif.bd")) returned 1 [0064.036] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ricepapr\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RICEPAPR\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ricepapr\\thmbnail.png.bd")) returned 1 [0064.042] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ripple\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RIPPLE\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ripple\\preview.gif.bd")) returned 1 [0064.047] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ripple\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RIPPLE\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ripple\\thmbnail.png.bd")) returned 1 [0064.053] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\rmnsque\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RMNSQUE\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\rmnsque\\preview.gif.bd")) returned 1 [0064.059] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\rmnsque\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RMNSQUE\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\rmnsque\\thmbnail.png.bd")) returned 1 [0064.064] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\satin\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SATIN\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\satin\\preview.gif.bd")) returned 1 [0064.069] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\satin\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SATIN\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\satin\\thmbnail.png.bd")) returned 1 [0064.078] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sky\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SKY\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sky\\preview.gif.bd")) returned 1 [0064.141] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sky\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SKY\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sky\\thmbnail.png.bd")) returned 1 [0064.146] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\slate\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SLATE\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\slate\\preview.gif.bd")) returned 1 [0064.152] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\slate\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SLATE\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\slate\\thmbnail.png.bd")) returned 1 [0064.157] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sonora\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sonora\\preview.gif.bd")) returned 1 [0064.161] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sonora\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sonora\\thmbnail.png.bd")) returned 1 [0064.170] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\spring\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\spring\\preview.gif.bd")) returned 1 [0064.175] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\spring\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\spring\\thmbnail.png.bd")) returned 1 [0064.187] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\strtedge\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\strtedge\\preview.gif.bd")) returned 1 [0064.192] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\strtedge\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\STRTEDGE\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\strtedge\\thmbnail.png.bd")) returned 1 [0064.215] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\studio\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\STUDIO\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\studio\\preview.gif.bd")) returned 1 [0064.220] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\studio\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\STUDIO\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\studio\\thmbnail.png.bd")) returned 1 [0064.226] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sumipntg\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SUMIPNTG\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sumipntg\\preview.gif.bd")) returned 1 [0064.236] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sumipntg\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SUMIPNTG\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sumipntg\\thmbnail.png.bd")) returned 1 [0064.243] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\water\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\WATER\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\water\\preview.gif.bd")) returned 1 [0064.249] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\water\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\WATER\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\water\\thmbnail.png.bd")) returned 1 [0064.255] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\watermar\\preview.gif"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\WATERMAR\\PREVIEW.GIF.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\watermar\\preview.gif.bd")) returned 1 [0064.259] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\watermar\\thmbnail.png"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\WATERMAR\\THMBNAIL.PNG.BD" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\watermar\\thmbnail.png.bd")) returned 1 [0064.456] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.bd")) returned 1 [0064.460] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.bd")) returned 1 [0064.464] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.bd")) returned 1 [0064.466] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.bd")) returned 1 [0064.469] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.bd")) returned 1 [0064.472] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.bd")) returned 1 [0064.476] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.bd")) returned 1 [0064.481] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.bd")) returned 1 [0064.484] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.bd")) returned 1 [0064.486] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.bd")) returned 1 [0064.493] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.bd")) returned 1 [0064.497] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.bd")) returned 1 [0064.500] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.bd")) returned 1 [0064.504] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.bd")) returned 1 [0064.507] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.bd")) returned 1 [0064.510] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.bd")) returned 1 [0064.514] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.bd")) returned 1 [0064.517] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.bd")) returned 1 [0064.520] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.bd")) returned 1 [0064.523] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.bd")) returned 1 [0064.527] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.bd")) returned 1 [0064.533] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.bd")) returned 1 [0064.536] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.bd")) returned 1 [0064.546] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.bd")) returned 1 [0064.549] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.bd")) returned 1 [0064.552] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.bd")) returned 1 [0064.558] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.bd")) returned 1 [0064.561] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.bd")) returned 1 [0064.564] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.bd")) returned 1 [0064.566] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.bd")) returned 1 [0064.569] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.bd")) returned 1 [0064.572] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.bd")) returned 1 [0064.574] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.bd")) returned 1 [0064.577] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.bd")) returned 1 [0064.589] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.bd")) returned 1 [0064.593] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.bd")) returned 1 [0064.598] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.bd")) returned 1 [0064.602] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.bd")) returned 1 [0064.643] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0075478.gif.bd")) returned 1 [0064.649] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.bd")) returned 1 [0064.653] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.bd")) returned 1 [0064.659] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.bd")) returned 1 [0064.663] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.bd")) returned 1 [0064.666] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.bd")) returned 1 [0064.671] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.bd")) returned 1 [0064.675] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.bd")) returned 1 [0064.680] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.bd")) returned 1 [0064.683] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.bd")) returned 1 [0064.692] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.bd")) returned 1 [0064.696] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.bd")) returned 1 [0064.699] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.bd")) returned 1 [0064.705] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.bd")) returned 1 [0064.710] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.bd")) returned 1 [0064.716] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.bd")) returned 1 [0064.719] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.bd")) returned 1 [0064.723] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.bd")) returned 1 [0064.727] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.bd")) returned 1 [0064.733] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.bd")) returned 1 [0064.744] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.bd")) returned 1 [0064.746] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.bd")) returned 1 [0064.754] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.bd")) returned 1 [0064.763] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.bd")) returned 1 [0064.766] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099192.gif.bd")) returned 1 [0064.771] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099193.gif.bd")) returned 1 [0064.776] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099194.gif.bd")) returned 1 [0064.779] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099195.gif.bd")) returned 1 [0064.784] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099196.gif.bd")) returned 1 [0064.787] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099197.gif.bd")) returned 1 [0064.789] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099198.gif.bd")) returned 1 [0064.794] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099199.gif.bd")) returned 1 [0064.797] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099200.gif.bd")) returned 1 [0064.802] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099201.gif.bd")) returned 1 [0067.460] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1367 [0067.461] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x89bbb700, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xadd97f91, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x89bbb700, dwHighDateTime=0x1d0ca66)) returned 1 [0067.461] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0067.461] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x130b, lpOverlapped=0x0) returned 1 [0067.548] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0067.548] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x130b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x130b, lpOverlapped=0x0) returned 1 [0067.548] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.549] CloseHandle (hObject=0x1cc) returned 1 [0067.551] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099202.gif.bd")) returned 1 [0067.553] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc31c5eb3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xf40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099203.GIF", cAlternateFileName="")) returned 1 [0067.553] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.553] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.554] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0099203.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" [0067.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF", pszSpec="*.zip") returned 0 [0067.554] lstrlenA (lpString="*.zip") returned 5 [0067.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF", pszSpec="*.rar") returned 0 [0067.554] lstrlenA (lpString="*.rar") returned 5 [0067.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF", pszSpec="*.7z") returned 0 [0067.554] lstrlenA (lpString="*.7z") returned 4 [0067.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF", pszSpec="*.tar") returned 0 [0067.554] lstrlenA (lpString="*.tar") returned 5 [0067.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF", pszSpec="*.gzip") returned 0 [0067.554] lstrlenA (lpString="*.gzip") returned 6 [0067.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF", pszSpec="*.jpg") returned 0 [0067.554] lstrlenA (lpString="*.jpg") returned 5 [0067.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF", pszSpec="*.jpeg") returned 0 [0067.554] lstrlenA (lpString="*.jpeg") returned 6 [0067.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF", pszSpec="*.psd") returned 0 [0067.554] lstrlenA (lpString="*.psd") returned 5 [0067.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF", pszSpec="*.cdr") returned 0 [0067.554] lstrlenA (lpString="*.cdr") returned 5 [0067.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF", pszSpec="*.dwg") returned 0 [0067.554] lstrlenA (lpString="*.dwg") returned 5 [0067.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF", pszSpec="*.max") returned 0 [0067.554] lstrlenA (lpString="*.max") returned 5 [0067.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF", pszSpec="*.bmp") returned 0 [0067.554] lstrlenA (lpString="*.bmp") returned 5 [0067.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF", pszSpec="*.gif") returned 1 [0067.554] lstrlenA (lpString="*.gif") returned 5 [0067.554] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" [0067.554] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" [0067.554] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF." [0067.554] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.BD" [0067.555] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0067.555] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf40 [0067.555] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x89bbb700, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc31c5eb3, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x89bbb700, dwHighDateTime=0x1d0ca66)) returned 1 [0067.555] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0067.555] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xee4, lpOverlapped=0x0) returned 1 [0067.557] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned="J0099203.GIF" [0067.557] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0067.557] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xee4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xee4, lpOverlapped=0x0) returned 1 [0067.557] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.557] CloseHandle (hObject=0x1cc) returned 1 [0067.558] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099203.gif.bd")) returned 1 [0067.559] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadd9cdf2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x45be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099204.WMF", cAlternateFileName="")) returned 1 [0067.559] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.559] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0099204.WMF") returned -1 [0067.559] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0099204.WMF") returned -1 [0067.559] lstrcmpiA (lpString1="", lpString2="J0099204.WMF") returned -1 [0067.559] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned="J0099203.GIF" [0067.559] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.559] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.559] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.559] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.559] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0099204.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" [0067.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.zip") returned 0 [0067.559] lstrlenA (lpString="*.zip") returned 5 [0067.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.rar") returned 0 [0067.559] lstrlenA (lpString="*.rar") returned 5 [0067.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.7z") returned 0 [0067.559] lstrlenA (lpString="*.7z") returned 4 [0067.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.tar") returned 0 [0067.559] lstrlenA (lpString="*.tar") returned 5 [0067.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.gzip") returned 0 [0067.559] lstrlenA (lpString="*.gzip") returned 6 [0067.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.jpg") returned 0 [0067.560] lstrlenA (lpString="*.jpg") returned 5 [0067.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.jpeg") returned 0 [0067.560] lstrlenA (lpString="*.jpeg") returned 6 [0067.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.psd") returned 0 [0067.560] lstrlenA (lpString="*.psd") returned 5 [0067.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.cdr") returned 0 [0067.560] lstrlenA (lpString="*.cdr") returned 5 [0067.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.dwg") returned 0 [0067.560] lstrlenA (lpString="*.dwg") returned 5 [0067.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.max") returned 0 [0067.560] lstrlenA (lpString="*.max") returned 5 [0067.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.bmp") returned 0 [0067.560] lstrlenA (lpString="*.bmp") returned 5 [0067.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.gif") returned 0 [0067.560] lstrlenA (lpString="*.gif") returned 5 [0067.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.png") returned 0 [0067.560] lstrlenA (lpString="*.png") returned 5 [0067.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.doc") returned 0 [0067.560] lstrlenA (lpString="*.doc") returned 5 [0067.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.docx") returned 0 [0067.560] lstrlenA (lpString="*.docx") returned 6 [0067.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.xls") returned 0 [0067.560] lstrlenA (lpString="*.xls") returned 5 [0067.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.xlsx") returned 0 [0067.560] lstrlenA (lpString="*.xlsx") returned 6 [0067.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.ppt") returned 0 [0067.560] lstrlenA (lpString="*.ppt") returned 5 [0067.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.pptx") returned 0 [0067.560] lstrlenA (lpString="*.pptx") returned 6 [0067.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.txt") returned 0 [0067.560] lstrlenA (lpString="*.txt") returned 5 [0067.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.pdf") returned 0 [0067.560] lstrlenA (lpString="*.pdf") returned 5 [0067.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.djvu") returned 0 [0067.560] lstrlenA (lpString="*.djvu") returned 6 [0067.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.htm") returned 0 [0067.560] lstrlenA (lpString="*.htm") returned 5 [0067.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.html") returned 0 [0067.561] lstrlenA (lpString="*.html") returned 6 [0067.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.mdb") returned 0 [0067.561] lstrlenA (lpString="*.mdb") returned 5 [0067.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.cer") returned 0 [0067.561] lstrlenA (lpString="*.cer") returned 5 [0067.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.p12") returned 0 [0067.561] lstrlenA (lpString="*.p12") returned 5 [0067.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.pfx") returned 0 [0067.561] lstrlenA (lpString="*.pfx") returned 5 [0067.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.kwm") returned 0 [0067.561] lstrlenA (lpString="*.kwm") returned 5 [0067.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.pwm") returned 0 [0067.561] lstrlenA (lpString="*.pwm") returned 5 [0067.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.1cd") returned 0 [0067.561] lstrlenA (lpString="*.1cd") returned 5 [0067.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.md") returned 0 [0067.561] lstrlenA (lpString="*.md") returned 4 [0067.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.mdf") returned 0 [0067.561] lstrlenA (lpString="*.mdf") returned 5 [0067.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.dbf") returned 0 [0067.561] lstrlenA (lpString="*.dbf") returned 5 [0067.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.odt") returned 0 [0067.561] lstrlenA (lpString="*.odt") returned 5 [0067.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.vob") returned 0 [0067.561] lstrlenA (lpString="*.vob") returned 5 [0067.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.ifo") returned 0 [0067.561] lstrlenA (lpString="*.ifo") returned 5 [0067.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.lnk") returned 0 [0067.561] lstrlenA (lpString="*.lnk") returned 5 [0067.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.torrent") returned 0 [0067.561] lstrlenA (lpString="*.torrent") returned 9 [0067.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.mov") returned 0 [0067.561] lstrlenA (lpString="*.mov") returned 5 [0067.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.m2v") returned 0 [0067.561] lstrlenA (lpString="*.m2v") returned 5 [0067.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.3gp") returned 0 [0067.562] lstrlenA (lpString="*.3gp") returned 5 [0067.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.mpeg") returned 0 [0067.562] lstrlenA (lpString="*.mpeg") returned 6 [0067.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.mpg") returned 0 [0067.562] lstrlenA (lpString="*.mpg") returned 5 [0067.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.flv") returned 0 [0067.562] lstrlenA (lpString="*.flv") returned 5 [0067.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.avi") returned 0 [0067.562] lstrlenA (lpString="*.avi") returned 5 [0067.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.mp4") returned 0 [0067.562] lstrlenA (lpString="*.mp4") returned 5 [0067.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.wmv") returned 0 [0067.562] lstrlenA (lpString="*.wmv") returned 5 [0067.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.divx") returned 0 [0067.562] lstrlenA (lpString="*.divx") returned 6 [0067.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.mkv") returned 0 [0067.562] lstrlenA (lpString="*.mkv") returned 5 [0067.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.mp3") returned 0 [0067.562] lstrlenA (lpString="*.mp3") returned 5 [0067.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.wav") returned 0 [0067.562] lstrlenA (lpString="*.wav") returned 5 [0067.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.flac") returned 0 [0067.562] lstrlenA (lpString="*.flac") returned 6 [0067.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.ape") returned 0 [0067.562] lstrlenA (lpString="*.ape") returned 5 [0067.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.wma") returned 0 [0067.562] lstrlenA (lpString="*.wma") returned 5 [0067.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.ac3") returned 0 [0067.562] lstrlenA (lpString="*.ac3") returned 5 [0067.562] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadda42e2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x45be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099205.WMF", cAlternateFileName="")) returned 1 [0067.562] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.562] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0099205.WMF") returned -1 [0067.562] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0099205.WMF") returned -1 [0067.562] lstrcmpiA (lpString1="", lpString2="J0099205.WMF") returned -1 [0067.562] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned="J0099204.WMF" [0067.562] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.562] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.562] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.563] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.563] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0099205.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" [0067.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.zip") returned 0 [0067.563] lstrlenA (lpString="*.zip") returned 5 [0067.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.rar") returned 0 [0067.563] lstrlenA (lpString="*.rar") returned 5 [0067.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.7z") returned 0 [0067.563] lstrlenA (lpString="*.7z") returned 4 [0067.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.tar") returned 0 [0067.563] lstrlenA (lpString="*.tar") returned 5 [0067.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.gzip") returned 0 [0067.563] lstrlenA (lpString="*.gzip") returned 6 [0067.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.jpg") returned 0 [0067.563] lstrlenA (lpString="*.jpg") returned 5 [0067.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.jpeg") returned 0 [0067.563] lstrlenA (lpString="*.jpeg") returned 6 [0067.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.psd") returned 0 [0067.563] lstrlenA (lpString="*.psd") returned 5 [0067.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.cdr") returned 0 [0067.563] lstrlenA (lpString="*.cdr") returned 5 [0067.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.dwg") returned 0 [0067.563] lstrlenA (lpString="*.dwg") returned 5 [0067.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.max") returned 0 [0067.563] lstrlenA (lpString="*.max") returned 5 [0067.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.bmp") returned 0 [0067.563] lstrlenA (lpString="*.bmp") returned 5 [0067.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.gif") returned 0 [0067.563] lstrlenA (lpString="*.gif") returned 5 [0067.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.png") returned 0 [0067.564] lstrlenA (lpString="*.png") returned 5 [0067.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.doc") returned 0 [0067.564] lstrlenA (lpString="*.doc") returned 5 [0067.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.docx") returned 0 [0067.564] lstrlenA (lpString="*.docx") returned 6 [0067.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.xls") returned 0 [0067.564] lstrlenA (lpString="*.xls") returned 5 [0067.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.xlsx") returned 0 [0067.564] lstrlenA (lpString="*.xlsx") returned 6 [0067.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.ppt") returned 0 [0067.564] lstrlenA (lpString="*.ppt") returned 5 [0067.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.pptx") returned 0 [0067.564] lstrlenA (lpString="*.pptx") returned 6 [0067.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.txt") returned 0 [0067.564] lstrlenA (lpString="*.txt") returned 5 [0067.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.pdf") returned 0 [0067.564] lstrlenA (lpString="*.pdf") returned 5 [0067.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.djvu") returned 0 [0067.564] lstrlenA (lpString="*.djvu") returned 6 [0067.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.htm") returned 0 [0067.564] lstrlenA (lpString="*.htm") returned 5 [0067.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.html") returned 0 [0067.564] lstrlenA (lpString="*.html") returned 6 [0067.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.mdb") returned 0 [0067.564] lstrlenA (lpString="*.mdb") returned 5 [0067.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.cer") returned 0 [0067.564] lstrlenA (lpString="*.cer") returned 5 [0067.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.p12") returned 0 [0067.564] lstrlenA (lpString="*.p12") returned 5 [0067.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.pfx") returned 0 [0067.564] lstrlenA (lpString="*.pfx") returned 5 [0067.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.kwm") returned 0 [0067.564] lstrlenA (lpString="*.kwm") returned 5 [0067.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.pwm") returned 0 [0067.564] lstrlenA (lpString="*.pwm") returned 5 [0067.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.1cd") returned 0 [0067.564] lstrlenA (lpString="*.1cd") returned 5 [0067.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.md") returned 0 [0067.565] lstrlenA (lpString="*.md") returned 4 [0067.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.mdf") returned 0 [0067.565] lstrlenA (lpString="*.mdf") returned 5 [0067.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.dbf") returned 0 [0067.565] lstrlenA (lpString="*.dbf") returned 5 [0067.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.odt") returned 0 [0067.565] lstrlenA (lpString="*.odt") returned 5 [0067.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.vob") returned 0 [0067.565] lstrlenA (lpString="*.vob") returned 5 [0067.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.ifo") returned 0 [0067.565] lstrlenA (lpString="*.ifo") returned 5 [0067.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.lnk") returned 0 [0067.565] lstrlenA (lpString="*.lnk") returned 5 [0067.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.torrent") returned 0 [0067.565] lstrlenA (lpString="*.torrent") returned 9 [0067.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.mov") returned 0 [0067.565] lstrlenA (lpString="*.mov") returned 5 [0067.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.m2v") returned 0 [0067.565] lstrlenA (lpString="*.m2v") returned 5 [0067.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.3gp") returned 0 [0067.565] lstrlenA (lpString="*.3gp") returned 5 [0067.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.mpeg") returned 0 [0067.565] lstrlenA (lpString="*.mpeg") returned 6 [0067.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.mpg") returned 0 [0067.565] lstrlenA (lpString="*.mpg") returned 5 [0067.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.flv") returned 0 [0067.565] lstrlenA (lpString="*.flv") returned 5 [0067.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.avi") returned 0 [0067.565] lstrlenA (lpString="*.avi") returned 5 [0067.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.mp4") returned 0 [0067.565] lstrlenA (lpString="*.mp4") returned 5 [0067.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.wmv") returned 0 [0067.565] lstrlenA (lpString="*.wmv") returned 5 [0067.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.divx") returned 0 [0067.565] lstrlenA (lpString="*.divx") returned 6 [0067.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.mkv") returned 0 [0067.565] lstrlenA (lpString="*.mkv") returned 5 [0067.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.mp3") returned 0 [0067.566] lstrlenA (lpString="*.mp3") returned 5 [0067.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.wav") returned 0 [0067.566] lstrlenA (lpString="*.wav") returned 5 [0067.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.flac") returned 0 [0067.566] lstrlenA (lpString="*.flac") returned 6 [0067.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.ape") returned 0 [0067.566] lstrlenA (lpString="*.ape") returned 5 [0067.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.wma") returned 0 [0067.566] lstrlenA (lpString="*.wma") returned 5 [0067.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.ac3") returned 0 [0067.566] lstrlenA (lpString="*.ac3") returned 5 [0067.566] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc31cd3b7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x133f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101856.BMP", cAlternateFileName="")) returned 1 [0067.566] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.566] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0101856.BMP") returned -1 [0067.566] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0101856.BMP") returned -1 [0067.566] lstrcmpiA (lpString1="", lpString2="J0101856.BMP") returned -1 [0067.566] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned="J0099205.WMF" [0067.566] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.566] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.566] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.566] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.566] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0101856.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" [0067.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP", pszSpec="*.zip") returned 0 [0067.566] lstrlenA (lpString="*.zip") returned 5 [0067.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP", pszSpec="*.rar") returned 0 [0067.566] lstrlenA (lpString="*.rar") returned 5 [0067.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP", pszSpec="*.7z") returned 0 [0067.567] lstrlenA (lpString="*.7z") returned 4 [0067.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP", pszSpec="*.tar") returned 0 [0067.567] lstrlenA (lpString="*.tar") returned 5 [0067.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP", pszSpec="*.gzip") returned 0 [0067.567] lstrlenA (lpString="*.gzip") returned 6 [0067.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP", pszSpec="*.jpg") returned 0 [0067.567] lstrlenA (lpString="*.jpg") returned 5 [0067.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP", pszSpec="*.jpeg") returned 0 [0067.567] lstrlenA (lpString="*.jpeg") returned 6 [0067.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP", pszSpec="*.psd") returned 0 [0067.567] lstrlenA (lpString="*.psd") returned 5 [0067.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP", pszSpec="*.cdr") returned 0 [0067.567] lstrlenA (lpString="*.cdr") returned 5 [0067.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP", pszSpec="*.dwg") returned 0 [0067.567] lstrlenA (lpString="*.dwg") returned 5 [0067.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP", pszSpec="*.max") returned 0 [0067.567] lstrlenA (lpString="*.max") returned 5 [0067.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP", pszSpec="*.bmp") returned 1 [0067.567] lstrlenA (lpString="*.bmp") returned 5 [0067.567] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" [0067.567] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" [0067.567] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP." [0067.567] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.BD" [0067.567] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0067.568] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x133f8 [0067.568] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x89bbb700, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc31cd3b7, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x89bbb700, dwHighDateTime=0x1d0ca66)) returned 1 [0067.568] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0067.568] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1339c, lpOverlapped=0x0) returned 1 [0067.570] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned="J0101856.BMP" [0067.572] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0067.572] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1339c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1339c, lpOverlapped=0x0) returned 1 [0067.573] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.573] CloseHandle (hObject=0x1cc) returned 1 [0067.575] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.bd")) returned 1 [0067.576] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc31d3596, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101857.BMP", cAlternateFileName="")) returned 1 [0067.576] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.576] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0101857.BMP") returned -1 [0067.576] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0101857.BMP") returned -1 [0067.576] lstrcmpiA (lpString1="", lpString2="J0101857.BMP") returned -1 [0067.576] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned="J0101856.BMP" [0067.576] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.576] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.576] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.576] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.576] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0101857.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" [0067.576] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP", pszSpec="*.zip") returned 0 [0067.576] lstrlenA (lpString="*.zip") returned 5 [0067.576] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP", pszSpec="*.rar") returned 0 [0067.576] lstrlenA (lpString="*.rar") returned 5 [0067.576] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP", pszSpec="*.7z") returned 0 [0067.576] lstrlenA (lpString="*.7z") returned 4 [0067.576] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP", pszSpec="*.tar") returned 0 [0067.576] lstrlenA (lpString="*.tar") returned 5 [0067.576] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP", pszSpec="*.gzip") returned 0 [0067.576] lstrlenA (lpString="*.gzip") returned 6 [0067.576] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP", pszSpec="*.jpg") returned 0 [0067.576] lstrlenA (lpString="*.jpg") returned 5 [0067.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP", pszSpec="*.jpeg") returned 0 [0067.577] lstrlenA (lpString="*.jpeg") returned 6 [0067.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP", pszSpec="*.psd") returned 0 [0067.577] lstrlenA (lpString="*.psd") returned 5 [0067.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP", pszSpec="*.cdr") returned 0 [0067.577] lstrlenA (lpString="*.cdr") returned 5 [0067.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP", pszSpec="*.dwg") returned 0 [0067.577] lstrlenA (lpString="*.dwg") returned 5 [0067.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP", pszSpec="*.max") returned 0 [0067.577] lstrlenA (lpString="*.max") returned 5 [0067.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP", pszSpec="*.bmp") returned 1 [0067.577] lstrlenA (lpString="*.bmp") returned 5 [0067.577] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" [0067.577] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" [0067.577] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP." [0067.577] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.BD" [0067.577] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0067.577] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8 [0067.577] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x89bbb700, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc31d3596, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x89bbb700, dwHighDateTime=0x1d0ca66)) returned 1 [0067.577] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0067.577] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7d5c, lpOverlapped=0x0) returned 1 [0067.690] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned="J0101857.BMP" [0067.691] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0067.692] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7d5c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7d5c, lpOverlapped=0x0) returned 1 [0067.692] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.692] CloseHandle (hObject=0x1cc) returned 1 [0067.695] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.bd")) returned 1 [0067.696] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc31d8412, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101858.BMP", cAlternateFileName="")) returned 1 [0067.697] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.697] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0101858.BMP") returned -1 [0067.697] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0101858.BMP") returned -1 [0067.697] lstrcmpiA (lpString1="", lpString2="J0101858.BMP") returned -1 [0067.697] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned="J0101857.BMP" [0067.697] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.697] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.697] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.697] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.699] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0101858.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" [0067.699] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP", pszSpec="*.zip") returned 0 [0067.699] lstrlenA (lpString="*.zip") returned 5 [0067.699] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP", pszSpec="*.rar") returned 0 [0067.699] lstrlenA (lpString="*.rar") returned 5 [0067.699] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP", pszSpec="*.7z") returned 0 [0067.699] lstrlenA (lpString="*.7z") returned 4 [0067.699] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP", pszSpec="*.tar") returned 0 [0067.699] lstrlenA (lpString="*.tar") returned 5 [0067.699] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP", pszSpec="*.gzip") returned 0 [0067.699] lstrlenA (lpString="*.gzip") returned 6 [0067.699] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP", pszSpec="*.jpg") returned 0 [0067.699] lstrlenA (lpString="*.jpg") returned 5 [0067.699] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP", pszSpec="*.jpeg") returned 0 [0067.699] lstrlenA (lpString="*.jpeg") returned 6 [0067.699] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP", pszSpec="*.psd") returned 0 [0067.700] lstrlenA (lpString="*.psd") returned 5 [0067.700] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP", pszSpec="*.cdr") returned 0 [0067.700] lstrlenA (lpString="*.cdr") returned 5 [0067.700] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP", pszSpec="*.dwg") returned 0 [0067.700] lstrlenA (lpString="*.dwg") returned 5 [0067.700] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP", pszSpec="*.max") returned 0 [0067.700] lstrlenA (lpString="*.max") returned 5 [0067.700] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP", pszSpec="*.bmp") returned 1 [0067.700] lstrlenA (lpString="*.bmp") returned 5 [0067.700] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" [0067.700] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" [0067.700] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP." [0067.701] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.BD" [0067.701] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0067.701] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8 [0067.701] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x89bbb700, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc31d8412, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x89bbb700, dwHighDateTime=0x1d0ca66)) returned 1 [0067.701] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0067.701] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7d5c, lpOverlapped=0x0) returned 1 [0067.704] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned="J0101858.BMP" [0067.705] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0067.705] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7d5c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7d5c, lpOverlapped=0x0) returned 1 [0067.705] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.705] CloseHandle (hObject=0x1cc) returned 1 [0067.710] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.bd")) returned 1 [0067.711] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc31e3356, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101859.BMP", cAlternateFileName="")) returned 1 [0067.711] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.711] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0101859.BMP") returned -1 [0067.711] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0101859.BMP") returned -1 [0067.711] lstrcmpiA (lpString1="", lpString2="J0101859.BMP") returned -1 [0067.711] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned="J0101858.BMP" [0067.711] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.711] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.711] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.711] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.711] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0101859.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" [0067.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP", pszSpec="*.zip") returned 0 [0067.711] lstrlenA (lpString="*.zip") returned 5 [0067.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP", pszSpec="*.rar") returned 0 [0067.711] lstrlenA (lpString="*.rar") returned 5 [0067.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP", pszSpec="*.7z") returned 0 [0067.711] lstrlenA (lpString="*.7z") returned 4 [0067.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP", pszSpec="*.tar") returned 0 [0067.711] lstrlenA (lpString="*.tar") returned 5 [0067.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP", pszSpec="*.gzip") returned 0 [0067.711] lstrlenA (lpString="*.gzip") returned 6 [0067.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP", pszSpec="*.jpg") returned 0 [0067.711] lstrlenA (lpString="*.jpg") returned 5 [0067.712] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP", pszSpec="*.jpeg") returned 0 [0067.712] lstrlenA (lpString="*.jpeg") returned 6 [0067.712] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP", pszSpec="*.psd") returned 0 [0067.712] lstrlenA (lpString="*.psd") returned 5 [0067.712] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP", pszSpec="*.cdr") returned 0 [0067.712] lstrlenA (lpString="*.cdr") returned 5 [0067.712] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP", pszSpec="*.dwg") returned 0 [0067.712] lstrlenA (lpString="*.dwg") returned 5 [0067.712] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP", pszSpec="*.max") returned 0 [0067.712] lstrlenA (lpString="*.max") returned 5 [0067.712] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP", pszSpec="*.bmp") returned 1 [0067.712] lstrlenA (lpString="*.bmp") returned 5 [0067.712] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" [0067.712] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" [0067.712] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP." [0067.712] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.BD" [0067.712] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0067.712] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce0 [0067.712] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x89bbb700, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc31e3356, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x89bbb700, dwHighDateTime=0x1d0ca66)) returned 1 [0067.712] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0067.713] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7c84, lpOverlapped=0x0) returned 1 [0067.714] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned="J0101859.BMP" [0067.716] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0067.716] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7c84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7c84, lpOverlapped=0x0) returned 1 [0067.716] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.716] CloseHandle (hObject=0x1cc) returned 1 [0067.719] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.bd")) returned 1 [0067.722] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc31e9500, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101860.BMP", cAlternateFileName="")) returned 1 [0067.722] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.722] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0101860.BMP") returned -1 [0067.722] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0101860.BMP") returned -1 [0067.723] lstrcmpiA (lpString1="", lpString2="J0101860.BMP") returned -1 [0067.723] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned="J0101859.BMP" [0067.723] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.723] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.723] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.723] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.723] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0101860.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" [0067.723] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP", pszSpec="*.zip") returned 0 [0067.724] lstrlenA (lpString="*.zip") returned 5 [0067.724] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP", pszSpec="*.rar") returned 0 [0067.724] lstrlenA (lpString="*.rar") returned 5 [0067.724] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP", pszSpec="*.7z") returned 0 [0067.724] lstrlenA (lpString="*.7z") returned 4 [0067.724] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP", pszSpec="*.tar") returned 0 [0067.724] lstrlenA (lpString="*.tar") returned 5 [0067.724] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP", pszSpec="*.gzip") returned 0 [0067.724] lstrlenA (lpString="*.gzip") returned 6 [0067.724] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP", pszSpec="*.jpg") returned 0 [0067.724] lstrlenA (lpString="*.jpg") returned 5 [0067.724] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP", pszSpec="*.jpeg") returned 0 [0067.724] lstrlenA (lpString="*.jpeg") returned 6 [0067.725] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP", pszSpec="*.psd") returned 0 [0067.725] lstrlenA (lpString="*.psd") returned 5 [0067.725] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP", pszSpec="*.cdr") returned 0 [0067.725] lstrlenA (lpString="*.cdr") returned 5 [0067.725] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP", pszSpec="*.dwg") returned 0 [0067.725] lstrlenA (lpString="*.dwg") returned 5 [0067.725] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP", pszSpec="*.max") returned 0 [0067.725] lstrlenA (lpString="*.max") returned 5 [0067.725] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP", pszSpec="*.bmp") returned 1 [0067.725] lstrlenA (lpString="*.bmp") returned 5 [0067.725] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" [0067.726] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" [0067.726] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP." [0067.726] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.BD" [0067.726] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0067.728] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8 [0067.728] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x89bbb700, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc31e9500, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x89bbb700, dwHighDateTime=0x1d0ca66)) returned 1 [0067.728] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0067.728] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7d5c, lpOverlapped=0x0) returned 1 [0067.839] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned="J0101860.BMP" [0067.840] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0067.840] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7d5c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7d5c, lpOverlapped=0x0) returned 1 [0067.840] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.840] CloseHandle (hObject=0x1cc) returned 1 [0067.842] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.bd")) returned 1 [0067.843] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc31ef6ea, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101861.BMP", cAlternateFileName="")) returned 1 [0067.843] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.843] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0101861.BMP") returned -1 [0067.843] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0101861.BMP") returned -1 [0067.843] lstrcmpiA (lpString1="", lpString2="J0101861.BMP") returned -1 [0067.843] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned="J0101860.BMP" [0067.843] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.843] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.844] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.844] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.844] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0101861.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" [0067.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP", pszSpec="*.zip") returned 0 [0067.844] lstrlenA (lpString="*.zip") returned 5 [0067.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP", pszSpec="*.rar") returned 0 [0067.844] lstrlenA (lpString="*.rar") returned 5 [0067.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP", pszSpec="*.7z") returned 0 [0067.844] lstrlenA (lpString="*.7z") returned 4 [0067.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP", pszSpec="*.tar") returned 0 [0067.844] lstrlenA (lpString="*.tar") returned 5 [0067.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP", pszSpec="*.gzip") returned 0 [0067.844] lstrlenA (lpString="*.gzip") returned 6 [0067.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP", pszSpec="*.jpg") returned 0 [0067.844] lstrlenA (lpString="*.jpg") returned 5 [0067.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP", pszSpec="*.jpeg") returned 0 [0067.844] lstrlenA (lpString="*.jpeg") returned 6 [0067.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP", pszSpec="*.psd") returned 0 [0067.844] lstrlenA (lpString="*.psd") returned 5 [0067.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP", pszSpec="*.cdr") returned 0 [0067.844] lstrlenA (lpString="*.cdr") returned 5 [0067.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP", pszSpec="*.dwg") returned 0 [0067.844] lstrlenA (lpString="*.dwg") returned 5 [0067.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP", pszSpec="*.max") returned 0 [0067.844] lstrlenA (lpString="*.max") returned 5 [0067.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP", pszSpec="*.bmp") returned 1 [0067.844] lstrlenA (lpString="*.bmp") returned 5 [0067.844] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" [0067.845] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" [0067.845] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP." [0067.845] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.BD" [0067.845] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0067.845] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8 [0067.845] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x89bbb700, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc31ef6ea, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x89bbb700, dwHighDateTime=0x1d0ca66)) returned 1 [0067.845] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0067.845] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7d5c, lpOverlapped=0x0) returned 1 [0067.848] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned="J0101861.BMP" [0067.850] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0067.850] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7d5c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7d5c, lpOverlapped=0x0) returned 1 [0067.850] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.850] CloseHandle (hObject=0x1cc) returned 1 [0067.852] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.bd")) returned 1 [0067.853] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc31f585c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101862.BMP", cAlternateFileName="")) returned 1 [0067.853] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.853] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0101862.BMP") returned -1 [0067.853] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0101862.BMP") returned -1 [0067.853] lstrcmpiA (lpString1="", lpString2="J0101862.BMP") returned -1 [0067.853] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned="J0101861.BMP" [0067.853] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.854] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.854] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.854] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.854] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0101862.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" [0067.854] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP", pszSpec="*.zip") returned 0 [0067.854] lstrlenA (lpString="*.zip") returned 5 [0067.854] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP", pszSpec="*.rar") returned 0 [0067.854] lstrlenA (lpString="*.rar") returned 5 [0067.854] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP", pszSpec="*.7z") returned 0 [0067.854] lstrlenA (lpString="*.7z") returned 4 [0067.854] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP", pszSpec="*.tar") returned 0 [0067.854] lstrlenA (lpString="*.tar") returned 5 [0067.854] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP", pszSpec="*.gzip") returned 0 [0067.854] lstrlenA (lpString="*.gzip") returned 6 [0067.854] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP", pszSpec="*.jpg") returned 0 [0067.854] lstrlenA (lpString="*.jpg") returned 5 [0067.855] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP", pszSpec="*.jpeg") returned 0 [0067.855] lstrlenA (lpString="*.jpeg") returned 6 [0067.855] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP", pszSpec="*.psd") returned 0 [0067.855] lstrlenA (lpString="*.psd") returned 5 [0067.855] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP", pszSpec="*.cdr") returned 0 [0067.855] lstrlenA (lpString="*.cdr") returned 5 [0067.855] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP", pszSpec="*.dwg") returned 0 [0067.855] lstrlenA (lpString="*.dwg") returned 5 [0067.855] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP", pszSpec="*.max") returned 0 [0067.855] lstrlenA (lpString="*.max") returned 5 [0067.855] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP", pszSpec="*.bmp") returned 1 [0067.855] lstrlenA (lpString="*.bmp") returned 5 [0067.855] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" [0067.855] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" [0067.855] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP." [0067.855] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.BD" [0067.855] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0067.856] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8 [0067.856] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x89bbb700, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc31f585c, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x89bbb700, dwHighDateTime=0x1d0ca66)) returned 1 [0067.856] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0067.856] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7d5c, lpOverlapped=0x0) returned 1 [0067.860] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned="J0101862.BMP" [0067.861] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0067.861] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7d5c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7d5c, lpOverlapped=0x0) returned 1 [0067.861] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.861] CloseHandle (hObject=0x1cc) returned 1 [0067.863] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.bd")) returned 1 [0067.864] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc31fb9f3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101863.BMP", cAlternateFileName="")) returned 1 [0067.864] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.864] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0101863.BMP") returned -1 [0067.864] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0101863.BMP") returned -1 [0067.864] lstrcmpiA (lpString1="", lpString2="J0101863.BMP") returned -1 [0067.864] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned="J0101862.BMP" [0067.864] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.864] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.864] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.864] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.864] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0101863.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" [0067.864] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP", pszSpec="*.zip") returned 0 [0067.864] lstrlenA (lpString="*.zip") returned 5 [0067.864] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP", pszSpec="*.rar") returned 0 [0067.864] lstrlenA (lpString="*.rar") returned 5 [0067.864] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP", pszSpec="*.7z") returned 0 [0067.864] lstrlenA (lpString="*.7z") returned 4 [0067.865] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP", pszSpec="*.tar") returned 0 [0067.865] lstrlenA (lpString="*.tar") returned 5 [0067.865] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP", pszSpec="*.gzip") returned 0 [0067.865] lstrlenA (lpString="*.gzip") returned 6 [0067.865] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP", pszSpec="*.jpg") returned 0 [0067.865] lstrlenA (lpString="*.jpg") returned 5 [0067.865] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP", pszSpec="*.jpeg") returned 0 [0067.865] lstrlenA (lpString="*.jpeg") returned 6 [0067.865] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP", pszSpec="*.psd") returned 0 [0067.865] lstrlenA (lpString="*.psd") returned 5 [0067.865] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP", pszSpec="*.cdr") returned 0 [0067.865] lstrlenA (lpString="*.cdr") returned 5 [0067.865] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP", pszSpec="*.dwg") returned 0 [0067.865] lstrlenA (lpString="*.dwg") returned 5 [0067.865] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP", pszSpec="*.max") returned 0 [0067.865] lstrlenA (lpString="*.max") returned 5 [0067.865] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP", pszSpec="*.bmp") returned 1 [0067.865] lstrlenA (lpString="*.bmp") returned 5 [0067.865] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" [0067.865] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" [0067.865] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP." [0067.865] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.BD" [0067.865] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0067.866] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8 [0067.866] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x89bbb700, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc31fb9f3, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x89bbb700, dwHighDateTime=0x1d0ca66)) returned 1 [0067.866] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0067.866] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7d5c, lpOverlapped=0x0) returned 1 [0067.869] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned="J0101863.BMP" [0067.869] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0067.870] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7d5c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7d5c, lpOverlapped=0x0) returned 1 [0067.870] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.870] CloseHandle (hObject=0x1cc) returned 1 [0067.871] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.bd")) returned 1 [0067.872] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3201be6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101864.BMP", cAlternateFileName="")) returned 1 [0067.872] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.872] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0101864.BMP") returned -1 [0067.872] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0101864.BMP") returned -1 [0067.872] lstrcmpiA (lpString1="", lpString2="J0101864.BMP") returned -1 [0067.872] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned="J0101863.BMP" [0067.872] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.872] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.872] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.872] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.872] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0101864.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" [0067.872] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP", pszSpec="*.zip") returned 0 [0067.872] lstrlenA (lpString="*.zip") returned 5 [0067.872] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP", pszSpec="*.rar") returned 0 [0067.872] lstrlenA (lpString="*.rar") returned 5 [0067.872] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP", pszSpec="*.7z") returned 0 [0067.872] lstrlenA (lpString="*.7z") returned 4 [0067.872] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP", pszSpec="*.tar") returned 0 [0067.872] lstrlenA (lpString="*.tar") returned 5 [0067.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP", pszSpec="*.gzip") returned 0 [0067.873] lstrlenA (lpString="*.gzip") returned 6 [0067.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP", pszSpec="*.jpg") returned 0 [0067.873] lstrlenA (lpString="*.jpg") returned 5 [0067.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP", pszSpec="*.jpeg") returned 0 [0067.873] lstrlenA (lpString="*.jpeg") returned 6 [0067.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP", pszSpec="*.psd") returned 0 [0067.873] lstrlenA (lpString="*.psd") returned 5 [0067.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP", pszSpec="*.cdr") returned 0 [0067.873] lstrlenA (lpString="*.cdr") returned 5 [0067.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP", pszSpec="*.dwg") returned 0 [0067.873] lstrlenA (lpString="*.dwg") returned 5 [0067.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP", pszSpec="*.max") returned 0 [0067.873] lstrlenA (lpString="*.max") returned 5 [0067.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP", pszSpec="*.bmp") returned 1 [0067.873] lstrlenA (lpString="*.bmp") returned 5 [0067.873] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" [0067.873] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" [0067.873] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP." [0067.873] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.BD" [0067.873] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0067.874] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce0 [0067.874] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x89bbb700, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc3201be6, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x89bbb700, dwHighDateTime=0x1d0ca66)) returned 1 [0067.874] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0067.874] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7c84, lpOverlapped=0x0) returned 1 [0067.876] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned="J0101864.BMP" [0067.876] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0067.876] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7c84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7c84, lpOverlapped=0x0) returned 1 [0067.877] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.877] CloseHandle (hObject=0x1cc) returned 1 [0067.878] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.bd")) returned 1 [0067.879] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaddaa59d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101865.BMP", cAlternateFileName="")) returned 1 [0067.879] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.879] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0101865.BMP") returned -1 [0067.879] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0101865.BMP") returned -1 [0067.879] lstrcmpiA (lpString1="", lpString2="J0101865.BMP") returned -1 [0067.879] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned="J0101864.BMP" [0067.879] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.879] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.879] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.879] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.879] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0101865.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" [0067.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP", pszSpec="*.zip") returned 0 [0067.879] lstrlenA (lpString="*.zip") returned 5 [0067.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP", pszSpec="*.rar") returned 0 [0067.879] lstrlenA (lpString="*.rar") returned 5 [0067.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP", pszSpec="*.7z") returned 0 [0067.879] lstrlenA (lpString="*.7z") returned 4 [0067.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP", pszSpec="*.tar") returned 0 [0067.879] lstrlenA (lpString="*.tar") returned 5 [0067.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP", pszSpec="*.gzip") returned 0 [0067.879] lstrlenA (lpString="*.gzip") returned 6 [0067.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP", pszSpec="*.jpg") returned 0 [0067.879] lstrlenA (lpString="*.jpg") returned 5 [0067.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP", pszSpec="*.jpeg") returned 0 [0067.879] lstrlenA (lpString="*.jpeg") returned 6 [0067.880] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP", pszSpec="*.psd") returned 0 [0067.880] lstrlenA (lpString="*.psd") returned 5 [0067.880] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP", pszSpec="*.cdr") returned 0 [0067.880] lstrlenA (lpString="*.cdr") returned 5 [0067.880] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP", pszSpec="*.dwg") returned 0 [0067.880] lstrlenA (lpString="*.dwg") returned 5 [0067.880] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP", pszSpec="*.max") returned 0 [0067.880] lstrlenA (lpString="*.max") returned 5 [0067.880] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP", pszSpec="*.bmp") returned 1 [0067.880] lstrlenA (lpString="*.bmp") returned 5 [0067.880] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" [0067.880] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" [0067.880] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP." [0067.880] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.BD" [0067.880] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0067.883] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8 [0067.883] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x89bbb700, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xaddaa59d, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x89bbb700, dwHighDateTime=0x1d0ca66)) returned 1 [0067.883] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0067.883] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7d5c, lpOverlapped=0x0) returned 1 [0067.887] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned="J0101865.BMP" [0067.887] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0067.887] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7d5c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7d5c, lpOverlapped=0x0) returned 1 [0067.888] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.888] CloseHandle (hObject=0x1cc) returned 1 [0067.889] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.bd")) returned 1 [0067.890] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3207d6f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101866.BMP", cAlternateFileName="")) returned 1 [0067.893] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.893] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0101866.BMP") returned -1 [0067.893] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0101866.BMP") returned -1 [0067.893] lstrcmpiA (lpString1="", lpString2="J0101866.BMP") returned -1 [0067.893] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned="J0101865.BMP" [0067.893] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.893] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.893] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.893] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.893] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0101866.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" [0067.893] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP", pszSpec="*.zip") returned 0 [0067.893] lstrlenA (lpString="*.zip") returned 5 [0067.893] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP", pszSpec="*.rar") returned 0 [0067.893] lstrlenA (lpString="*.rar") returned 5 [0067.893] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP", pszSpec="*.7z") returned 0 [0067.893] lstrlenA (lpString="*.7z") returned 4 [0067.893] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP", pszSpec="*.tar") returned 0 [0067.893] lstrlenA (lpString="*.tar") returned 5 [0067.893] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP", pszSpec="*.gzip") returned 0 [0067.893] lstrlenA (lpString="*.gzip") returned 6 [0067.893] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP", pszSpec="*.jpg") returned 0 [0067.893] lstrlenA (lpString="*.jpg") returned 5 [0067.893] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP", pszSpec="*.jpeg") returned 0 [0067.893] lstrlenA (lpString="*.jpeg") returned 6 [0067.893] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP", pszSpec="*.psd") returned 0 [0067.893] lstrlenA (lpString="*.psd") returned 5 [0067.893] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP", pszSpec="*.cdr") returned 0 [0067.894] lstrlenA (lpString="*.cdr") returned 5 [0067.894] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP", pszSpec="*.dwg") returned 0 [0067.894] lstrlenA (lpString="*.dwg") returned 5 [0067.894] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP", pszSpec="*.max") returned 0 [0067.894] lstrlenA (lpString="*.max") returned 5 [0067.894] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP", pszSpec="*.bmp") returned 1 [0067.894] lstrlenA (lpString="*.bmp") returned 5 [0067.894] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" [0067.894] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" [0067.894] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP." [0067.894] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.BD" [0067.894] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0067.894] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8 [0067.894] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x89bbb700, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc3207d6f, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x89bbb700, dwHighDateTime=0x1d0ca66)) returned 1 [0067.894] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0067.894] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7d5c, lpOverlapped=0x0) returned 1 [0067.896] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned="J0101866.BMP" [0067.897] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0067.897] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7d5c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7d5c, lpOverlapped=0x0) returned 1 [0067.898] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.898] CloseHandle (hObject=0x1cc) returned 1 [0067.900] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.bd")) returned 1 [0067.900] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc320f269, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101867.BMP", cAlternateFileName="")) returned 1 [0067.900] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.900] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0101867.BMP") returned -1 [0067.900] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0101867.BMP") returned -1 [0067.900] lstrcmpiA (lpString1="", lpString2="J0101867.BMP") returned -1 [0067.900] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned="J0101866.BMP" [0067.900] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.900] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.900] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.900] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.901] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0101867.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" [0067.901] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP", pszSpec="*.zip") returned 0 [0067.901] lstrlenA (lpString="*.zip") returned 5 [0067.901] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP", pszSpec="*.rar") returned 0 [0067.901] lstrlenA (lpString="*.rar") returned 5 [0067.901] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP", pszSpec="*.7z") returned 0 [0067.901] lstrlenA (lpString="*.7z") returned 4 [0067.901] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP", pszSpec="*.tar") returned 0 [0067.901] lstrlenA (lpString="*.tar") returned 5 [0067.901] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP", pszSpec="*.gzip") returned 0 [0067.901] lstrlenA (lpString="*.gzip") returned 6 [0067.901] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP", pszSpec="*.jpg") returned 0 [0067.901] lstrlenA (lpString="*.jpg") returned 5 [0067.901] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP", pszSpec="*.jpeg") returned 0 [0067.901] lstrlenA (lpString="*.jpeg") returned 6 [0067.901] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP", pszSpec="*.psd") returned 0 [0067.901] lstrlenA (lpString="*.psd") returned 5 [0067.901] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP", pszSpec="*.cdr") returned 0 [0067.901] lstrlenA (lpString="*.cdr") returned 5 [0067.901] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP", pszSpec="*.dwg") returned 0 [0067.901] lstrlenA (lpString="*.dwg") returned 5 [0067.901] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP", pszSpec="*.max") returned 0 [0067.901] lstrlenA (lpString="*.max") returned 5 [0067.901] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP", pszSpec="*.bmp") returned 1 [0067.901] lstrlenA (lpString="*.bmp") returned 5 [0067.901] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" [0067.901] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" [0067.901] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP." [0067.901] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.BD" [0067.901] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0067.902] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7f68 [0067.902] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x89bbb700, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc320f269, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x89bbb700, dwHighDateTime=0x1d0ca66)) returned 1 [0067.902] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0067.902] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7f0c, lpOverlapped=0x0) returned 1 [0067.903] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned="J0101867.BMP" [0067.904] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0067.904] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7f0c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7f0c, lpOverlapped=0x0) returned 1 [0067.905] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.905] CloseHandle (hObject=0x1cc) returned 1 [0067.906] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.bd")) returned 1 [0067.907] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32154bf, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3ee8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101980.WMF", cAlternateFileName="")) returned 1 [0067.907] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.907] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0101980.WMF") returned -1 [0067.907] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0101980.WMF") returned -1 [0067.907] lstrcmpiA (lpString1="", lpString2="J0101980.WMF") returned -1 [0067.907] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned="J0101867.BMP" [0067.907] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.907] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.907] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.907] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.907] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0101980.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" [0067.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.zip") returned 0 [0067.907] lstrlenA (lpString="*.zip") returned 5 [0067.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.rar") returned 0 [0067.907] lstrlenA (lpString="*.rar") returned 5 [0067.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.7z") returned 0 [0067.907] lstrlenA (lpString="*.7z") returned 4 [0067.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.tar") returned 0 [0067.908] lstrlenA (lpString="*.tar") returned 5 [0067.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.gzip") returned 0 [0067.908] lstrlenA (lpString="*.gzip") returned 6 [0067.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.jpg") returned 0 [0067.908] lstrlenA (lpString="*.jpg") returned 5 [0067.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.jpeg") returned 0 [0067.908] lstrlenA (lpString="*.jpeg") returned 6 [0067.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.psd") returned 0 [0067.908] lstrlenA (lpString="*.psd") returned 5 [0067.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.cdr") returned 0 [0067.908] lstrlenA (lpString="*.cdr") returned 5 [0067.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.dwg") returned 0 [0067.908] lstrlenA (lpString="*.dwg") returned 5 [0067.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.max") returned 0 [0067.908] lstrlenA (lpString="*.max") returned 5 [0067.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.bmp") returned 0 [0067.908] lstrlenA (lpString="*.bmp") returned 5 [0067.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.gif") returned 0 [0067.908] lstrlenA (lpString="*.gif") returned 5 [0067.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.png") returned 0 [0067.908] lstrlenA (lpString="*.png") returned 5 [0067.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.doc") returned 0 [0067.908] lstrlenA (lpString="*.doc") returned 5 [0067.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.docx") returned 0 [0067.908] lstrlenA (lpString="*.docx") returned 6 [0067.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.xls") returned 0 [0067.908] lstrlenA (lpString="*.xls") returned 5 [0067.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.xlsx") returned 0 [0067.908] lstrlenA (lpString="*.xlsx") returned 6 [0067.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.ppt") returned 0 [0067.908] lstrlenA (lpString="*.ppt") returned 5 [0067.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.pptx") returned 0 [0067.908] lstrlenA (lpString="*.pptx") returned 6 [0067.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.txt") returned 0 [0067.909] lstrlenA (lpString="*.txt") returned 5 [0067.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.pdf") returned 0 [0067.909] lstrlenA (lpString="*.pdf") returned 5 [0067.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.djvu") returned 0 [0067.909] lstrlenA (lpString="*.djvu") returned 6 [0067.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.htm") returned 0 [0067.909] lstrlenA (lpString="*.htm") returned 5 [0067.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.html") returned 0 [0067.909] lstrlenA (lpString="*.html") returned 6 [0067.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.mdb") returned 0 [0067.909] lstrlenA (lpString="*.mdb") returned 5 [0067.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.cer") returned 0 [0067.909] lstrlenA (lpString="*.cer") returned 5 [0067.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.p12") returned 0 [0067.909] lstrlenA (lpString="*.p12") returned 5 [0067.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.pfx") returned 0 [0067.909] lstrlenA (lpString="*.pfx") returned 5 [0067.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.kwm") returned 0 [0067.909] lstrlenA (lpString="*.kwm") returned 5 [0067.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.pwm") returned 0 [0067.909] lstrlenA (lpString="*.pwm") returned 5 [0067.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.1cd") returned 0 [0067.909] lstrlenA (lpString="*.1cd") returned 5 [0067.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.md") returned 0 [0067.909] lstrlenA (lpString="*.md") returned 4 [0067.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.mdf") returned 0 [0067.909] lstrlenA (lpString="*.mdf") returned 5 [0067.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.dbf") returned 0 [0067.909] lstrlenA (lpString="*.dbf") returned 5 [0067.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.odt") returned 0 [0067.909] lstrlenA (lpString="*.odt") returned 5 [0067.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.vob") returned 0 [0067.910] lstrlenA (lpString="*.vob") returned 5 [0067.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.ifo") returned 0 [0067.910] lstrlenA (lpString="*.ifo") returned 5 [0067.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.lnk") returned 0 [0067.910] lstrlenA (lpString="*.lnk") returned 5 [0067.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.torrent") returned 0 [0067.910] lstrlenA (lpString="*.torrent") returned 9 [0067.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.mov") returned 0 [0067.910] lstrlenA (lpString="*.mov") returned 5 [0067.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.m2v") returned 0 [0067.910] lstrlenA (lpString="*.m2v") returned 5 [0067.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.3gp") returned 0 [0067.910] lstrlenA (lpString="*.3gp") returned 5 [0067.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.mpeg") returned 0 [0067.910] lstrlenA (lpString="*.mpeg") returned 6 [0067.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.mpg") returned 0 [0067.910] lstrlenA (lpString="*.mpg") returned 5 [0067.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.flv") returned 0 [0067.910] lstrlenA (lpString="*.flv") returned 5 [0067.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.avi") returned 0 [0067.910] lstrlenA (lpString="*.avi") returned 5 [0067.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.mp4") returned 0 [0067.910] lstrlenA (lpString="*.mp4") returned 5 [0067.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.wmv") returned 0 [0067.910] lstrlenA (lpString="*.wmv") returned 5 [0067.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.divx") returned 0 [0067.910] lstrlenA (lpString="*.divx") returned 6 [0067.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.mkv") returned 0 [0067.910] lstrlenA (lpString="*.mkv") returned 5 [0067.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.mp3") returned 0 [0067.910] lstrlenA (lpString="*.mp3") returned 5 [0067.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.wav") returned 0 [0067.911] lstrlenA (lpString="*.wav") returned 5 [0067.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.flac") returned 0 [0067.911] lstrlenA (lpString="*.flac") returned 6 [0067.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.ape") returned 0 [0067.911] lstrlenA (lpString="*.ape") returned 5 [0067.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.wma") returned 0 [0067.911] lstrlenA (lpString="*.wma") returned 5 [0067.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.ac3") returned 0 [0067.911] lstrlenA (lpString="*.ac3") returned 5 [0067.911] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc321a320, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0102002.WMF", cAlternateFileName="")) returned 1 [0067.911] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.911] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0102002.WMF") returned -1 [0067.911] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0102002.WMF") returned -1 [0067.911] lstrcmpiA (lpString1="", lpString2="J0102002.WMF") returned -1 [0067.911] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned="J0101980.WMF" [0067.911] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.911] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.911] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.911] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.911] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0102002.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" [0067.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.zip") returned 0 [0067.911] lstrlenA (lpString="*.zip") returned 5 [0067.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.rar") returned 0 [0067.911] lstrlenA (lpString="*.rar") returned 5 [0067.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.7z") returned 0 [0067.911] lstrlenA (lpString="*.7z") returned 4 [0067.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.tar") returned 0 [0067.911] lstrlenA (lpString="*.tar") returned 5 [0067.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.gzip") returned 0 [0067.912] lstrlenA (lpString="*.gzip") returned 6 [0067.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.jpg") returned 0 [0067.912] lstrlenA (lpString="*.jpg") returned 5 [0067.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.jpeg") returned 0 [0067.912] lstrlenA (lpString="*.jpeg") returned 6 [0067.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.psd") returned 0 [0067.912] lstrlenA (lpString="*.psd") returned 5 [0067.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.cdr") returned 0 [0067.912] lstrlenA (lpString="*.cdr") returned 5 [0067.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.dwg") returned 0 [0067.912] lstrlenA (lpString="*.dwg") returned 5 [0067.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.max") returned 0 [0067.912] lstrlenA (lpString="*.max") returned 5 [0067.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.bmp") returned 0 [0067.912] lstrlenA (lpString="*.bmp") returned 5 [0067.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.gif") returned 0 [0067.912] lstrlenA (lpString="*.gif") returned 5 [0067.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.png") returned 0 [0067.912] lstrlenA (lpString="*.png") returned 5 [0067.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.doc") returned 0 [0067.912] lstrlenA (lpString="*.doc") returned 5 [0067.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.docx") returned 0 [0067.912] lstrlenA (lpString="*.docx") returned 6 [0067.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.xls") returned 0 [0067.912] lstrlenA (lpString="*.xls") returned 5 [0067.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.xlsx") returned 0 [0067.912] lstrlenA (lpString="*.xlsx") returned 6 [0067.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.ppt") returned 0 [0067.912] lstrlenA (lpString="*.ppt") returned 5 [0067.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.pptx") returned 0 [0067.912] lstrlenA (lpString="*.pptx") returned 6 [0067.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.txt") returned 0 [0067.913] lstrlenA (lpString="*.txt") returned 5 [0067.913] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.pdf") returned 0 [0067.913] lstrlenA (lpString="*.pdf") returned 5 [0067.913] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.djvu") returned 0 [0067.913] lstrlenA (lpString="*.djvu") returned 6 [0067.913] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.htm") returned 0 [0067.913] lstrlenA (lpString="*.htm") returned 5 [0067.913] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.html") returned 0 [0067.913] lstrlenA (lpString="*.html") returned 6 [0067.913] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.mdb") returned 0 [0067.913] lstrlenA (lpString="*.mdb") returned 5 [0067.913] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.cer") returned 0 [0067.913] lstrlenA (lpString="*.cer") returned 5 [0067.913] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.p12") returned 0 [0067.913] lstrlenA (lpString="*.p12") returned 5 [0067.913] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.pfx") returned 0 [0067.913] lstrlenA (lpString="*.pfx") returned 5 [0067.913] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.kwm") returned 0 [0067.913] lstrlenA (lpString="*.kwm") returned 5 [0067.913] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.pwm") returned 0 [0067.913] lstrlenA (lpString="*.pwm") returned 5 [0067.913] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.1cd") returned 0 [0067.913] lstrlenA (lpString="*.1cd") returned 5 [0067.913] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.md") returned 0 [0067.913] lstrlenA (lpString="*.md") returned 4 [0067.913] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.mdf") returned 0 [0067.913] lstrlenA (lpString="*.mdf") returned 5 [0067.913] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.dbf") returned 0 [0067.913] lstrlenA (lpString="*.dbf") returned 5 [0067.913] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.odt") returned 0 [0067.913] lstrlenA (lpString="*.odt") returned 5 [0067.914] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.vob") returned 0 [0067.914] lstrlenA (lpString="*.vob") returned 5 [0067.914] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.ifo") returned 0 [0067.914] lstrlenA (lpString="*.ifo") returned 5 [0067.914] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.lnk") returned 0 [0067.914] lstrlenA (lpString="*.lnk") returned 5 [0067.914] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.torrent") returned 0 [0067.914] lstrlenA (lpString="*.torrent") returned 9 [0067.914] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.mov") returned 0 [0067.914] lstrlenA (lpString="*.mov") returned 5 [0067.914] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.m2v") returned 0 [0067.914] lstrlenA (lpString="*.m2v") returned 5 [0067.914] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.3gp") returned 0 [0067.914] lstrlenA (lpString="*.3gp") returned 5 [0067.914] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.mpeg") returned 0 [0067.914] lstrlenA (lpString="*.mpeg") returned 6 [0067.914] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.mpg") returned 0 [0067.914] lstrlenA (lpString="*.mpg") returned 5 [0067.914] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.flv") returned 0 [0067.914] lstrlenA (lpString="*.flv") returned 5 [0067.914] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.avi") returned 0 [0067.914] lstrlenA (lpString="*.avi") returned 5 [0067.914] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.mp4") returned 0 [0067.914] lstrlenA (lpString="*.mp4") returned 5 [0067.914] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.wmv") returned 0 [0067.914] lstrlenA (lpString="*.wmv") returned 5 [0067.914] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.divx") returned 0 [0067.914] lstrlenA (lpString="*.divx") returned 6 [0067.914] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.mkv") returned 0 [0067.914] lstrlenA (lpString="*.mkv") returned 5 [0067.914] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.mp3") returned 0 [0067.914] lstrlenA (lpString="*.mp3") returned 5 [0067.914] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.wav") returned 0 [0067.915] lstrlenA (lpString="*.wav") returned 5 [0067.915] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.flac") returned 0 [0067.915] lstrlenA (lpString="*.flac") returned 6 [0067.915] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.ape") returned 0 [0067.915] lstrlenA (lpString="*.ape") returned 5 [0067.915] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.wma") returned 0 [0067.915] lstrlenA (lpString="*.wma") returned 5 [0067.915] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.ac3") returned 0 [0067.915] lstrlenA (lpString="*.ac3") returned 5 [0067.915] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3220438, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6978, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0102594.WMF", cAlternateFileName="")) returned 1 [0067.915] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.915] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0102594.WMF") returned -1 [0067.915] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0102594.WMF") returned -1 [0067.915] lstrcmpiA (lpString1="", lpString2="J0102594.WMF") returned -1 [0067.915] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned="J0102002.WMF" [0067.915] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.915] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.915] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.915] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.916] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0102594.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" [0067.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.zip") returned 0 [0067.916] lstrlenA (lpString="*.zip") returned 5 [0067.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.rar") returned 0 [0067.916] lstrlenA (lpString="*.rar") returned 5 [0067.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.7z") returned 0 [0067.916] lstrlenA (lpString="*.7z") returned 4 [0067.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.tar") returned 0 [0067.916] lstrlenA (lpString="*.tar") returned 5 [0067.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.gzip") returned 0 [0067.916] lstrlenA (lpString="*.gzip") returned 6 [0067.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.jpg") returned 0 [0067.916] lstrlenA (lpString="*.jpg") returned 5 [0067.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.jpeg") returned 0 [0067.916] lstrlenA (lpString="*.jpeg") returned 6 [0067.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.psd") returned 0 [0067.916] lstrlenA (lpString="*.psd") returned 5 [0067.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.cdr") returned 0 [0067.916] lstrlenA (lpString="*.cdr") returned 5 [0067.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.dwg") returned 0 [0067.916] lstrlenA (lpString="*.dwg") returned 5 [0067.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.max") returned 0 [0067.916] lstrlenA (lpString="*.max") returned 5 [0067.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.bmp") returned 0 [0067.916] lstrlenA (lpString="*.bmp") returned 5 [0067.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.gif") returned 0 [0067.916] lstrlenA (lpString="*.gif") returned 5 [0067.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.png") returned 0 [0067.916] lstrlenA (lpString="*.png") returned 5 [0067.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.doc") returned 0 [0067.916] lstrlenA (lpString="*.doc") returned 5 [0067.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.docx") returned 0 [0067.917] lstrlenA (lpString="*.docx") returned 6 [0067.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.xls") returned 0 [0067.917] lstrlenA (lpString="*.xls") returned 5 [0067.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.xlsx") returned 0 [0067.917] lstrlenA (lpString="*.xlsx") returned 6 [0067.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.ppt") returned 0 [0067.917] lstrlenA (lpString="*.ppt") returned 5 [0067.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.pptx") returned 0 [0067.917] lstrlenA (lpString="*.pptx") returned 6 [0067.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.txt") returned 0 [0067.917] lstrlenA (lpString="*.txt") returned 5 [0067.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.pdf") returned 0 [0067.917] lstrlenA (lpString="*.pdf") returned 5 [0067.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.djvu") returned 0 [0067.917] lstrlenA (lpString="*.djvu") returned 6 [0067.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.htm") returned 0 [0067.917] lstrlenA (lpString="*.htm") returned 5 [0067.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.html") returned 0 [0067.917] lstrlenA (lpString="*.html") returned 6 [0067.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.mdb") returned 0 [0067.917] lstrlenA (lpString="*.mdb") returned 5 [0067.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.cer") returned 0 [0067.917] lstrlenA (lpString="*.cer") returned 5 [0067.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.p12") returned 0 [0067.917] lstrlenA (lpString="*.p12") returned 5 [0067.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.pfx") returned 0 [0067.917] lstrlenA (lpString="*.pfx") returned 5 [0067.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.kwm") returned 0 [0067.917] lstrlenA (lpString="*.kwm") returned 5 [0067.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.pwm") returned 0 [0067.917] lstrlenA (lpString="*.pwm") returned 5 [0067.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.1cd") returned 0 [0067.918] lstrlenA (lpString="*.1cd") returned 5 [0067.918] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.md") returned 0 [0067.918] lstrlenA (lpString="*.md") returned 4 [0067.918] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.mdf") returned 0 [0067.918] lstrlenA (lpString="*.mdf") returned 5 [0067.918] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.dbf") returned 0 [0067.918] lstrlenA (lpString="*.dbf") returned 5 [0067.918] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.odt") returned 0 [0067.918] lstrlenA (lpString="*.odt") returned 5 [0067.918] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.vob") returned 0 [0067.918] lstrlenA (lpString="*.vob") returned 5 [0067.918] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.ifo") returned 0 [0067.918] lstrlenA (lpString="*.ifo") returned 5 [0067.918] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.lnk") returned 0 [0067.918] lstrlenA (lpString="*.lnk") returned 5 [0067.918] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.torrent") returned 0 [0067.918] lstrlenA (lpString="*.torrent") returned 9 [0067.918] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.mov") returned 0 [0067.918] lstrlenA (lpString="*.mov") returned 5 [0067.918] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.m2v") returned 0 [0067.918] lstrlenA (lpString="*.m2v") returned 5 [0067.918] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.3gp") returned 0 [0067.918] lstrlenA (lpString="*.3gp") returned 5 [0067.918] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.mpeg") returned 0 [0067.918] lstrlenA (lpString="*.mpeg") returned 6 [0067.918] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.mpg") returned 0 [0067.918] lstrlenA (lpString="*.mpg") returned 5 [0067.918] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.flv") returned 0 [0067.918] lstrlenA (lpString="*.flv") returned 5 [0067.918] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.avi") returned 0 [0067.918] lstrlenA (lpString="*.avi") returned 5 [0067.918] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.mp4") returned 0 [0067.918] lstrlenA (lpString="*.mp4") returned 5 [0067.919] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.wmv") returned 0 [0067.919] lstrlenA (lpString="*.wmv") returned 5 [0067.919] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.divx") returned 0 [0067.919] lstrlenA (lpString="*.divx") returned 6 [0067.919] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.mkv") returned 0 [0067.919] lstrlenA (lpString="*.mkv") returned 5 [0067.919] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.mp3") returned 0 [0067.919] lstrlenA (lpString="*.mp3") returned 5 [0067.919] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.wav") returned 0 [0067.919] lstrlenA (lpString="*.wav") returned 5 [0067.919] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.flac") returned 0 [0067.919] lstrlenA (lpString="*.flac") returned 6 [0067.919] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.ape") returned 0 [0067.919] lstrlenA (lpString="*.ape") returned 5 [0067.919] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.wma") returned 0 [0067.919] lstrlenA (lpString="*.wma") returned 5 [0067.919] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.ac3") returned 0 [0067.919] lstrlenA (lpString="*.ac3") returned 5 [0067.919] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3225217, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2bd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0102762.WMF", cAlternateFileName="")) returned 1 [0067.919] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.919] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0102762.WMF") returned -1 [0067.919] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0102762.WMF") returned -1 [0067.919] lstrcmpiA (lpString1="", lpString2="J0102762.WMF") returned -1 [0067.919] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned="J0102594.WMF" [0067.919] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.919] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.919] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.919] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.919] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0102762.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.zip") returned 0 [0067.920] lstrlenA (lpString="*.zip") returned 5 [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.rar") returned 0 [0067.920] lstrlenA (lpString="*.rar") returned 5 [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.7z") returned 0 [0067.920] lstrlenA (lpString="*.7z") returned 4 [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.tar") returned 0 [0067.920] lstrlenA (lpString="*.tar") returned 5 [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.gzip") returned 0 [0067.920] lstrlenA (lpString="*.gzip") returned 6 [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.jpg") returned 0 [0067.920] lstrlenA (lpString="*.jpg") returned 5 [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.jpeg") returned 0 [0067.920] lstrlenA (lpString="*.jpeg") returned 6 [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.psd") returned 0 [0067.920] lstrlenA (lpString="*.psd") returned 5 [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.cdr") returned 0 [0067.920] lstrlenA (lpString="*.cdr") returned 5 [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.dwg") returned 0 [0067.920] lstrlenA (lpString="*.dwg") returned 5 [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.max") returned 0 [0067.920] lstrlenA (lpString="*.max") returned 5 [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.bmp") returned 0 [0067.920] lstrlenA (lpString="*.bmp") returned 5 [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.gif") returned 0 [0067.920] lstrlenA (lpString="*.gif") returned 5 [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.png") returned 0 [0067.920] lstrlenA (lpString="*.png") returned 5 [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.doc") returned 0 [0067.920] lstrlenA (lpString="*.doc") returned 5 [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.docx") returned 0 [0067.921] lstrlenA (lpString="*.docx") returned 6 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.xls") returned 0 [0067.921] lstrlenA (lpString="*.xls") returned 5 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.xlsx") returned 0 [0067.921] lstrlenA (lpString="*.xlsx") returned 6 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.ppt") returned 0 [0067.921] lstrlenA (lpString="*.ppt") returned 5 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.pptx") returned 0 [0067.921] lstrlenA (lpString="*.pptx") returned 6 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.txt") returned 0 [0067.921] lstrlenA (lpString="*.txt") returned 5 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.pdf") returned 0 [0067.921] lstrlenA (lpString="*.pdf") returned 5 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.djvu") returned 0 [0067.921] lstrlenA (lpString="*.djvu") returned 6 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.htm") returned 0 [0067.921] lstrlenA (lpString="*.htm") returned 5 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.html") returned 0 [0067.921] lstrlenA (lpString="*.html") returned 6 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.mdb") returned 0 [0067.921] lstrlenA (lpString="*.mdb") returned 5 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.cer") returned 0 [0067.921] lstrlenA (lpString="*.cer") returned 5 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.p12") returned 0 [0067.921] lstrlenA (lpString="*.p12") returned 5 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.pfx") returned 0 [0067.921] lstrlenA (lpString="*.pfx") returned 5 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.kwm") returned 0 [0067.921] lstrlenA (lpString="*.kwm") returned 5 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.pwm") returned 0 [0067.921] lstrlenA (lpString="*.pwm") returned 5 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.1cd") returned 0 [0067.921] lstrlenA (lpString="*.1cd") returned 5 [0067.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.md") returned 0 [0067.922] lstrlenA (lpString="*.md") returned 4 [0067.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.mdf") returned 0 [0067.922] lstrlenA (lpString="*.mdf") returned 5 [0067.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.dbf") returned 0 [0067.922] lstrlenA (lpString="*.dbf") returned 5 [0067.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.odt") returned 0 [0067.922] lstrlenA (lpString="*.odt") returned 5 [0067.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.vob") returned 0 [0067.922] lstrlenA (lpString="*.vob") returned 5 [0067.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.ifo") returned 0 [0067.922] lstrlenA (lpString="*.ifo") returned 5 [0067.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.lnk") returned 0 [0067.922] lstrlenA (lpString="*.lnk") returned 5 [0067.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.torrent") returned 0 [0067.922] lstrlenA (lpString="*.torrent") returned 9 [0067.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.mov") returned 0 [0067.922] lstrlenA (lpString="*.mov") returned 5 [0067.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.m2v") returned 0 [0067.922] lstrlenA (lpString="*.m2v") returned 5 [0067.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.3gp") returned 0 [0067.922] lstrlenA (lpString="*.3gp") returned 5 [0067.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.mpeg") returned 0 [0067.922] lstrlenA (lpString="*.mpeg") returned 6 [0067.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.mpg") returned 0 [0067.922] lstrlenA (lpString="*.mpg") returned 5 [0067.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.flv") returned 0 [0067.922] lstrlenA (lpString="*.flv") returned 5 [0067.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.avi") returned 0 [0067.922] lstrlenA (lpString="*.avi") returned 5 [0067.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.mp4") returned 0 [0067.922] lstrlenA (lpString="*.mp4") returned 5 [0067.923] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.wmv") returned 0 [0067.923] lstrlenA (lpString="*.wmv") returned 5 [0067.923] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.divx") returned 0 [0067.923] lstrlenA (lpString="*.divx") returned 6 [0067.923] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.mkv") returned 0 [0067.923] lstrlenA (lpString="*.mkv") returned 5 [0067.923] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.mp3") returned 0 [0067.923] lstrlenA (lpString="*.mp3") returned 5 [0067.923] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.wav") returned 0 [0067.923] lstrlenA (lpString="*.wav") returned 5 [0067.923] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.flac") returned 0 [0067.923] lstrlenA (lpString="*.flac") returned 6 [0067.923] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.ape") returned 0 [0067.923] lstrlenA (lpString="*.ape") returned 5 [0067.923] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.wma") returned 0 [0067.923] lstrlenA (lpString="*.wma") returned 5 [0067.923] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.ac3") returned 0 [0067.923] lstrlenA (lpString="*.ac3") returned 5 [0067.923] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaddaf331, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4290, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0102984.WMF", cAlternateFileName="")) returned 1 [0067.923] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.923] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0102984.WMF") returned -1 [0067.923] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0102984.WMF") returned -1 [0067.923] lstrcmpiA (lpString1="", lpString2="J0102984.WMF") returned -1 [0067.923] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned="J0102762.WMF" [0067.923] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.923] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.923] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.923] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.923] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0102984.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" [0067.923] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF", pszSpec="*.zip") returned 0 [0067.924] lstrlenA (lpString="*.zip") returned 5 [0067.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF", pszSpec="*.rar") returned 0 [0067.924] lstrlenA (lpString="*.rar") returned 5 [0067.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF", pszSpec="*.7z") returned 0 [0067.924] lstrlenA (lpString="*.7z") returned 4 [0067.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF", pszSpec="*.tar") returned 0 [0067.924] lstrlenA (lpString="*.tar") returned 5 [0067.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF", pszSpec="*.gzip") returned 0 [0067.924] lstrlenA (lpString="*.gzip") returned 6 [0067.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF", pszSpec="*.jpg") returned 0 [0067.924] lstrlenA (lpString="*.jpg") returned 5 [0067.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF", pszSpec="*.jpeg") returned 0 [0067.924] lstrlenA (lpString="*.jpeg") returned 6 [0067.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF", pszSpec="*.psd") returned 0 [0067.924] lstrlenA (lpString="*.psd") returned 5 [0067.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF", pszSpec="*.cdr") returned 0 [0067.924] lstrlenA (lpString="*.cdr") returned 5 [0067.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF", pszSpec="*.dwg") returned 0 [0067.924] lstrlenA (lpString="*.dwg") returned 5 [0067.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF", pszSpec="*.max") returned 0 [0067.924] lstrlenA (lpString="*.max") returned 5 [0067.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF", pszSpec="*.bmp") returned 0 [0067.924] lstrlenA (lpString="*.bmp") returned 5 [0067.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF", pszSpec="*.gif") returned 0 [0067.924] lstrlenA (lpString="*.gif") returned 5 [0067.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF", pszSpec="*.png") returned 0 [0067.924] lstrlenA (lpString="*.png") returned 5 [0067.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF", pszSpec="*.doc") returned 0 [0067.924] lstrlenA (lpString="*.doc") returned 5 [0067.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF", pszSpec="*.docx") returned 0 [0067.924] lstrlenA (lpString="*.docx") returned 6 [0067.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF", pszSpec="*.xls") returned 0 [0067.924] lstrlenA (lpString="*.xls") returned 5 [0067.925] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF", pszSpec="*.xlsx") returned 0 [0067.925] lstrlenA (lpString="*.xlsx") returned 6 [0067.925] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF", pszSpec="*.ppt") returned 0 [0067.925] lstrlenA (lpString="*.ppt") returned 5 [0067.925] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF", pszSpec="*.pptx") returned 0 [0067.925] lstrlenA (lpString="*.pptx") returned 6 [0067.925] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF", pszSpec="*.txt") returned 0 [0067.925] lstrlenA (lpString="*.txt") returned 5 [0067.925] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc322a047, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x43c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0103058.WMF", cAlternateFileName="")) returned 1 [0067.925] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.961] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0103058.WMF") returned -1 [0067.961] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0103058.WMF") returned -1 [0067.961] lstrcmpiA (lpString1="", lpString2="J0103058.WMF") returned -1 [0067.961] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned="J0102984.WMF" [0067.961] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.961] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.961] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.961] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.961] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0103058.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" [0067.961] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaddb4192, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3264, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0103262.WMF", cAlternateFileName="")) returned 1 [0067.961] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.961] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0103262.WMF") returned -1 [0067.961] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0103262.WMF") returned -1 [0067.961] lstrcmpiA (lpString1="", lpString2="J0103262.WMF") returned -1 [0067.961] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned="J0103058.WMF" [0067.961] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.961] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.962] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.962] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.962] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0103262.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" [0067.962] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaddbb608, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xaf94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0103402.WMF", cAlternateFileName="")) returned 1 [0067.962] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.962] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0103402.WMF") returned -1 [0067.962] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0103402.WMF") returned -1 [0067.962] lstrcmpiA (lpString1="", lpString2="J0103402.WMF") returned -1 [0067.962] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned="J0103262.WMF" [0067.962] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.962] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.962] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.962] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.962] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0103402.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" [0067.962] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32301be, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1714, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0103812.WMF", cAlternateFileName="")) returned 1 [0067.962] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.962] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0103812.WMF") returned -1 [0067.962] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0103812.WMF") returned -1 [0067.962] lstrcmpiA (lpString1="", lpString2="J0103812.WMF") returned -1 [0067.962] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned="J0103402.WMF" [0067.963] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.963] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.963] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.963] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.963] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0103812.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" [0067.963] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc323638e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5c2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0103850.WMF", cAlternateFileName="")) returned 1 [0067.963] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.963] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0103850.WMF") returned -1 [0067.963] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0103850.WMF") returned -1 [0067.963] lstrcmpiA (lpString1="", lpString2="J0103850.WMF") returned -1 [0067.963] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned="J0103812.WMF" [0067.963] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.963] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.963] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.963] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.963] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0103850.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" [0067.963] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaddc0411, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105230.WMF", cAlternateFileName="")) returned 1 [0067.963] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.963] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105230.WMF") returned -1 [0067.963] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105230.WMF") returned -1 [0067.963] lstrcmpiA (lpString1="", lpString2="J0105230.WMF") returned -1 [0067.963] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned="J0103850.WMF" [0067.963] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.963] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.963] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.963] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.964] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105230.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" [0067.964] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc323b1a9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105232.WMF", cAlternateFileName="")) returned 1 [0067.964] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.964] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105232.WMF") returned -1 [0067.964] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105232.WMF") returned -1 [0067.964] lstrcmpiA (lpString1="", lpString2="J0105232.WMF") returned -1 [0067.964] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned="J0105230.WMF" [0067.964] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.964] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.964] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.964] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.964] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105232.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" [0067.964] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc323ec41, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105234.WMF", cAlternateFileName="")) returned 1 [0067.964] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.964] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105234.WMF") returned -1 [0067.964] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105234.WMF") returned -1 [0067.964] lstrcmpiA (lpString1="", lpString2="J0105234.WMF") returned -1 [0067.964] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned="J0105232.WMF" [0067.964] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.964] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.964] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.964] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.964] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105234.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" [0067.964] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3244dfc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4314, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105238.WMF", cAlternateFileName="")) returned 1 [0067.965] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.965] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105238.WMF") returned -1 [0067.965] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105238.WMF") returned -1 [0067.965] lstrcmpiA (lpString1="", lpString2="J0105238.WMF") returned -1 [0067.965] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned="J0105234.WMF" [0067.965] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.965] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.965] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.965] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.965] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105238.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" [0067.965] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc324af95, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2d0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105240.WMF", cAlternateFileName="")) returned 1 [0067.965] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.965] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105240.WMF") returned -1 [0067.965] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105240.WMF") returned -1 [0067.965] lstrcmpiA (lpString1="", lpString2="J0105240.WMF") returned -1 [0067.965] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned="J0105238.WMF" [0067.965] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.965] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.965] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.965] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.965] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105240.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" [0067.965] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc324febd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2bdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105244.WMF", cAlternateFileName="")) returned 1 [0067.965] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.965] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105244.WMF") returned -1 [0067.965] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105244.WMF") returned -1 [0067.965] lstrcmpiA (lpString1="", lpString2="J0105244.WMF") returned -1 [0067.966] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned="J0105240.WMF" [0067.966] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.966] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.966] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.966] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.966] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105244.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" [0067.966] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaddc65ce, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105246.WMF", cAlternateFileName="")) returned 1 [0067.966] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.966] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105246.WMF") returned -1 [0067.966] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105246.WMF") returned -1 [0067.966] lstrcmpiA (lpString1="", lpString2="J0105246.WMF") returned -1 [0067.966] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned="J0105244.WMF" [0067.966] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.966] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.966] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.966] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.966] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105246.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" [0067.966] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc325383d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1214, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105250.WMF", cAlternateFileName="")) returned 1 [0067.966] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.966] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105250.WMF") returned -1 [0067.966] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105250.WMF") returned -1 [0067.967] lstrcmpiA (lpString1="", lpString2="J0105250.WMF") returned -1 [0067.967] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned="J0105246.WMF" [0067.967] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.967] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.967] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.967] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.967] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105250.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" [0067.967] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32599fb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1714, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105266.WMF", cAlternateFileName="")) returned 1 [0067.967] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.967] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105266.WMF") returned -1 [0067.967] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105266.WMF") returned -1 [0067.967] lstrcmpiA (lpString1="", lpString2="J0105266.WMF") returned -1 [0067.967] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned="J0105250.WMF" [0067.967] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.967] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.967] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.967] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.967] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105266.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" [0067.967] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc325fbb1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4540, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105272.WMF", cAlternateFileName="")) returned 1 [0067.967] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.967] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105272.WMF") returned -1 [0067.967] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105272.WMF") returned -1 [0067.967] lstrcmpiA (lpString1="", lpString2="J0105272.WMF") returned -1 [0067.967] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned="J0105266.WMF" [0067.967] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.968] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.968] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.968] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.968] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105272.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" [0067.968] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3265da7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105276.WMF", cAlternateFileName="")) returned 1 [0067.968] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.968] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105276.WMF") returned -1 [0067.968] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105276.WMF") returned -1 [0067.968] lstrcmpiA (lpString1="", lpString2="J0105276.WMF") returned -1 [0067.968] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned="J0105272.WMF" [0067.968] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.968] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.968] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.968] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.968] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105276.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" [0067.968] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaddcb408, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2d14, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105280.WMF", cAlternateFileName="")) returned 1 [0067.968] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.968] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105280.WMF") returned -1 [0067.968] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105280.WMF") returned -1 [0067.968] lstrcmpiA (lpString1="", lpString2="J0105280.WMF") returned -1 [0067.968] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned="J0105276.WMF" [0067.968] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.968] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.969] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.969] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.969] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105280.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" [0067.969] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc326ab48, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x12bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105282.WMF", cAlternateFileName="")) returned 1 [0067.969] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.969] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105282.WMF") returned -1 [0067.969] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105282.WMF") returned -1 [0067.969] lstrcmpiA (lpString1="", lpString2="J0105282.WMF") returned -1 [0067.969] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned="J0105280.WMF" [0067.969] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.969] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.969] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.969] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.969] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105282.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" [0067.969] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3270d52, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x19a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105286.WMF", cAlternateFileName="")) returned 1 [0067.969] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.969] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105286.WMF") returned -1 [0067.969] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105286.WMF") returned -1 [0067.969] lstrcmpiA (lpString1="", lpString2="J0105286.WMF") returned -1 [0067.969] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned="J0105282.WMF" [0067.969] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.969] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.969] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.969] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.970] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105286.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" [0067.970] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3274775, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3dd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105288.WMF", cAlternateFileName="")) returned 1 [0067.970] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.970] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105288.WMF") returned -1 [0067.970] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105288.WMF") returned -1 [0067.970] lstrcmpiA (lpString1="", lpString2="J0105288.WMF") returned -1 [0067.970] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned="J0105286.WMF" [0067.970] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.970] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.970] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.970] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.970] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105288.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" [0067.970] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaddd2980, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3a14, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105292.WMF", cAlternateFileName="")) returned 1 [0067.970] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.970] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105292.WMF") returned -1 [0067.970] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105292.WMF") returned -1 [0067.970] lstrcmpiA (lpString1="", lpString2="J0105292.WMF") returned -1 [0067.970] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned="J0105288.WMF" [0067.970] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.970] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.970] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.970] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.970] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105292.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" [0067.971] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc327a95a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1580, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105294.WMF", cAlternateFileName="")) returned 1 [0067.971] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.971] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105294.WMF") returned -1 [0067.971] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105294.WMF") returned -1 [0067.971] lstrcmpiA (lpString1="", lpString2="J0105294.WMF") returned -1 [0067.971] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned="J0105292.WMF" [0067.971] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.971] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.971] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.971] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.971] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105294.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" [0067.971] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc327f780, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x18b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105298.WMF", cAlternateFileName="")) returned 1 [0067.971] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.971] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105298.WMF") returned -1 [0067.971] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105298.WMF") returned -1 [0067.971] lstrcmpiA (lpString1="", lpString2="J0105298.WMF") returned -1 [0067.971] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned="J0105294.WMF" [0067.971] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.971] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.971] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.971] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.971] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105298.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" [0067.971] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3284574, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x10e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105306.WMF", cAlternateFileName="")) returned 1 [0067.972] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.972] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105306.WMF") returned -1 [0067.972] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105306.WMF") returned -1 [0067.972] lstrcmpiA (lpString1="", lpString2="J0105306.WMF") returned -1 [0067.972] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned="J0105298.WMF" [0067.972] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.972] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.972] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.972] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.972] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105306.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" [0067.972] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaddd638e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105320.WMF", cAlternateFileName="")) returned 1 [0067.972] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.972] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105320.WMF") returned -1 [0067.972] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105320.WMF") returned -1 [0067.972] lstrcmpiA (lpString1="", lpString2="J0105320.WMF") returned -1 [0067.972] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned="J0105306.WMF" [0067.972] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.972] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.972] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.972] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.972] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105320.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" [0067.972] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc328ba9b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1f38, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105328.WMF", cAlternateFileName="")) returned 1 [0067.972] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.972] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105328.WMF") returned -1 [0067.973] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105328.WMF") returned -1 [0067.973] lstrcmpiA (lpString1="", lpString2="J0105328.WMF") returned -1 [0067.973] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned="J0105320.WMF" [0067.973] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.973] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.973] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.973] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.973] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105328.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" [0067.973] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc329ba9b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x290c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105332.WMF", cAlternateFileName="")) returned 1 [0067.973] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.973] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105332.WMF") returned -1 [0067.973] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105332.WMF") returned -1 [0067.973] lstrcmpiA (lpString1="", lpString2="J0105332.WMF") returned -1 [0067.973] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned="J0105328.WMF" [0067.973] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.973] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.973] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.973] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.973] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105332.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" [0067.973] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadddb225, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb54, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105336.WMF", cAlternateFileName="")) returned 1 [0067.989] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.990] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105336.WMF") returned -1 [0067.990] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105336.WMF") returned -1 [0067.990] lstrcmpiA (lpString1="", lpString2="J0105336.WMF") returned -1 [0067.990] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned="J0105332.WMF" [0067.990] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.990] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.990] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.990] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.990] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105336.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" [0067.990] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32aa36a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2d40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105338.WMF", cAlternateFileName="")) returned 1 [0067.990] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.990] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105338.WMF") returned -1 [0067.990] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105338.WMF") returned -1 [0067.990] lstrcmpiA (lpString1="", lpString2="J0105338.WMF") returned -1 [0067.990] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned="J0105336.WMF" [0067.990] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.990] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.990] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.990] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.990] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105338.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" [0067.990] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadddffd0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x42a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105348.WMF", cAlternateFileName="")) returned 1 [0067.991] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.991] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105348.WMF") returned -1 [0067.991] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105348.WMF") returned -1 [0067.991] lstrcmpiA (lpString1="", lpString2="J0105348.WMF") returned -1 [0067.991] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned="J0105338.WMF" [0067.991] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.991] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.991] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.991] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.991] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105348.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" [0067.991] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32bef10, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x229c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105360.WMF", cAlternateFileName="")) returned 1 [0067.991] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.991] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105360.WMF") returned -1 [0067.991] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105360.WMF") returned -1 [0067.991] lstrcmpiA (lpString1="", lpString2="J0105360.WMF") returned -1 [0067.991] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned="J0105348.WMF" [0067.991] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.991] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.991] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.991] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.991] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105360.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" [0067.991] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadde7545, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x305c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105368.WMF", cAlternateFileName="")) returned 1 [0067.991] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.992] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105368.WMF") returned -1 [0067.992] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105368.WMF") returned -1 [0067.992] lstrcmpiA (lpString1="", lpString2="J0105368.WMF") returned -1 [0067.992] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned="J0105360.WMF" [0067.992] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.992] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.992] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.992] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.992] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105368.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" [0067.992] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaddeb03f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1364, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105376.WMF", cAlternateFileName="")) returned 1 [0067.992] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.992] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105376.WMF") returned -1 [0067.992] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105376.WMF") returned -1 [0067.992] lstrcmpiA (lpString1="", lpString2="J0105376.WMF") returned -1 [0067.992] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned="J0105368.WMF" [0067.992] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.992] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.992] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.992] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.992] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105376.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" [0067.992] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaddefe01, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1364, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105378.WMF", cAlternateFileName="")) returned 1 [0067.992] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.992] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105378.WMF") returned -1 [0067.992] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105378.WMF") returned -1 [0067.992] lstrcmpiA (lpString1="", lpString2="J0105378.WMF") returned -1 [0067.992] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned="J0105376.WMF" [0067.993] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.993] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.993] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.993] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.993] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105378.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" [0067.994] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32c3d3a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1210, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105380.WMF", cAlternateFileName="")) returned 1 [0067.994] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.994] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105380.WMF") returned -1 [0067.994] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105380.WMF") returned -1 [0067.994] lstrcmpiA (lpString1="", lpString2="J0105380.WMF") returned -1 [0067.994] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned="J0105378.WMF" [0067.994] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.994] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.994] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.994] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.994] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105380.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" [0067.994] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32c8bc7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105384.WMF", cAlternateFileName="")) returned 1 [0067.994] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.994] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105384.WMF") returned -1 [0067.994] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105384.WMF") returned -1 [0067.995] lstrcmpiA (lpString1="", lpString2="J0105384.WMF") returned -1 [0067.995] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned="J0105380.WMF" [0067.995] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.995] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.995] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.995] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.995] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105384.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" [0067.995] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaddf4b9f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x175c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105386.WMF", cAlternateFileName="")) returned 1 [0067.995] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.995] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105386.WMF") returned -1 [0067.995] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105386.WMF") returned -1 [0067.995] lstrcmpiA (lpString1="", lpString2="J0105386.WMF") returned -1 [0067.995] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned="J0105384.WMF" [0067.995] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.995] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.995] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.995] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.995] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105386.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" [0067.995] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaddfd450, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x203c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105388.WMF", cAlternateFileName="")) returned 1 [0067.995] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.995] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105388.WMF") returned -1 [0067.995] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105388.WMF") returned -1 [0067.995] lstrcmpiA (lpString1="", lpString2="J0105388.WMF") returned -1 [0067.995] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned="J0105386.WMF" [0067.995] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.996] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.996] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.996] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.996] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105388.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" [0067.996] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade0230b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1350, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105390.WMF", cAlternateFileName="")) returned 1 [0067.996] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.996] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105390.WMF") returned -1 [0067.996] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105390.WMF") returned -1 [0067.996] lstrcmpiA (lpString1="", lpString2="J0105390.WMF") returned -1 [0067.996] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned="J0105388.WMF" [0067.996] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.996] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.996] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.996] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.996] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105390.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" [0067.996] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32cd986, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2b04, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105396.WMF", cAlternateFileName="")) returned 1 [0067.996] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.996] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105396.WMF") returned -1 [0067.996] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105396.WMF") returned -1 [0067.996] lstrcmpiA (lpString1="", lpString2="J0105396.WMF") returned -1 [0067.996] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned="J0105390.WMF" [0067.996] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.996] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.997] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.997] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.997] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105396.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" [0067.997] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32d3b63, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd00, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105398.WMF", cAlternateFileName="")) returned 1 [0067.997] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.997] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105398.WMF") returned -1 [0067.997] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105398.WMF") returned -1 [0067.997] lstrcmpiA (lpString1="", lpString2="J0105398.WMF") returned -1 [0067.997] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned="J0105396.WMF" [0067.997] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.997] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.997] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.997] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.997] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105398.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" [0067.997] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32d8980, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4fdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105410.WMF", cAlternateFileName="")) returned 1 [0067.997] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.997] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105410.WMF") returned -1 [0067.997] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105410.WMF") returned -1 [0067.997] lstrcmpiA (lpString1="", lpString2="J0105410.WMF") returned -1 [0067.997] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned="J0105398.WMF" [0067.997] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.997] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.997] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.997] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.998] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105410.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" [0067.998] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade070e1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x24b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105412.WMF", cAlternateFileName="")) returned 1 [0067.998] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.998] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105412.WMF") returned -1 [0067.998] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105412.WMF") returned -1 [0067.998] lstrcmpiA (lpString1="", lpString2="J0105412.WMF") returned -1 [0067.998] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned="J0105410.WMF" [0067.998] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.998] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.998] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.998] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.998] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105412.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" [0067.998] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32deada, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1864, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105414.WMF", cAlternateFileName="")) returned 1 [0067.998] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.998] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105414.WMF") returned -1 [0067.998] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105414.WMF") returned -1 [0067.998] lstrcmpiA (lpString1="", lpString2="J0105414.WMF") returned -1 [0067.998] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned="J0105412.WMF" [0067.998] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.998] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.998] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.998] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.998] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105414.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" [0067.999] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade15c92, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4928, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105490.WMF", cAlternateFileName="")) returned 1 [0067.999] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.999] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105490.WMF") returned -1 [0067.999] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105490.WMF") returned -1 [0067.999] lstrcmpiA (lpString1="", lpString2="J0105490.WMF") returned -1 [0067.999] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned="J0105414.WMF" [0067.999] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.999] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.999] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.999] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.999] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105490.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" [0067.999] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade21ed1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1424, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105496.WMF", cAlternateFileName="")) returned 1 [0067.999] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.999] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105496.WMF") returned -1 [0067.999] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105496.WMF") returned -1 [0067.999] lstrcmpiA (lpString1="", lpString2="J0105496.WMF") returned -1 [0067.999] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned="J0105490.WMF" [0067.999] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0067.999] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0067.999] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0067.999] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0067.999] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105496.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" [0067.999] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade2801c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1560, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105502.WMF", cAlternateFileName="")) returned 1 [0067.999] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0067.999] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105502.WMF") returned -1 [0067.999] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105502.WMF") returned -1 [0068.000] lstrcmpiA (lpString1="", lpString2="J0105502.WMF") returned -1 [0068.000] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned="J0105496.WMF" [0068.000] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.000] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.000] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.000] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.000] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105502.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" [0068.000] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32e2576, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1034, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105504.WMF", cAlternateFileName="")) returned 1 [0068.000] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.000] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105504.WMF") returned -1 [0068.000] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105504.WMF") returned -1 [0068.000] lstrcmpiA (lpString1="", lpString2="J0105504.WMF") returned -1 [0068.000] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned="J0105502.WMF" [0068.000] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.000] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.000] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.000] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.000] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105504.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" [0068.000] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32e8771, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105506.WMF", cAlternateFileName="")) returned 1 [0068.000] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.000] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105506.WMF") returned -1 [0068.000] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105506.WMF") returned -1 [0068.000] lstrcmpiA (lpString1="", lpString2="J0105506.WMF") returned -1 [0068.000] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned="J0105504.WMF" [0068.000] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.001] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.001] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.001] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.001] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105506.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" [0068.001] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32ee8d4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7c44, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105520.WMF", cAlternateFileName="")) returned 1 [0068.001] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.001] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105520.WMF") returned -1 [0068.001] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105520.WMF") returned -1 [0068.001] lstrcmpiA (lpString1="", lpString2="J0105520.WMF") returned -1 [0068.001] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned="J0105506.WMF" [0068.001] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.001] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.001] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.001] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.001] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105520.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" [0068.001] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32f36e0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x43b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105526.WMF", cAlternateFileName="")) returned 1 [0068.001] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.001] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105526.WMF") returned -1 [0068.001] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105526.WMF") returned -1 [0068.001] lstrcmpiA (lpString1="", lpString2="J0105526.WMF") returned -1 [0068.001] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned="J0105520.WMF" [0068.001] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.002] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.002] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.002] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.002] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105526.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" [0068.002] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32f9a75, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105530.WMF", cAlternateFileName="")) returned 1 [0068.002] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.002] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105530.WMF") returned -1 [0068.002] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105530.WMF") returned -1 [0068.002] lstrcmpiA (lpString1="", lpString2="J0105530.WMF") returned -1 [0068.002] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned="J0105526.WMF" [0068.002] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.002] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.002] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.002] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.002] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105530.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" [0068.002] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33070e2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x542c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105588.WMF", cAlternateFileName="")) returned 1 [0068.002] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.002] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105588.WMF") returned -1 [0068.002] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105588.WMF") returned -1 [0068.002] lstrcmpiA (lpString1="", lpString2="J0105588.WMF") returned -1 [0068.002] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned="J0105530.WMF" [0068.002] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.002] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.002] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.003] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.003] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105588.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" [0068.003] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade2ce2a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105600.WMF", cAlternateFileName="")) returned 1 [0068.003] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.003] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105600.WMF") returned -1 [0068.003] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105600.WMF") returned -1 [0068.003] lstrcmpiA (lpString1="", lpString2="J0105600.WMF") returned -1 [0068.003] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned="J0105588.WMF" [0068.003] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.003] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.003] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.003] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.003] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105600.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" [0068.003] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade3304f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x287c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105638.WMF", cAlternateFileName="")) returned 1 [0068.003] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.003] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105638.WMF") returned -1 [0068.003] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105638.WMF") returned -1 [0068.003] lstrcmpiA (lpString1="", lpString2="J0105638.WMF") returned -1 [0068.003] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned="J0105600.WMF" [0068.003] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.003] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.003] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.003] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.003] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105638.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" [0068.004] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc331e3d5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x35f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105710.WMF", cAlternateFileName="")) returned 1 [0068.004] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.004] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105710.WMF") returned -1 [0068.004] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105710.WMF") returned -1 [0068.004] lstrcmpiA (lpString1="", lpString2="J0105710.WMF") returned -1 [0068.004] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned="J0105638.WMF" [0068.004] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.004] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.004] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.004] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.004] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105710.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" [0068.004] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3324411, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2030, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105846.WMF", cAlternateFileName="")) returned 1 [0068.004] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.004] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105846.WMF") returned -1 [0068.004] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105846.WMF") returned -1 [0068.004] lstrcmpiA (lpString1="", lpString2="J0105846.WMF") returned -1 [0068.004] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned="J0105710.WMF" [0068.004] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.004] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.004] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.004] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.004] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105846.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" [0068.004] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade3a539, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2dc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105912.WMF", cAlternateFileName="")) returned 1 [0068.004] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.005] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105912.WMF") returned -1 [0068.005] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105912.WMF") returned -1 [0068.005] lstrcmpiA (lpString1="", lpString2="J0105912.WMF") returned -1 [0068.005] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned="J0105846.WMF" [0068.005] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.005] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.005] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.005] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.005] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105912.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" [0068.005] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade3f392, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105974.WMF", cAlternateFileName="")) returned 1 [0068.005] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.005] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0105974.WMF") returned -1 [0068.005] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0105974.WMF") returned -1 [0068.005] lstrcmpiA (lpString1="", lpString2="J0105974.WMF") returned -1 [0068.005] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned="J0105912.WMF" [0068.005] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.005] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.005] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.005] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.005] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0105974.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" [0068.005] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3329247, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x274c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106020.WMF", cAlternateFileName="")) returned 1 [0068.005] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.005] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0106020.WMF") returned -1 [0068.005] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0106020.WMF") returned -1 [0068.005] lstrcmpiA (lpString1="", lpString2="J0106020.WMF") returned -1 [0068.006] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned="J0105974.WMF" [0068.006] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.006] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.006] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.006] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.006] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0106020.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" [0068.006] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade44155, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106124.WMF", cAlternateFileName="")) returned 1 [0068.006] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.006] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0106124.WMF") returned -1 [0068.006] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0106124.WMF") returned -1 [0068.006] lstrcmpiA (lpString1="", lpString2="J0106124.WMF") returned -1 [0068.006] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned="J0106020.WMF" [0068.006] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.006] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.006] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.006] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.006] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0106124.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" [0068.006] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade48f9e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5bfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106146.WMF", cAlternateFileName="")) returned 1 [0068.043] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.043] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0106146.WMF") returned -1 [0068.043] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0106146.WMF") returned -1 [0068.043] lstrcmpiA (lpString1="", lpString2="J0106146.WMF") returned -1 [0068.043] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned="J0106124.WMF" [0068.043] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.043] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.043] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.043] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.043] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0106146.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" [0068.043] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade5055a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106208.WMF", cAlternateFileName="")) returned 1 [0068.043] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.043] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0106208.WMF") returned -1 [0068.043] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0106208.WMF") returned -1 [0068.043] lstrcmpiA (lpString1="", lpString2="J0106208.WMF") returned -1 [0068.043] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned="J0106146.WMF" [0068.043] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.043] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.043] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.044] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.044] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0106208.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" [0068.044] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc332f4da, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4c90, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106222.WMF", cAlternateFileName="")) returned 1 [0068.044] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.044] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0106222.WMF") returned -1 [0068.044] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0106222.WMF") returned -1 [0068.044] lstrcmpiA (lpString1="", lpString2="J0106222.WMF") returned -1 [0068.044] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned="J0106208.WMF" [0068.044] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.044] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.044] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.044] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.044] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0106222.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" [0068.044] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3334202, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x864, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106572.WMF", cAlternateFileName="")) returned 1 [0068.044] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.044] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0106572.WMF") returned -1 [0068.044] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0106572.WMF") returned -1 [0068.044] lstrcmpiA (lpString1="", lpString2="J0106572.WMF") returned -1 [0068.044] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned="J0106222.WMF" [0068.044] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.044] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.044] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.044] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.045] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0106572.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" [0068.045] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade53f21, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106816.WMF", cAlternateFileName="")) returned 1 [0068.045] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.045] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0106816.WMF") returned -1 [0068.045] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0106816.WMF") returned -1 [0068.045] lstrcmpiA (lpString1="", lpString2="J0106816.WMF") returned -1 [0068.045] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned="J0106572.WMF" [0068.045] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.045] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.045] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.045] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.045] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0106816.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" [0068.045] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade5a1db, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x35d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106958.WMF", cAlternateFileName="")) returned 1 [0068.045] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.045] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0106958.WMF") returned -1 [0068.045] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0106958.WMF") returned -1 [0068.045] lstrcmpiA (lpString1="", lpString2="J0106958.WMF") returned -1 [0068.045] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned="J0106816.WMF" [0068.045] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.045] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.045] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.045] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.046] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0106958.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" [0068.046] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3337c75, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xbcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107024.WMF", cAlternateFileName="")) returned 1 [0068.046] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.046] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0107024.WMF") returned -1 [0068.046] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0107024.WMF") returned -1 [0068.046] lstrcmpiA (lpString1="", lpString2="J0107024.WMF") returned -1 [0068.046] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned="J0106958.WMF" [0068.046] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.046] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.046] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.046] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.046] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107024.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" [0068.046] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade5eeff, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1dd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107026.WMF", cAlternateFileName="")) returned 1 [0068.046] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.046] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0107026.WMF") returned -1 [0068.046] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0107026.WMF") returned -1 [0068.046] lstrcmpiA (lpString1="", lpString2="J0107026.WMF") returned -1 [0068.046] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned="J0107024.WMF" [0068.046] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.046] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.047] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.047] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.047] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107026.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" [0068.047] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade650c9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2358, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107042.WMF", cAlternateFileName="")) returned 1 [0068.047] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.047] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0107042.WMF") returned -1 [0068.047] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0107042.WMF") returned -1 [0068.047] lstrcmpiA (lpString1="", lpString2="J0107042.WMF") returned -1 [0068.047] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned="J0107026.WMF" [0068.047] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.047] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.047] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.047] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.047] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107042.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" [0068.047] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc333cae6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107090.WMF", cAlternateFileName="")) returned 1 [0068.047] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.048] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0107090.WMF") returned -1 [0068.048] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0107090.WMF") returned -1 [0068.048] lstrcmpiA (lpString1="", lpString2="J0107090.WMF") returned -1 [0068.048] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned="J0107042.WMF" [0068.048] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.048] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.048] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.048] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.048] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107090.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" [0068.048] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3343ff1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x69cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107130.WMF", cAlternateFileName="")) returned 1 [0068.048] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.048] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0107130.WMF") returned -1 [0068.048] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0107130.WMF") returned -1 [0068.048] lstrcmpiA (lpString1="", lpString2="J0107130.WMF") returned -1 [0068.048] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned="J0107090.WMF" [0068.048] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.048] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.048] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.048] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.048] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107130.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" [0068.049] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade6b269, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xbcfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107132.WMF", cAlternateFileName="")) returned 1 [0068.049] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.049] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0107132.WMF") returned -1 [0068.049] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0107132.WMF") returned -1 [0068.049] lstrcmpiA (lpString1="", lpString2="J0107132.WMF") returned -1 [0068.049] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned="J0107130.WMF" [0068.049] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.049] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.049] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.049] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.049] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107132.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" [0068.049] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade71474, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xbd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107134.WMF", cAlternateFileName="")) returned 1 [0068.049] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.049] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0107134.WMF") returned -1 [0068.049] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0107134.WMF") returned -1 [0068.049] lstrcmpiA (lpString1="", lpString2="J0107134.WMF") returned -1 [0068.049] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned="J0107132.WMF" [0068.049] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.049] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.049] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.049] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.050] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107134.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" [0068.050] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc334a1a0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4330, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107138.WMF", cAlternateFileName="")) returned 1 [0068.050] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.050] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0107138.WMF") returned -1 [0068.050] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0107138.WMF") returned -1 [0068.050] lstrcmpiA (lpString1="", lpString2="J0107138.WMF") returned -1 [0068.050] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned="J0107134.WMF" [0068.050] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.050] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.050] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.050] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.050] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107138.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" [0068.050] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade7765a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107146.WMF", cAlternateFileName="")) returned 1 [0068.050] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.050] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0107146.WMF") returned -1 [0068.050] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0107146.WMF") returned -1 [0068.050] lstrcmpiA (lpString1="", lpString2="J0107146.WMF") returned -1 [0068.050] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned="J0107138.WMF" [0068.050] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.050] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.051] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.051] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.051] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107146.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" [0068.051] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade7d777, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4ea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107148.WMF", cAlternateFileName="")) returned 1 [0068.051] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.051] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0107148.WMF") returned -1 [0068.051] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0107148.WMF") returned -1 [0068.051] lstrcmpiA (lpString1="", lpString2="J0107148.WMF") returned -1 [0068.051] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned="J0107146.WMF" [0068.051] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.051] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.051] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.051] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.051] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107148.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" [0068.051] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade825e4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3490, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107150.WMF", cAlternateFileName="")) returned 1 [0068.051] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.051] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0107150.WMF") returned -1 [0068.051] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0107150.WMF") returned -1 [0068.051] lstrcmpiA (lpString1="", lpString2="J0107150.WMF") returned -1 [0068.052] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned="J0107148.WMF" [0068.052] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.052] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.052] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.052] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.052] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107150.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" [0068.052] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade89b06, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5804, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107152.WMF", cAlternateFileName="")) returned 1 [0068.052] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.052] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned="J0107150.WMF" [0068.052] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.052] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.052] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.052] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.052] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107152.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" [0068.052] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade8e8d5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x571c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107154.WMF", cAlternateFileName="")) returned 1 [0068.052] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.053] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned="J0107152.WMF" [0068.053] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.053] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.053] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.053] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.053] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107154.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" [0068.053] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc334f009, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x614c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107158.WMF", cAlternateFileName="")) returned 1 [0068.053] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.053] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned="J0107154.WMF" [0068.053] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.053] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.053] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.053] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.053] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107158.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" [0068.053] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3353e45, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3ee4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107182.WMF", cAlternateFileName="")) returned 1 [0068.053] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.053] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned="J0107158.WMF" [0068.053] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.054] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.054] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.054] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.054] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107182.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" [0068.054] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3359fe7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x11b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107188.WMF", cAlternateFileName="")) returned 1 [0068.054] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.054] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned="J0107182.WMF" [0068.054] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.054] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.054] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.054] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.054] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107188.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" [0068.054] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade94b4e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x26f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107192.WMF", cAlternateFileName="")) returned 1 [0068.054] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.054] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned="J0107188.WMF" [0068.054] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.054] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.054] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.055] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.055] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107192.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" [0068.055] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc335edaa, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4ef4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107254.WMF", cAlternateFileName="")) returned 1 [0068.055] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.055] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned="J0107192.WMF" [0068.055] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.055] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.055] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.055] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.055] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107254.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" [0068.055] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade9ac3d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107258.WMF", cAlternateFileName="")) returned 1 [0068.055] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.055] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned="J0107254.WMF" [0068.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.056] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.056] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.056] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.056] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107258.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" [0068.056] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3364f2e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1f3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107262.WMF", cAlternateFileName="")) returned 1 [0068.056] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.056] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned="J0107258.WMF" [0068.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.056] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.056] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.056] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.057] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107262.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" [0068.057] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3368981, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107264.WMF", cAlternateFileName="")) returned 1 [0068.057] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.057] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned="J0107262.WMF" [0068.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.057] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.057] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.057] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.057] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107264.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" [0068.057] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade9fa70, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107266.WMF", cAlternateFileName="")) returned 1 [0068.057] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.057] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned="J0107264.WMF" [0068.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.057] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.057] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.057] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.057] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107266.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" [0068.057] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc337124c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2b64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107280.WMF", cAlternateFileName="")) returned 1 [0068.058] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.058] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned="J0107266.WMF" [0068.058] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.058] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.058] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.058] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.058] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107280.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" [0068.058] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33760ac, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107282.WMF", cAlternateFileName="")) returned 1 [0068.058] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.058] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned="J0107280.WMF" [0068.058] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.058] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.058] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.058] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.058] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107282.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" [0068.058] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadea34e6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x347c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107288.WMF", cAlternateFileName="")) returned 1 [0068.058] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.058] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned="J0107282.WMF" [0068.058] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.058] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.058] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.058] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.058] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107288.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" [0068.059] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadeaaa5f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3014, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107290.WMF", cAlternateFileName="")) returned 1 [0068.059] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.059] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned="J0107288.WMF" [0068.059] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.059] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.059] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.059] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.059] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107290.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" [0068.059] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadeaf88d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x99c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107300.WMF", cAlternateFileName="")) returned 1 [0068.059] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.059] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned="J0107290.WMF" [0068.059] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.059] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.059] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.059] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.059] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107300.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" [0068.059] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc337aece, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107302.WMF", cAlternateFileName="")) returned 1 [0068.059] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.059] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned="J0107300.WMF" [0068.059] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.059] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.059] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.059] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.060] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107302.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" [0068.060] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadeb4669, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107308.WMF", cAlternateFileName="")) returned 1 [0068.060] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.060] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned="J0107302.WMF" [0068.061] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.061] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.061] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.061] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.061] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107308.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" [0068.061] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadeb9576, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2a64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107314.WMF", cAlternateFileName="")) returned 1 [0068.061] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.061] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned="J0107308.WMF" [0068.061] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.061] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.061] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.061] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.061] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107314.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" [0068.061] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3381054, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2c18, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107316.WMF", cAlternateFileName="")) returned 1 [0068.061] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.061] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned="J0107314.WMF" [0068.061] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.061] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.061] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.061] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.061] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107316.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" [0068.062] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33885bb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1984, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107328.WMF", cAlternateFileName="")) returned 1 [0068.062] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.062] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned="J0107316.WMF" [0068.062] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.062] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.062] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.062] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.062] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107328.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" [0068.062] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadebf620, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107342.WMF", cAlternateFileName="")) returned 1 [0068.062] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.062] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned="J0107328.WMF" [0068.062] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.062] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.062] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.062] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.062] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107342.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" [0068.062] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc338c0d3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x13d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107344.WMF", cAlternateFileName="")) returned 1 [0068.062] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.064] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned="J0107342.WMF" [0068.064] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.064] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.064] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.064] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.064] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107344.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" [0068.064] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3390e47, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5c78, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107350.WMF", cAlternateFileName="")) returned 1 [0068.064] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.064] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned="J0107344.WMF" [0068.064] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.064] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.064] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.064] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.064] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107350.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" [0068.064] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3397007, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1f1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107358.WMF", cAlternateFileName="")) returned 1 [0068.064] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.065] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned="J0107350.WMF" [0068.065] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.065] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.065] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.065] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.065] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107358.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" [0068.065] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadec4462, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x40cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107364.WMF", cAlternateFileName="")) returned 1 [0068.065] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.065] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned="J0107358.WMF" [0068.065] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.065] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.065] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.065] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.065] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107364.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" [0068.065] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadec9264, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2ce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107426.WMF", cAlternateFileName="")) returned 1 [0068.065] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.065] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned="J0107364.WMF" [0068.065] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.065] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.065] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.065] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.065] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107426.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" [0068.066] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc339e6ce, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7680, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107446.WMF", cAlternateFileName="")) returned 1 [0068.066] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.066] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned="J0107426.WMF" [0068.066] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.066] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.066] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.066] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.066] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107446.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" [0068.066] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadecf531, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1338, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107450.WMF", cAlternateFileName="")) returned 1 [0068.066] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.066] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned="J0107446.WMF" [0068.066] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.066] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.066] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.066] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.066] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107450.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" [0068.066] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaded55f4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x52e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107452.WMF", cAlternateFileName="")) returned 1 [0068.066] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.066] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned="J0107450.WMF" [0068.066] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.066] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.066] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.066] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.067] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107452.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" [0068.067] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadeda3f6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107456.WMF", cAlternateFileName="")) returned 1 [0068.067] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.067] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned="J0107452.WMF" [0068.067] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.067] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.067] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.067] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.067] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0107456.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" [0068.067] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadeddf54, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xdf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107458.WMF", cAlternateFileName="")) returned 1 [0068.067] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.067] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned="J0107456.WMF" [0068.067] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.067] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.067] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.067] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.067] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33a333a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x258c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107468.WMF", cAlternateFileName="")) returned 1 [0068.067] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.067] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned="J0107458.WMF" [0068.067] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.067] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.068] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.068] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadee4037, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1788, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107480.WMF", cAlternateFileName="")) returned 1 [0068.068] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.068] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned="J0107468.WMF" [0068.068] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.068] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.068] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.068] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33a8173, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1374, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107482.WMF", cAlternateFileName="")) returned 1 [0068.068] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.068] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned="J0107480.WMF" [0068.068] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.068] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.068] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.068] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadeeb58a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xbe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107484.WMF", cAlternateFileName="")) returned 1 [0068.068] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.068] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned="J0107482.WMF" [0068.068] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.068] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.068] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.069] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadef16f0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1f40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107488.WMF", cAlternateFileName="")) returned 1 [0068.069] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.069] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned="J0107484.WMF" [0068.069] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.069] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.069] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.069] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33ae337, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4054, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107490.WMF", cAlternateFileName="")) returned 1 [0068.069] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.069] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned="J0107488.WMF" [0068.069] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.069] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.069] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.069] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33b44a9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1acc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107492.WMF", cAlternateFileName="")) returned 1 [0068.069] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.069] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned="J0107490.WMF" [0068.069] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.069] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.069] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.069] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33b9311, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1918, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107494.WMF", cAlternateFileName="")) returned 1 [0068.069] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.069] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned="J0107492.WMF" [0068.069] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.070] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.070] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.070] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadef5169, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x22a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107496.WMF", cAlternateFileName="")) returned 1 [0068.070] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.070] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned="J0107494.WMF" [0068.070] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.070] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.070] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.070] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadef9f85, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107500.WMF", cAlternateFileName="")) returned 1 [0068.070] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.070] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned="J0107496.WMF" [0068.070] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.070] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.070] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.070] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33be0eb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2a54, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107502.WMF", cAlternateFileName="")) returned 1 [0068.070] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.070] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned="J0107500.WMF" [0068.070] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.070] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.070] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.071] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf001b7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2c8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107512.WMF", cAlternateFileName="")) returned 1 [0068.071] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.071] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned="J0107502.WMF" [0068.071] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.071] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.071] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.071] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33c2f4f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2fac, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107514.WMF", cAlternateFileName="")) returned 1 [0068.071] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.071] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned="J0107512.WMF" [0068.071] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.071] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.071] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.071] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf04f6a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x36b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107516.WMF", cAlternateFileName="")) returned 1 [0068.071] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.071] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned="J0107514.WMF" [0068.071] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.072] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.072] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.072] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33c9131, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1f0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107526.WMF", cAlternateFileName="")) returned 1 [0068.072] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.072] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned="J0107516.WMF" [0068.072] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.072] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.072] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.072] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf09df9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1a88, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107528.WMF", cAlternateFileName="")) returned 1 [0068.072] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.072] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned="J0107526.WMF" [0068.072] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.072] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.072] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.072] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33d0667, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6890, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107544.WMF", cAlternateFileName="")) returned 1 [0068.072] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.072] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned="J0107528.WMF" [0068.072] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.073] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.073] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.073] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33d4116, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107658.WMF", cAlternateFileName="")) returned 1 [0068.073] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.073] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned="J0107544.WMF" [0068.073] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.073] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.073] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.073] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33d8eea, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107708.WMF", cAlternateFileName="")) returned 1 [0068.073] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.073] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned="J0107658.WMF" [0068.073] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.073] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.073] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.073] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf0ebc5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107712.WMF", cAlternateFileName="")) returned 1 [0068.074] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.074] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned="J0107708.WMF" [0068.074] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.075] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.075] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.075] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf14d53, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xed8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107718.WMF", cAlternateFileName="")) returned 1 [0068.075] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.075] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned="J0107712.WMF" [0068.075] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.075] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.075] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.075] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33df047, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2044, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107722.WMF", cAlternateFileName="")) returned 1 [0068.075] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.075] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned="J0107718.WMF" [0068.075] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.075] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.075] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.075] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf19b52, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107724.WMF", cAlternateFileName="")) returned 1 [0068.075] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.075] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned="J0107722.WMF" [0068.075] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.075] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.076] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.076] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf1e98f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1574, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107728.WMF", cAlternateFileName="")) returned 1 [0068.076] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.076] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned="J0107724.WMF" [0068.076] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.076] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.076] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.076] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf237b9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xbf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107730.WMF", cAlternateFileName="")) returned 1 [0068.076] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.076] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned="J0107728.WMF" [0068.076] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.076] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.076] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.076] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33e3e85, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107734.WMF", cAlternateFileName="")) returned 1 [0068.076] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.076] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned="J0107730.WMF" [0068.076] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.076] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.076] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.077] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33e8d86, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107742.WMF", cAlternateFileName="")) returned 1 [0068.077] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.077] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned="J0107734.WMF" [0068.077] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.077] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.077] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.077] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf287a1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107744.WMF", cAlternateFileName="")) returned 1 [0068.077] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.077] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned="J0107742.WMF" [0068.077] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.077] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.077] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.077] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33edaa2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x12b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107746.WMF", cAlternateFileName="")) returned 1 [0068.077] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.077] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned="J0107744.WMF" [0068.077] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.077] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.077] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.078] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33f3c52, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2020, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107748.WMF", cAlternateFileName="")) returned 1 [0068.078] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.078] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned="J0107746.WMF" [0068.078] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.078] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.078] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.078] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf2d3cf, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x126c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107750.WMF", cAlternateFileName="")) returned 1 [0068.078] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.078] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned="J0107748.WMF" [0068.078] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.078] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.078] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.078] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf335c0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4146, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0136865.WMF", cAlternateFileName="")) returned 1 [0068.078] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.078] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned="J0107750.WMF" [0068.078] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.078] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.078] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.078] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3422ae9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x9d27, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0144773.JPG", cAlternateFileName="")) returned 1 [0068.078] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.079] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned="J0136865.WMF" [0068.079] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.079] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.079] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.079] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" [0068.079] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" [0068.079] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.080] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9d27 [0068.080] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc3422ae9, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.080] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.080] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x9ccb, lpOverlapped=0x0) returned 1 [0068.103] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned="J0144773.JPG" [0068.104] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.104] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x9ccb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x9ccb, lpOverlapped=0x0) returned 1 [0068.105] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.105] CloseHandle (hObject=0x1cc) returned 1 [0068.106] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.bd")) returned 1 [0068.107] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3439677, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8379, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145168.JPG", cAlternateFileName="")) returned 1 [0068.107] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.107] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0145168.JPG") returned -1 [0068.107] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0145168.JPG") returned -1 [0068.107] lstrcmpiA (lpString1="", lpString2="J0145168.JPG") returned -1 [0068.107] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned="J0144773.JPG" [0068.107] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.107] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.107] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.107] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.108] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0145168.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" [0068.108] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG", pszSpec="*.zip") returned 0 [0068.108] lstrlenA (lpString="*.zip") returned 5 [0068.108] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG", pszSpec="*.rar") returned 0 [0068.108] lstrlenA (lpString="*.rar") returned 5 [0068.108] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG", pszSpec="*.7z") returned 0 [0068.108] lstrlenA (lpString="*.7z") returned 4 [0068.108] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG", pszSpec="*.tar") returned 0 [0068.108] lstrlenA (lpString="*.tar") returned 5 [0068.108] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG", pszSpec="*.gzip") returned 0 [0068.108] lstrlenA (lpString="*.gzip") returned 6 [0068.108] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG", pszSpec="*.jpg") returned 1 [0068.108] lstrlenA (lpString="*.jpg") returned 5 [0068.108] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" [0068.108] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" [0068.108] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG." [0068.108] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.BD" [0068.108] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.108] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8379 [0068.108] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc3439677, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.109] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.109] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x831d, lpOverlapped=0x0) returned 1 [0068.180] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned="J0145168.JPG" [0068.181] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.181] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x831d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x831d, lpOverlapped=0x0) returned 1 [0068.182] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.182] CloseHandle (hObject=0x1cc) returned 1 [0068.183] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.bd")) returned 1 [0068.184] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf61c81, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xf0c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145212.JPG", cAlternateFileName="")) returned 1 [0068.184] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.184] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0145212.JPG") returned -1 [0068.184] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0145212.JPG") returned -1 [0068.184] lstrcmpiA (lpString1="", lpString2="J0145212.JPG") returned -1 [0068.184] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned="J0145168.JPG" [0068.184] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.184] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.185] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.185] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.185] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0145212.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" [0068.185] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG", pszSpec="*.zip") returned 0 [0068.185] lstrlenA (lpString="*.zip") returned 5 [0068.185] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG", pszSpec="*.rar") returned 0 [0068.185] lstrlenA (lpString="*.rar") returned 5 [0068.185] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG", pszSpec="*.7z") returned 0 [0068.185] lstrlenA (lpString="*.7z") returned 4 [0068.185] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG", pszSpec="*.tar") returned 0 [0068.185] lstrlenA (lpString="*.tar") returned 5 [0068.185] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG", pszSpec="*.gzip") returned 0 [0068.185] lstrlenA (lpString="*.gzip") returned 6 [0068.185] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG", pszSpec="*.jpg") returned 1 [0068.185] lstrlenA (lpString="*.jpg") returned 5 [0068.185] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" [0068.185] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" [0068.185] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG." [0068.185] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.BD" [0068.185] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.186] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf0c1 [0068.186] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xadf61c81, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.186] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.186] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xf065, lpOverlapped=0x0) returned 1 [0068.316] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned="J0145212.JPG" [0068.317] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.317] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xf065, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xf065, lpOverlapped=0x0) returned 1 [0068.318] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.318] CloseHandle (hObject=0x1cc) returned 1 [0068.321] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.bd")) returned 1 [0068.322] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3440bc9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xc056, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145272.JPG", cAlternateFileName="")) returned 1 [0068.322] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.322] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0145272.JPG") returned -1 [0068.322] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0145272.JPG") returned -1 [0068.322] lstrcmpiA (lpString1="", lpString2="J0145272.JPG") returned -1 [0068.322] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned="J0145212.JPG" [0068.322] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.322] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.322] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.322] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.322] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0145272.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" [0068.322] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG", pszSpec="*.zip") returned 0 [0068.322] lstrlenA (lpString="*.zip") returned 5 [0068.322] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG", pszSpec="*.rar") returned 0 [0068.322] lstrlenA (lpString="*.rar") returned 5 [0068.322] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG", pszSpec="*.7z") returned 0 [0068.322] lstrlenA (lpString="*.7z") returned 4 [0068.322] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG", pszSpec="*.tar") returned 0 [0068.322] lstrlenA (lpString="*.tar") returned 5 [0068.322] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG", pszSpec="*.gzip") returned 0 [0068.322] lstrlenA (lpString="*.gzip") returned 6 [0068.322] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG", pszSpec="*.jpg") returned 1 [0068.322] lstrlenA (lpString="*.jpg") returned 5 [0068.322] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" [0068.322] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" [0068.322] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG." [0068.323] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.BD" [0068.323] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.323] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc056 [0068.323] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc3440bc9, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.323] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.323] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xbffa, lpOverlapped=0x0) returned 1 [0068.325] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned="J0145272.JPG" [0068.326] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.326] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xbffa, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xbffa, lpOverlapped=0x0) returned 1 [0068.326] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.338] CloseHandle (hObject=0x1cc) returned 1 [0068.340] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.bd")) returned 1 [0068.341] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf66a59, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5285, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145361.JPG", cAlternateFileName="")) returned 1 [0068.341] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.341] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0145361.JPG") returned -1 [0068.341] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0145361.JPG") returned -1 [0068.341] lstrcmpiA (lpString1="", lpString2="J0145361.JPG") returned -1 [0068.341] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned="J0145272.JPG" [0068.341] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.341] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.341] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.341] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.341] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0145361.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" [0068.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG", pszSpec="*.zip") returned 0 [0068.341] lstrlenA (lpString="*.zip") returned 5 [0068.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG", pszSpec="*.rar") returned 0 [0068.341] lstrlenA (lpString="*.rar") returned 5 [0068.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG", pszSpec="*.7z") returned 0 [0068.342] lstrlenA (lpString="*.7z") returned 4 [0068.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG", pszSpec="*.tar") returned 0 [0068.342] lstrlenA (lpString="*.tar") returned 5 [0068.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG", pszSpec="*.gzip") returned 0 [0068.342] lstrlenA (lpString="*.gzip") returned 6 [0068.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG", pszSpec="*.jpg") returned 1 [0068.342] lstrlenA (lpString="*.jpg") returned 5 [0068.342] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" [0068.342] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" [0068.342] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG." [0068.342] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.BD" [0068.342] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.342] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5285 [0068.342] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xadf66a59, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.342] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.342] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x5229, lpOverlapped=0x0) returned 1 [0068.536] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned="J0145361.JPG" [0068.537] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.537] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x5229, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x5229, lpOverlapped=0x0) returned 1 [0068.537] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.537] CloseHandle (hObject=0x1cc) returned 1 [0068.539] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.bd")) returned 1 [0068.555] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc344947d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x45cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145373.JPG", cAlternateFileName="")) returned 1 [0068.555] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.555] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0145373.JPG") returned -1 [0068.555] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0145373.JPG") returned -1 [0068.555] lstrcmpiA (lpString1="", lpString2="J0145373.JPG") returned -1 [0068.555] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned="J0145361.JPG" [0068.556] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.556] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.556] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.556] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.556] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0145373.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" [0068.556] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG", pszSpec="*.zip") returned 0 [0068.556] lstrlenA (lpString="*.zip") returned 5 [0068.556] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG", pszSpec="*.rar") returned 0 [0068.556] lstrlenA (lpString="*.rar") returned 5 [0068.556] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG", pszSpec="*.7z") returned 0 [0068.556] lstrlenA (lpString="*.7z") returned 4 [0068.556] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG", pszSpec="*.tar") returned 0 [0068.556] lstrlenA (lpString="*.tar") returned 5 [0068.556] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG", pszSpec="*.gzip") returned 0 [0068.556] lstrlenA (lpString="*.gzip") returned 6 [0068.556] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG", pszSpec="*.jpg") returned 1 [0068.556] lstrlenA (lpString="*.jpg") returned 5 [0068.556] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" [0068.556] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" [0068.556] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG." [0068.557] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.BD" [0068.557] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.558] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x45cb [0068.558] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc344947d, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.558] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.558] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x456f, lpOverlapped=0x0) returned 1 [0068.559] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned="J0145373.JPG" [0068.560] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.560] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x456f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x456f, lpOverlapped=0x0) returned 1 [0068.560] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.560] CloseHandle (hObject=0x1cc) returned 1 [0068.562] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.bd")) returned 1 [0068.562] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf6cbb2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7c6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145669.JPG", cAlternateFileName="")) returned 1 [0068.562] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.563] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0145669.JPG") returned -1 [0068.563] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0145669.JPG") returned -1 [0068.563] lstrcmpiA (lpString1="", lpString2="J0145669.JPG") returned -1 [0068.563] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned="J0145373.JPG" [0068.563] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.563] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.563] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.563] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.563] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0145669.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" [0068.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG", pszSpec="*.zip") returned 0 [0068.563] lstrlenA (lpString="*.zip") returned 5 [0068.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG", pszSpec="*.rar") returned 0 [0068.563] lstrlenA (lpString="*.rar") returned 5 [0068.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG", pszSpec="*.7z") returned 0 [0068.563] lstrlenA (lpString="*.7z") returned 4 [0068.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG", pszSpec="*.tar") returned 0 [0068.563] lstrlenA (lpString="*.tar") returned 5 [0068.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG", pszSpec="*.gzip") returned 0 [0068.563] lstrlenA (lpString="*.gzip") returned 6 [0068.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG", pszSpec="*.jpg") returned 1 [0068.563] lstrlenA (lpString="*.jpg") returned 5 [0068.563] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" [0068.564] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" [0068.564] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG." [0068.564] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.BD" [0068.564] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.564] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7c6a [0068.564] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xadf6cbb2, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.564] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.564] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7c0e, lpOverlapped=0x0) returned 1 [0068.569] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned="J0145669.JPG" [0068.570] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.570] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7c0e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7c0e, lpOverlapped=0x0) returned 1 [0068.570] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.570] CloseHandle (hObject=0x1cc) returned 1 [0068.584] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.bd")) returned 1 [0068.585] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3451d10, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8fd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145707.JPG", cAlternateFileName="")) returned 1 [0068.585] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.585] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0145707.JPG") returned -1 [0068.585] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0145707.JPG") returned -1 [0068.585] lstrcmpiA (lpString1="", lpString2="J0145707.JPG") returned -1 [0068.585] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned="J0145669.JPG" [0068.585] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.585] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.585] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.585] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.585] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0145707.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" [0068.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG", pszSpec="*.zip") returned 0 [0068.585] lstrlenA (lpString="*.zip") returned 5 [0068.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG", pszSpec="*.rar") returned 0 [0068.585] lstrlenA (lpString="*.rar") returned 5 [0068.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG", pszSpec="*.7z") returned 0 [0068.585] lstrlenA (lpString="*.7z") returned 4 [0068.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG", pszSpec="*.tar") returned 0 [0068.585] lstrlenA (lpString="*.tar") returned 5 [0068.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG", pszSpec="*.gzip") returned 0 [0068.585] lstrlenA (lpString="*.gzip") returned 6 [0068.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG", pszSpec="*.jpg") returned 1 [0068.586] lstrlenA (lpString="*.jpg") returned 5 [0068.586] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" [0068.586] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" [0068.586] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG." [0068.586] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.BD" [0068.586] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.586] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8fd4 [0068.586] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc3451d10, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.586] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.586] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x8f78, lpOverlapped=0x0) returned 1 [0068.589] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned="J0145707.JPG" [0068.590] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.590] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x8f78, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x8f78, lpOverlapped=0x0) returned 1 [0068.590] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.590] CloseHandle (hObject=0x1cc) returned 1 [0068.591] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.bd")) returned 1 [0068.592] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf740bd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145810.JPG", cAlternateFileName="")) returned 1 [0068.592] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.592] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0145810.JPG") returned -1 [0068.592] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0145810.JPG") returned -1 [0068.592] lstrcmpiA (lpString1="", lpString2="J0145810.JPG") returned -1 [0068.592] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned="J0145707.JPG" [0068.592] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.592] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.592] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.592] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.592] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0145810.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" [0068.592] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG", pszSpec="*.zip") returned 0 [0068.593] lstrlenA (lpString="*.zip") returned 5 [0068.593] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG", pszSpec="*.rar") returned 0 [0068.593] lstrlenA (lpString="*.rar") returned 5 [0068.593] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG", pszSpec="*.7z") returned 0 [0068.593] lstrlenA (lpString="*.7z") returned 4 [0068.593] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG", pszSpec="*.tar") returned 0 [0068.593] lstrlenA (lpString="*.tar") returned 5 [0068.593] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG", pszSpec="*.gzip") returned 0 [0068.593] lstrlenA (lpString="*.gzip") returned 6 [0068.593] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG", pszSpec="*.jpg") returned 1 [0068.593] lstrlenA (lpString="*.jpg") returned 5 [0068.593] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" [0068.593] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" [0068.593] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG." [0068.593] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.BD" [0068.593] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.593] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8fb8 [0068.593] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xadf740bd, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.593] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.593] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x8f5c, lpOverlapped=0x0) returned 1 [0068.595] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned="J0145810.JPG" [0068.596] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.597] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x8f5c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x8f5c, lpOverlapped=0x0) returned 1 [0068.597] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.597] CloseHandle (hObject=0x1cc) returned 1 [0068.598] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.bd")) returned 1 [0068.599] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3458198, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145879.JPG", cAlternateFileName="")) returned 1 [0068.599] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.599] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0145879.JPG") returned -1 [0068.599] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0145879.JPG") returned -1 [0068.599] lstrcmpiA (lpString1="", lpString2="J0145879.JPG") returned -1 [0068.599] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned="J0145810.JPG" [0068.599] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.599] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.599] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.599] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.599] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0145879.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" [0068.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG", pszSpec="*.zip") returned 0 [0068.600] lstrlenA (lpString="*.zip") returned 5 [0068.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG", pszSpec="*.rar") returned 0 [0068.600] lstrlenA (lpString="*.rar") returned 5 [0068.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG", pszSpec="*.7z") returned 0 [0068.600] lstrlenA (lpString="*.7z") returned 4 [0068.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG", pszSpec="*.tar") returned 0 [0068.600] lstrlenA (lpString="*.tar") returned 5 [0068.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG", pszSpec="*.gzip") returned 0 [0068.600] lstrlenA (lpString="*.gzip") returned 6 [0068.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG", pszSpec="*.jpg") returned 1 [0068.600] lstrlenA (lpString="*.jpg") returned 5 [0068.600] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" [0068.600] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" [0068.600] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG." [0068.600] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.BD" [0068.600] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.600] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8a5b [0068.600] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc3458198, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.600] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.600] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x89ff, lpOverlapped=0x0) returned 1 [0068.602] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned="J0145879.JPG" [0068.603] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.603] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x89ff, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x89ff, lpOverlapped=0x0) returned 1 [0068.604] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.604] CloseHandle (hObject=0x1cc) returned 1 [0068.605] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.bd")) returned 1 [0068.606] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc345e17e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x84a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145895.JPG", cAlternateFileName="")) returned 1 [0068.606] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.606] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0145895.JPG") returned -1 [0068.606] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0145895.JPG") returned -1 [0068.606] lstrcmpiA (lpString1="", lpString2="J0145895.JPG") returned -1 [0068.606] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned="J0145879.JPG" [0068.606] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.606] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.606] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.606] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.606] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0145895.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" [0068.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG", pszSpec="*.zip") returned 0 [0068.606] lstrlenA (lpString="*.zip") returned 5 [0068.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG", pszSpec="*.rar") returned 0 [0068.606] lstrlenA (lpString="*.rar") returned 5 [0068.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG", pszSpec="*.7z") returned 0 [0068.606] lstrlenA (lpString="*.7z") returned 4 [0068.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG", pszSpec="*.tar") returned 0 [0068.606] lstrlenA (lpString="*.tar") returned 5 [0068.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG", pszSpec="*.gzip") returned 0 [0068.606] lstrlenA (lpString="*.gzip") returned 6 [0068.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG", pszSpec="*.jpg") returned 1 [0068.606] lstrlenA (lpString="*.jpg") returned 5 [0068.606] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" [0068.607] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" [0068.607] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG." [0068.607] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.BD" [0068.607] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.607] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x84a6 [0068.607] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc345e17e, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.607] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.607] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x844a, lpOverlapped=0x0) returned 1 [0068.609] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned="J0145895.JPG" [0068.610] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.610] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x844a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x844a, lpOverlapped=0x0) returned 1 [0068.610] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.610] CloseHandle (hObject=0x1cc) returned 1 [0068.611] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.bd")) returned 1 [0068.612] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf7a2a9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x9a76, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145904.JPG", cAlternateFileName="")) returned 1 [0068.612] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.612] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0145904.JPG") returned -1 [0068.612] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0145904.JPG") returned -1 [0068.612] lstrcmpiA (lpString1="", lpString2="J0145904.JPG") returned -1 [0068.612] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned="J0145895.JPG" [0068.612] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.612] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.612] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.612] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.612] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0145904.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" [0068.613] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG", pszSpec="*.zip") returned 0 [0068.613] lstrlenA (lpString="*.zip") returned 5 [0068.613] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG", pszSpec="*.rar") returned 0 [0068.613] lstrlenA (lpString="*.rar") returned 5 [0068.613] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG", pszSpec="*.7z") returned 0 [0068.613] lstrlenA (lpString="*.7z") returned 4 [0068.613] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG", pszSpec="*.tar") returned 0 [0068.613] lstrlenA (lpString="*.tar") returned 5 [0068.613] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG", pszSpec="*.gzip") returned 0 [0068.613] lstrlenA (lpString="*.gzip") returned 6 [0068.613] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG", pszSpec="*.jpg") returned 1 [0068.613] lstrlenA (lpString="*.jpg") returned 5 [0068.613] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" [0068.613] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" [0068.613] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG." [0068.613] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.BD" [0068.613] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.614] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9a76 [0068.614] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xadf7a2a9, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.614] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.614] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x9a1a, lpOverlapped=0x0) returned 1 [0068.617] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned="J0145904.JPG" [0068.618] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.618] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x9a1a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x9a1a, lpOverlapped=0x0) returned 1 [0068.619] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.619] CloseHandle (hObject=0x1cc) returned 1 [0068.621] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.bd")) returned 1 [0068.621] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf8179c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0146142.JPG", cAlternateFileName="")) returned 1 [0068.621] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.621] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0146142.JPG") returned -1 [0068.621] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0146142.JPG") returned -1 [0068.621] lstrcmpiA (lpString1="", lpString2="J0146142.JPG") returned -1 [0068.621] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned="J0145904.JPG" [0068.621] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.622] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.622] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.622] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.622] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0146142.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" [0068.622] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG", pszSpec="*.zip") returned 0 [0068.622] lstrlenA (lpString="*.zip") returned 5 [0068.622] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG", pszSpec="*.rar") returned 0 [0068.622] lstrlenA (lpString="*.rar") returned 5 [0068.622] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG", pszSpec="*.7z") returned 0 [0068.622] lstrlenA (lpString="*.7z") returned 4 [0068.622] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG", pszSpec="*.tar") returned 0 [0068.622] lstrlenA (lpString="*.tar") returned 5 [0068.622] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG", pszSpec="*.gzip") returned 0 [0068.622] lstrlenA (lpString="*.gzip") returned 6 [0068.622] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG", pszSpec="*.jpg") returned 1 [0068.622] lstrlenA (lpString="*.jpg") returned 5 [0068.622] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" [0068.622] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" [0068.622] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG." [0068.622] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.BD" [0068.622] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.622] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb5ac [0068.622] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xadf8179c, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.623] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.623] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xb550, lpOverlapped=0x0) returned 1 [0068.624] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned="J0146142.JPG" [0068.626] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.626] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xb550, lpOverlapped=0x0) returned 1 [0068.626] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.626] CloseHandle (hObject=0x1cc) returned 1 [0068.628] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.bd")) returned 1 [0068.629] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34655d3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xaa9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0148309.JPG", cAlternateFileName="")) returned 1 [0068.629] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.629] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0148309.JPG") returned -1 [0068.629] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0148309.JPG") returned -1 [0068.629] lstrcmpiA (lpString1="", lpString2="J0148309.JPG") returned -1 [0068.629] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned="J0146142.JPG" [0068.629] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.629] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.629] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.629] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.629] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0148309.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" [0068.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG", pszSpec="*.zip") returned 0 [0068.629] lstrlenA (lpString="*.zip") returned 5 [0068.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG", pszSpec="*.rar") returned 0 [0068.629] lstrlenA (lpString="*.rar") returned 5 [0068.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG", pszSpec="*.7z") returned 0 [0068.629] lstrlenA (lpString="*.7z") returned 4 [0068.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG", pszSpec="*.tar") returned 0 [0068.630] lstrlenA (lpString="*.tar") returned 5 [0068.630] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG", pszSpec="*.gzip") returned 0 [0068.630] lstrlenA (lpString="*.gzip") returned 6 [0068.630] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG", pszSpec="*.jpg") returned 1 [0068.630] lstrlenA (lpString="*.jpg") returned 5 [0068.630] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" [0068.630] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" [0068.630] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG." [0068.630] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.BD" [0068.630] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.631] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaa9a [0068.631] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc34655d3, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.631] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.631] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xaa3e, lpOverlapped=0x0) returned 1 [0068.632] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned="J0148309.JPG" [0068.634] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.634] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xaa3e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xaa3e, lpOverlapped=0x0) returned 1 [0068.634] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.634] CloseHandle (hObject=0x1cc) returned 1 [0068.636] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.bd")) returned 1 [0068.637] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc346cafc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x107d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0148757.JPG", cAlternateFileName="")) returned 1 [0068.637] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.637] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0148757.JPG") returned -1 [0068.637] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0148757.JPG") returned -1 [0068.637] lstrcmpiA (lpString1="", lpString2="J0148757.JPG") returned -1 [0068.637] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned="J0148309.JPG" [0068.637] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.637] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.637] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.637] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.637] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0148757.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" [0068.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG", pszSpec="*.zip") returned 0 [0068.637] lstrlenA (lpString="*.zip") returned 5 [0068.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG", pszSpec="*.rar") returned 0 [0068.637] lstrlenA (lpString="*.rar") returned 5 [0068.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG", pszSpec="*.7z") returned 0 [0068.637] lstrlenA (lpString="*.7z") returned 4 [0068.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG", pszSpec="*.tar") returned 0 [0068.637] lstrlenA (lpString="*.tar") returned 5 [0068.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG", pszSpec="*.gzip") returned 0 [0068.637] lstrlenA (lpString="*.gzip") returned 6 [0068.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG", pszSpec="*.jpg") returned 1 [0068.637] lstrlenA (lpString="*.jpg") returned 5 [0068.637] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" [0068.638] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" [0068.638] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG." [0068.638] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.BD" [0068.638] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.638] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x107d4 [0068.638] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc346cafc, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.638] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.638] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x10778, lpOverlapped=0x0) returned 1 [0068.641] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned="J0148757.JPG" [0068.643] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.643] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x10778, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x10778, lpOverlapped=0x0) returned 1 [0068.643] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.643] CloseHandle (hObject=0x1cc) returned 1 [0068.646] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.bd")) returned 1 [0068.646] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3472c60, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x955d, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0148798.JPG", cAlternateFileName="")) returned 1 [0068.646] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.646] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0148798.JPG") returned -1 [0068.646] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0148798.JPG") returned -1 [0068.646] lstrcmpiA (lpString1="", lpString2="J0148798.JPG") returned -1 [0068.646] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned="J0148757.JPG" [0068.646] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.646] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.646] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.647] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.647] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0148798.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" [0068.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG", pszSpec="*.zip") returned 0 [0068.647] lstrlenA (lpString="*.zip") returned 5 [0068.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG", pszSpec="*.rar") returned 0 [0068.647] lstrlenA (lpString="*.rar") returned 5 [0068.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG", pszSpec="*.7z") returned 0 [0068.647] lstrlenA (lpString="*.7z") returned 4 [0068.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG", pszSpec="*.tar") returned 0 [0068.647] lstrlenA (lpString="*.tar") returned 5 [0068.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG", pszSpec="*.gzip") returned 0 [0068.647] lstrlenA (lpString="*.gzip") returned 6 [0068.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG", pszSpec="*.jpg") returned 1 [0068.647] lstrlenA (lpString="*.jpg") returned 5 [0068.647] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" [0068.647] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" [0068.647] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG." [0068.647] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.BD" [0068.647] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.647] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x955d [0068.647] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc3472c60, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.647] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.648] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x9501, lpOverlapped=0x0) returned 1 [0068.650] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned="J0148798.JPG" [0068.651] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.651] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x9501, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x9501, lpOverlapped=0x0) returned 1 [0068.651] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.651] CloseHandle (hObject=0x1cc) returned 1 [0068.653] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.bd")) returned 1 [0068.654] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf88d5f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6b01, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149018.JPG", cAlternateFileName="")) returned 1 [0068.654] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.654] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0149018.JPG") returned -1 [0068.654] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0149018.JPG") returned -1 [0068.654] lstrcmpiA (lpString1="", lpString2="J0149018.JPG") returned -1 [0068.654] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned="J0148798.JPG" [0068.654] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.654] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.654] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.654] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.654] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0149018.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" [0068.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG", pszSpec="*.zip") returned 0 [0068.654] lstrlenA (lpString="*.zip") returned 5 [0068.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG", pszSpec="*.rar") returned 0 [0068.654] lstrlenA (lpString="*.rar") returned 5 [0068.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG", pszSpec="*.7z") returned 0 [0068.654] lstrlenA (lpString="*.7z") returned 4 [0068.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG", pszSpec="*.tar") returned 0 [0068.654] lstrlenA (lpString="*.tar") returned 5 [0068.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG", pszSpec="*.gzip") returned 0 [0068.654] lstrlenA (lpString="*.gzip") returned 6 [0068.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG", pszSpec="*.jpg") returned 1 [0068.654] lstrlenA (lpString="*.jpg") returned 5 [0068.654] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" [0068.654] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" [0068.654] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG." [0068.654] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.BD" [0068.655] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.655] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6b01 [0068.655] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xadf88d5f, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.655] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.655] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x6aa5, lpOverlapped=0x0) returned 1 [0068.657] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned="J0149018.JPG" [0068.658] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.658] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x6aa5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x6aa5, lpOverlapped=0x0) returned 1 [0068.658] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.658] CloseHandle (hObject=0x1cc) returned 1 [0068.660] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.bd")) returned 1 [0068.660] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf901e9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xfd22, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149118.JPG", cAlternateFileName="")) returned 1 [0068.660] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.661] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0149118.JPG") returned -1 [0068.661] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0149118.JPG") returned -1 [0068.661] lstrcmpiA (lpString1="", lpString2="J0149118.JPG") returned -1 [0068.661] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned="J0149018.JPG" [0068.661] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.661] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.661] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.661] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.661] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0149118.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" [0068.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG", pszSpec="*.zip") returned 0 [0068.661] lstrlenA (lpString="*.zip") returned 5 [0068.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG", pszSpec="*.rar") returned 0 [0068.661] lstrlenA (lpString="*.rar") returned 5 [0068.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG", pszSpec="*.7z") returned 0 [0068.661] lstrlenA (lpString="*.7z") returned 4 [0068.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG", pszSpec="*.tar") returned 0 [0068.661] lstrlenA (lpString="*.tar") returned 5 [0068.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG", pszSpec="*.gzip") returned 0 [0068.661] lstrlenA (lpString="*.gzip") returned 6 [0068.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG", pszSpec="*.jpg") returned 1 [0068.661] lstrlenA (lpString="*.jpg") returned 5 [0068.661] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" [0068.661] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" [0068.661] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG." [0068.661] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.BD" [0068.661] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.662] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfd22 [0068.662] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xadf901e9, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.662] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.662] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xfcc6, lpOverlapped=0x0) returned 1 [0068.664] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned="J0149118.JPG" [0068.666] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.666] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xfcc6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xfcc6, lpOverlapped=0x0) returned 1 [0068.666] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.666] CloseHandle (hObject=0x1cc) returned 1 [0068.668] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.bd")) returned 1 [0068.669] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf963e1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb544, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0150150.WMF", cAlternateFileName="")) returned 1 [0068.669] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.669] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0150150.WMF") returned -1 [0068.669] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0150150.WMF") returned -1 [0068.669] lstrcmpiA (lpString1="", lpString2="J0150150.WMF") returned -1 [0068.669] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned="J0149118.JPG" [0068.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.669] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.669] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.669] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.669] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0150150.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" [0068.670] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.zip") returned 0 [0068.670] lstrlenA (lpString="*.zip") returned 5 [0068.670] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.rar") returned 0 [0068.670] lstrlenA (lpString="*.rar") returned 5 [0068.670] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.7z") returned 0 [0068.670] lstrlenA (lpString="*.7z") returned 4 [0068.670] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.tar") returned 0 [0068.670] lstrlenA (lpString="*.tar") returned 5 [0068.670] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.gzip") returned 0 [0068.670] lstrlenA (lpString="*.gzip") returned 6 [0068.670] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.jpg") returned 0 [0068.670] lstrlenA (lpString="*.jpg") returned 5 [0068.670] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.jpeg") returned 0 [0068.670] lstrlenA (lpString="*.jpeg") returned 6 [0068.670] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.psd") returned 0 [0068.670] lstrlenA (lpString="*.psd") returned 5 [0068.670] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.cdr") returned 0 [0068.670] lstrlenA (lpString="*.cdr") returned 5 [0068.670] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.dwg") returned 0 [0068.670] lstrlenA (lpString="*.dwg") returned 5 [0068.670] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.max") returned 0 [0068.670] lstrlenA (lpString="*.max") returned 5 [0068.670] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.bmp") returned 0 [0068.670] lstrlenA (lpString="*.bmp") returned 5 [0068.670] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.gif") returned 0 [0068.670] lstrlenA (lpString="*.gif") returned 5 [0068.670] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.png") returned 0 [0068.670] lstrlenA (lpString="*.png") returned 5 [0068.670] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.doc") returned 0 [0068.670] lstrlenA (lpString="*.doc") returned 5 [0068.671] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.docx") returned 0 [0068.671] lstrlenA (lpString="*.docx") returned 6 [0068.671] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.xls") returned 0 [0068.671] lstrlenA (lpString="*.xls") returned 5 [0068.671] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.xlsx") returned 0 [0068.671] lstrlenA (lpString="*.xlsx") returned 6 [0068.671] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.ppt") returned 0 [0068.671] lstrlenA (lpString="*.ppt") returned 5 [0068.671] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.pptx") returned 0 [0068.671] lstrlenA (lpString="*.pptx") returned 6 [0068.671] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.txt") returned 0 [0068.671] lstrlenA (lpString="*.txt") returned 5 [0068.671] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.pdf") returned 0 [0068.671] lstrlenA (lpString="*.pdf") returned 5 [0068.671] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.djvu") returned 0 [0068.671] lstrlenA (lpString="*.djvu") returned 6 [0068.671] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.htm") returned 0 [0068.671] lstrlenA (lpString="*.htm") returned 5 [0068.671] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.html") returned 0 [0068.671] lstrlenA (lpString="*.html") returned 6 [0068.671] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.mdb") returned 0 [0068.671] lstrlenA (lpString="*.mdb") returned 5 [0068.671] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.cer") returned 0 [0068.671] lstrlenA (lpString="*.cer") returned 5 [0068.671] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.p12") returned 0 [0068.671] lstrlenA (lpString="*.p12") returned 5 [0068.671] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.pfx") returned 0 [0068.671] lstrlenA (lpString="*.pfx") returned 5 [0068.671] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.kwm") returned 0 [0068.671] lstrlenA (lpString="*.kwm") returned 5 [0068.671] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.pwm") returned 0 [0068.672] lstrlenA (lpString="*.pwm") returned 5 [0068.672] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.1cd") returned 0 [0068.672] lstrlenA (lpString="*.1cd") returned 5 [0068.672] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.md") returned 0 [0068.672] lstrlenA (lpString="*.md") returned 4 [0068.672] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.mdf") returned 0 [0068.672] lstrlenA (lpString="*.mdf") returned 5 [0068.672] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.dbf") returned 0 [0068.672] lstrlenA (lpString="*.dbf") returned 5 [0068.672] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.odt") returned 0 [0068.672] lstrlenA (lpString="*.odt") returned 5 [0068.672] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.vob") returned 0 [0068.672] lstrlenA (lpString="*.vob") returned 5 [0068.672] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.ifo") returned 0 [0068.672] lstrlenA (lpString="*.ifo") returned 5 [0068.672] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.lnk") returned 0 [0068.672] lstrlenA (lpString="*.lnk") returned 5 [0068.672] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.torrent") returned 0 [0068.672] lstrlenA (lpString="*.torrent") returned 9 [0068.672] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.mov") returned 0 [0068.672] lstrlenA (lpString="*.mov") returned 5 [0068.672] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.m2v") returned 0 [0068.672] lstrlenA (lpString="*.m2v") returned 5 [0068.672] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.3gp") returned 0 [0068.672] lstrlenA (lpString="*.3gp") returned 5 [0068.672] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.mpeg") returned 0 [0068.672] lstrlenA (lpString="*.mpeg") returned 6 [0068.672] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.mpg") returned 0 [0068.672] lstrlenA (lpString="*.mpg") returned 5 [0068.672] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.flv") returned 0 [0068.672] lstrlenA (lpString="*.flv") returned 5 [0068.672] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.avi") returned 0 [0068.672] lstrlenA (lpString="*.avi") returned 5 [0068.672] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.mp4") returned 0 [0068.672] lstrlenA (lpString="*.mp4") returned 5 [0068.673] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.wmv") returned 0 [0068.673] lstrlenA (lpString="*.wmv") returned 5 [0068.673] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.divx") returned 0 [0068.673] lstrlenA (lpString="*.divx") returned 6 [0068.673] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.mkv") returned 0 [0068.673] lstrlenA (lpString="*.mkv") returned 5 [0068.673] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.mp3") returned 0 [0068.673] lstrlenA (lpString="*.mp3") returned 5 [0068.673] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.wav") returned 0 [0068.673] lstrlenA (lpString="*.wav") returned 5 [0068.673] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.flac") returned 0 [0068.673] lstrlenA (lpString="*.flac") returned 6 [0068.673] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.ape") returned 0 [0068.673] lstrlenA (lpString="*.ape") returned 5 [0068.673] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.wma") returned 0 [0068.673] lstrlenA (lpString="*.wma") returned 5 [0068.673] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.ac3") returned 0 [0068.673] lstrlenA (lpString="*.ac3") returned 5 [0068.673] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf9b19a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x212e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0150861.WMF", cAlternateFileName="")) returned 1 [0068.673] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.673] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0150861.WMF") returned -1 [0068.673] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0150861.WMF") returned -1 [0068.673] lstrcmpiA (lpString1="", lpString2="J0150861.WMF") returned -1 [0068.673] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned="J0150150.WMF" [0068.673] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.673] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.673] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.673] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.673] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0150861.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" [0068.673] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.zip") returned 0 [0068.673] lstrlenA (lpString="*.zip") returned 5 [0068.674] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.rar") returned 0 [0068.674] lstrlenA (lpString="*.rar") returned 5 [0068.674] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.7z") returned 0 [0068.674] lstrlenA (lpString="*.7z") returned 4 [0068.674] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.tar") returned 0 [0068.674] lstrlenA (lpString="*.tar") returned 5 [0068.674] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.gzip") returned 0 [0068.674] lstrlenA (lpString="*.gzip") returned 6 [0068.674] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.jpg") returned 0 [0068.674] lstrlenA (lpString="*.jpg") returned 5 [0068.674] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.jpeg") returned 0 [0068.674] lstrlenA (lpString="*.jpeg") returned 6 [0068.674] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.psd") returned 0 [0068.674] lstrlenA (lpString="*.psd") returned 5 [0068.674] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.cdr") returned 0 [0068.674] lstrlenA (lpString="*.cdr") returned 5 [0068.674] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.dwg") returned 0 [0068.674] lstrlenA (lpString="*.dwg") returned 5 [0068.674] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.max") returned 0 [0068.674] lstrlenA (lpString="*.max") returned 5 [0068.674] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.bmp") returned 0 [0068.674] lstrlenA (lpString="*.bmp") returned 5 [0068.674] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.gif") returned 0 [0068.674] lstrlenA (lpString="*.gif") returned 5 [0068.674] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.png") returned 0 [0068.674] lstrlenA (lpString="*.png") returned 5 [0068.674] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.doc") returned 0 [0068.674] lstrlenA (lpString="*.doc") returned 5 [0068.674] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.docx") returned 0 [0068.674] lstrlenA (lpString="*.docx") returned 6 [0068.674] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.xls") returned 0 [0068.674] lstrlenA (lpString="*.xls") returned 5 [0068.674] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.xlsx") returned 0 [0068.675] lstrlenA (lpString="*.xlsx") returned 6 [0068.675] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.ppt") returned 0 [0068.675] lstrlenA (lpString="*.ppt") returned 5 [0068.675] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.pptx") returned 0 [0068.675] lstrlenA (lpString="*.pptx") returned 6 [0068.675] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.txt") returned 0 [0068.675] lstrlenA (lpString="*.txt") returned 5 [0068.675] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.pdf") returned 0 [0068.675] lstrlenA (lpString="*.pdf") returned 5 [0068.675] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.djvu") returned 0 [0068.675] lstrlenA (lpString="*.djvu") returned 6 [0068.675] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.htm") returned 0 [0068.675] lstrlenA (lpString="*.htm") returned 5 [0068.675] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.html") returned 0 [0068.675] lstrlenA (lpString="*.html") returned 6 [0068.675] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.mdb") returned 0 [0068.675] lstrlenA (lpString="*.mdb") returned 5 [0068.675] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.cer") returned 0 [0068.675] lstrlenA (lpString="*.cer") returned 5 [0068.675] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.p12") returned 0 [0068.675] lstrlenA (lpString="*.p12") returned 5 [0068.675] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.pfx") returned 0 [0068.675] lstrlenA (lpString="*.pfx") returned 5 [0068.675] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.kwm") returned 0 [0068.675] lstrlenA (lpString="*.kwm") returned 5 [0068.675] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.pwm") returned 0 [0068.675] lstrlenA (lpString="*.pwm") returned 5 [0068.675] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.1cd") returned 0 [0068.675] lstrlenA (lpString="*.1cd") returned 5 [0068.675] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.md") returned 0 [0068.675] lstrlenA (lpString="*.md") returned 4 [0068.675] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.mdf") returned 0 [0068.675] lstrlenA (lpString="*.mdf") returned 5 [0068.675] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.dbf") returned 0 [0068.676] lstrlenA (lpString="*.dbf") returned 5 [0068.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.odt") returned 0 [0068.676] lstrlenA (lpString="*.odt") returned 5 [0068.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.vob") returned 0 [0068.676] lstrlenA (lpString="*.vob") returned 5 [0068.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.ifo") returned 0 [0068.676] lstrlenA (lpString="*.ifo") returned 5 [0068.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.lnk") returned 0 [0068.676] lstrlenA (lpString="*.lnk") returned 5 [0068.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.torrent") returned 0 [0068.676] lstrlenA (lpString="*.torrent") returned 9 [0068.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.mov") returned 0 [0068.676] lstrlenA (lpString="*.mov") returned 5 [0068.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.m2v") returned 0 [0068.676] lstrlenA (lpString="*.m2v") returned 5 [0068.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.3gp") returned 0 [0068.676] lstrlenA (lpString="*.3gp") returned 5 [0068.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.mpeg") returned 0 [0068.676] lstrlenA (lpString="*.mpeg") returned 6 [0068.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.mpg") returned 0 [0068.676] lstrlenA (lpString="*.mpg") returned 5 [0068.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.flv") returned 0 [0068.676] lstrlenA (lpString="*.flv") returned 5 [0068.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.avi") returned 0 [0068.676] lstrlenA (lpString="*.avi") returned 5 [0068.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.mp4") returned 0 [0068.676] lstrlenA (lpString="*.mp4") returned 5 [0068.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.wmv") returned 0 [0068.676] lstrlenA (lpString="*.wmv") returned 5 [0068.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.divx") returned 0 [0068.676] lstrlenA (lpString="*.divx") returned 6 [0068.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.mkv") returned 0 [0068.676] lstrlenA (lpString="*.mkv") returned 5 [0068.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.mp3") returned 0 [0068.677] lstrlenA (lpString="*.mp3") returned 5 [0068.677] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.wav") returned 0 [0068.677] lstrlenA (lpString="*.wav") returned 5 [0068.677] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.flac") returned 0 [0068.677] lstrlenA (lpString="*.flac") returned 6 [0068.677] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.ape") returned 0 [0068.677] lstrlenA (lpString="*.ape") returned 5 [0068.677] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.wma") returned 0 [0068.677] lstrlenA (lpString="*.wma") returned 5 [0068.678] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.ac3") returned 0 [0068.678] lstrlenA (lpString="*.ac3") returned 5 [0068.678] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf9ffbb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1104, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151041.WMF", cAlternateFileName="")) returned 1 [0068.678] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.678] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0151041.WMF") returned -1 [0068.678] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0151041.WMF") returned -1 [0068.678] lstrcmpiA (lpString1="", lpString2="J0151041.WMF") returned -1 [0068.678] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned="J0150861.WMF" [0068.678] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.678] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.678] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.678] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.678] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0151041.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" [0068.678] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.zip") returned 0 [0068.678] lstrlenA (lpString="*.zip") returned 5 [0068.678] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.rar") returned 0 [0068.678] lstrlenA (lpString="*.rar") returned 5 [0068.678] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.7z") returned 0 [0068.678] lstrlenA (lpString="*.7z") returned 4 [0068.678] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.tar") returned 0 [0068.678] lstrlenA (lpString="*.tar") returned 5 [0068.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.gzip") returned 0 [0068.679] lstrlenA (lpString="*.gzip") returned 6 [0068.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.jpg") returned 0 [0068.679] lstrlenA (lpString="*.jpg") returned 5 [0068.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.jpeg") returned 0 [0068.679] lstrlenA (lpString="*.jpeg") returned 6 [0068.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.psd") returned 0 [0068.679] lstrlenA (lpString="*.psd") returned 5 [0068.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.cdr") returned 0 [0068.679] lstrlenA (lpString="*.cdr") returned 5 [0068.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.dwg") returned 0 [0068.679] lstrlenA (lpString="*.dwg") returned 5 [0068.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.max") returned 0 [0068.679] lstrlenA (lpString="*.max") returned 5 [0068.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.bmp") returned 0 [0068.679] lstrlenA (lpString="*.bmp") returned 5 [0068.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.gif") returned 0 [0068.679] lstrlenA (lpString="*.gif") returned 5 [0068.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.png") returned 0 [0068.679] lstrlenA (lpString="*.png") returned 5 [0068.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.doc") returned 0 [0068.679] lstrlenA (lpString="*.doc") returned 5 [0068.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.docx") returned 0 [0068.679] lstrlenA (lpString="*.docx") returned 6 [0068.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.xls") returned 0 [0068.679] lstrlenA (lpString="*.xls") returned 5 [0068.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.xlsx") returned 0 [0068.679] lstrlenA (lpString="*.xlsx") returned 6 [0068.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.ppt") returned 0 [0068.679] lstrlenA (lpString="*.ppt") returned 5 [0068.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.pptx") returned 0 [0068.679] lstrlenA (lpString="*.pptx") returned 6 [0068.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.txt") returned 0 [0068.679] lstrlenA (lpString="*.txt") returned 5 [0068.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.pdf") returned 0 [0068.680] lstrlenA (lpString="*.pdf") returned 5 [0068.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.djvu") returned 0 [0068.680] lstrlenA (lpString="*.djvu") returned 6 [0068.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.htm") returned 0 [0068.680] lstrlenA (lpString="*.htm") returned 5 [0068.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.html") returned 0 [0068.680] lstrlenA (lpString="*.html") returned 6 [0068.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.mdb") returned 0 [0068.680] lstrlenA (lpString="*.mdb") returned 5 [0068.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.cer") returned 0 [0068.680] lstrlenA (lpString="*.cer") returned 5 [0068.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.p12") returned 0 [0068.680] lstrlenA (lpString="*.p12") returned 5 [0068.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.pfx") returned 0 [0068.680] lstrlenA (lpString="*.pfx") returned 5 [0068.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.kwm") returned 0 [0068.680] lstrlenA (lpString="*.kwm") returned 5 [0068.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.pwm") returned 0 [0068.680] lstrlenA (lpString="*.pwm") returned 5 [0068.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.1cd") returned 0 [0068.680] lstrlenA (lpString="*.1cd") returned 5 [0068.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.md") returned 0 [0068.680] lstrlenA (lpString="*.md") returned 4 [0068.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.mdf") returned 0 [0068.681] lstrlenA (lpString="*.mdf") returned 5 [0068.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.dbf") returned 0 [0068.681] lstrlenA (lpString="*.dbf") returned 5 [0068.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.odt") returned 0 [0068.681] lstrlenA (lpString="*.odt") returned 5 [0068.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.vob") returned 0 [0068.681] lstrlenA (lpString="*.vob") returned 5 [0068.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.ifo") returned 0 [0068.681] lstrlenA (lpString="*.ifo") returned 5 [0068.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.lnk") returned 0 [0068.681] lstrlenA (lpString="*.lnk") returned 5 [0068.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.torrent") returned 0 [0068.682] lstrlenA (lpString="*.torrent") returned 9 [0068.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.mov") returned 0 [0068.682] lstrlenA (lpString="*.mov") returned 5 [0068.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.m2v") returned 0 [0068.682] lstrlenA (lpString="*.m2v") returned 5 [0068.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.3gp") returned 0 [0068.682] lstrlenA (lpString="*.3gp") returned 5 [0068.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.mpeg") returned 0 [0068.682] lstrlenA (lpString="*.mpeg") returned 6 [0068.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.mpg") returned 0 [0068.682] lstrlenA (lpString="*.mpg") returned 5 [0068.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.flv") returned 0 [0068.682] lstrlenA (lpString="*.flv") returned 5 [0068.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.avi") returned 0 [0068.682] lstrlenA (lpString="*.avi") returned 5 [0068.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.mp4") returned 0 [0068.682] lstrlenA (lpString="*.mp4") returned 5 [0068.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.wmv") returned 0 [0068.682] lstrlenA (lpString="*.wmv") returned 5 [0068.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.divx") returned 0 [0068.682] lstrlenA (lpString="*.divx") returned 6 [0068.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.mkv") returned 0 [0068.682] lstrlenA (lpString="*.mkv") returned 5 [0068.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.mp3") returned 0 [0068.682] lstrlenA (lpString="*.mp3") returned 5 [0068.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.wav") returned 0 [0068.682] lstrlenA (lpString="*.wav") returned 5 [0068.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.flac") returned 0 [0068.682] lstrlenA (lpString="*.flac") returned 6 [0068.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.ape") returned 0 [0068.682] lstrlenA (lpString="*.ape") returned 5 [0068.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.wma") returned 0 [0068.682] lstrlenA (lpString="*.wma") returned 5 [0068.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.ac3") returned 0 [0068.682] lstrlenA (lpString="*.ac3") returned 5 [0068.683] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3478df9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3c68, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151045.WMF", cAlternateFileName="")) returned 1 [0068.684] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.684] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0151045.WMF") returned -1 [0068.684] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0151045.WMF") returned -1 [0068.684] lstrcmpiA (lpString1="", lpString2="J0151045.WMF") returned -1 [0068.684] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned="J0151041.WMF" [0068.684] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.684] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.684] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.684] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.684] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0151045.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" [0068.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.zip") returned 0 [0068.684] lstrlenA (lpString="*.zip") returned 5 [0068.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.rar") returned 0 [0068.684] lstrlenA (lpString="*.rar") returned 5 [0068.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.7z") returned 0 [0068.684] lstrlenA (lpString="*.7z") returned 4 [0068.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.tar") returned 0 [0068.684] lstrlenA (lpString="*.tar") returned 5 [0068.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.gzip") returned 0 [0068.684] lstrlenA (lpString="*.gzip") returned 6 [0068.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.jpg") returned 0 [0068.684] lstrlenA (lpString="*.jpg") returned 5 [0068.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.jpeg") returned 0 [0068.684] lstrlenA (lpString="*.jpeg") returned 6 [0068.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.psd") returned 0 [0068.684] lstrlenA (lpString="*.psd") returned 5 [0068.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.cdr") returned 0 [0068.684] lstrlenA (lpString="*.cdr") returned 5 [0068.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.dwg") returned 0 [0068.685] lstrlenA (lpString="*.dwg") returned 5 [0068.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.max") returned 0 [0068.685] lstrlenA (lpString="*.max") returned 5 [0068.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.bmp") returned 0 [0068.685] lstrlenA (lpString="*.bmp") returned 5 [0068.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.gif") returned 0 [0068.685] lstrlenA (lpString="*.gif") returned 5 [0068.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.png") returned 0 [0068.685] lstrlenA (lpString="*.png") returned 5 [0068.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.doc") returned 0 [0068.685] lstrlenA (lpString="*.doc") returned 5 [0068.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.docx") returned 0 [0068.685] lstrlenA (lpString="*.docx") returned 6 [0068.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.xls") returned 0 [0068.685] lstrlenA (lpString="*.xls") returned 5 [0068.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.xlsx") returned 0 [0068.685] lstrlenA (lpString="*.xlsx") returned 6 [0068.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.ppt") returned 0 [0068.685] lstrlenA (lpString="*.ppt") returned 5 [0068.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.pptx") returned 0 [0068.685] lstrlenA (lpString="*.pptx") returned 6 [0068.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.txt") returned 0 [0068.685] lstrlenA (lpString="*.txt") returned 5 [0068.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.pdf") returned 0 [0068.685] lstrlenA (lpString="*.pdf") returned 5 [0068.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.djvu") returned 0 [0068.685] lstrlenA (lpString="*.djvu") returned 6 [0068.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.htm") returned 0 [0068.685] lstrlenA (lpString="*.htm") returned 5 [0068.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.html") returned 0 [0068.685] lstrlenA (lpString="*.html") returned 6 [0068.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.mdb") returned 0 [0068.686] lstrlenA (lpString="*.mdb") returned 5 [0068.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.cer") returned 0 [0068.686] lstrlenA (lpString="*.cer") returned 5 [0068.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.p12") returned 0 [0068.686] lstrlenA (lpString="*.p12") returned 5 [0068.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.pfx") returned 0 [0068.686] lstrlenA (lpString="*.pfx") returned 5 [0068.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.kwm") returned 0 [0068.686] lstrlenA (lpString="*.kwm") returned 5 [0068.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.pwm") returned 0 [0068.686] lstrlenA (lpString="*.pwm") returned 5 [0068.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.1cd") returned 0 [0068.686] lstrlenA (lpString="*.1cd") returned 5 [0068.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.md") returned 0 [0068.686] lstrlenA (lpString="*.md") returned 4 [0068.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.mdf") returned 0 [0068.686] lstrlenA (lpString="*.mdf") returned 5 [0068.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.dbf") returned 0 [0068.686] lstrlenA (lpString="*.dbf") returned 5 [0068.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.odt") returned 0 [0068.686] lstrlenA (lpString="*.odt") returned 5 [0068.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.vob") returned 0 [0068.686] lstrlenA (lpString="*.vob") returned 5 [0068.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.ifo") returned 0 [0068.686] lstrlenA (lpString="*.ifo") returned 5 [0068.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.lnk") returned 0 [0068.686] lstrlenA (lpString="*.lnk") returned 5 [0068.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.torrent") returned 0 [0068.686] lstrlenA (lpString="*.torrent") returned 9 [0068.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.mov") returned 0 [0068.686] lstrlenA (lpString="*.mov") returned 5 [0068.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.m2v") returned 0 [0068.687] lstrlenA (lpString="*.m2v") returned 5 [0068.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.3gp") returned 0 [0068.687] lstrlenA (lpString="*.3gp") returned 5 [0068.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.mpeg") returned 0 [0068.687] lstrlenA (lpString="*.mpeg") returned 6 [0068.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.mpg") returned 0 [0068.687] lstrlenA (lpString="*.mpg") returned 5 [0068.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.flv") returned 0 [0068.687] lstrlenA (lpString="*.flv") returned 5 [0068.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.avi") returned 0 [0068.687] lstrlenA (lpString="*.avi") returned 5 [0068.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.mp4") returned 0 [0068.687] lstrlenA (lpString="*.mp4") returned 5 [0068.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.wmv") returned 0 [0068.687] lstrlenA (lpString="*.wmv") returned 5 [0068.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.divx") returned 0 [0068.687] lstrlenA (lpString="*.divx") returned 6 [0068.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.mkv") returned 0 [0068.687] lstrlenA (lpString="*.mkv") returned 5 [0068.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.mp3") returned 0 [0068.687] lstrlenA (lpString="*.mp3") returned 5 [0068.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.wav") returned 0 [0068.687] lstrlenA (lpString="*.wav") returned 5 [0068.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.flac") returned 0 [0068.687] lstrlenA (lpString="*.flac") returned 6 [0068.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.ape") returned 0 [0068.687] lstrlenA (lpString="*.ape") returned 5 [0068.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.wma") returned 0 [0068.687] lstrlenA (lpString="*.wma") returned 5 [0068.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.ac3") returned 0 [0068.687] lstrlenA (lpString="*.ac3") returned 5 [0068.687] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc347dc17, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4844, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151047.WMF", cAlternateFileName="")) returned 1 [0068.688] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.688] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0151047.WMF") returned -1 [0068.688] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0151047.WMF") returned -1 [0068.688] lstrcmpiA (lpString1="", lpString2="J0151047.WMF") returned -1 [0068.688] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned="J0151045.WMF" [0068.688] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.688] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.688] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.688] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.688] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0151047.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" [0068.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF", pszSpec="*.zip") returned 0 [0068.688] lstrlenA (lpString="*.zip") returned 5 [0068.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF", pszSpec="*.rar") returned 0 [0068.688] lstrlenA (lpString="*.rar") returned 5 [0068.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF", pszSpec="*.7z") returned 0 [0068.688] lstrlenA (lpString="*.7z") returned 4 [0068.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF", pszSpec="*.tar") returned 0 [0068.688] lstrlenA (lpString="*.tar") returned 5 [0068.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF", pszSpec="*.gzip") returned 0 [0068.688] lstrlenA (lpString="*.gzip") returned 6 [0068.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF", pszSpec="*.jpg") returned 0 [0068.688] lstrlenA (lpString="*.jpg") returned 5 [0068.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF", pszSpec="*.jpeg") returned 0 [0068.688] lstrlenA (lpString="*.jpeg") returned 6 [0068.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF", pszSpec="*.psd") returned 0 [0068.688] lstrlenA (lpString="*.psd") returned 5 [0068.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF", pszSpec="*.cdr") returned 0 [0068.688] lstrlenA (lpString="*.cdr") returned 5 [0068.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF", pszSpec="*.dwg") returned 0 [0068.688] lstrlenA (lpString="*.dwg") returned 5 [0068.689] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF", pszSpec="*.max") returned 0 [0068.689] lstrlenA (lpString="*.max") returned 5 [0068.689] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF", pszSpec="*.bmp") returned 0 [0068.689] lstrlenA (lpString="*.bmp") returned 5 [0068.689] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF", pszSpec="*.gif") returned 0 [0068.689] lstrlenA (lpString="*.gif") returned 5 [0068.689] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF", pszSpec="*.png") returned 0 [0068.689] lstrlenA (lpString="*.png") returned 5 [0068.689] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF", pszSpec="*.doc") returned 0 [0068.689] lstrlenA (lpString="*.doc") returned 5 [0068.689] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF", pszSpec="*.docx") returned 0 [0068.689] lstrlenA (lpString="*.docx") returned 6 [0068.689] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF", pszSpec="*.xls") returned 0 [0068.689] lstrlenA (lpString="*.xls") returned 5 [0068.689] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF", pszSpec="*.xlsx") returned 0 [0068.689] lstrlenA (lpString="*.xlsx") returned 6 [0068.689] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF", pszSpec="*.ppt") returned 0 [0068.689] lstrlenA (lpString="*.ppt") returned 5 [0068.689] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF", pszSpec="*.pptx") returned 0 [0068.689] lstrlenA (lpString="*.pptx") returned 6 [0068.689] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF", pszSpec="*.txt") returned 0 [0068.689] lstrlenA (lpString="*.txt") returned 5 [0068.689] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadfa6200, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3928, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151055.WMF", cAlternateFileName="")) returned 1 [0068.690] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.690] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0151055.WMF") returned -1 [0068.690] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0151055.WMF") returned -1 [0068.690] lstrcmpiA (lpString1="", lpString2="J0151055.WMF") returned -1 [0068.690] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned="J0151047.WMF" [0068.690] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.690] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.690] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.690] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.690] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0151055.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" [0068.690] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3483dd2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151061.WMF", cAlternateFileName="")) returned 1 [0068.690] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.690] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0151061.WMF") returned -1 [0068.690] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0151061.WMF") returned -1 [0068.690] lstrcmpiA (lpString1="", lpString2="J0151061.WMF") returned -1 [0068.690] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned="J0151055.WMF" [0068.690] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.690] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.690] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.690] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.690] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0151061.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" [0068.690] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3488be5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151063.WMF", cAlternateFileName="")) returned 1 [0068.690] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.690] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0151063.WMF") returned -1 [0068.690] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0151063.WMF") returned -1 [0068.690] lstrcmpiA (lpString1="", lpString2="J0151063.WMF") returned -1 [0068.691] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned="J0151061.WMF" [0068.691] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.691] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.691] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.691] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.691] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0151063.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" [0068.691] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadfac394, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3394, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151067.WMF", cAlternateFileName="")) returned 1 [0068.691] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.691] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0151067.WMF") returned -1 [0068.691] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0151067.WMF") returned -1 [0068.691] lstrcmpiA (lpString1="", lpString2="J0151067.WMF") returned -1 [0068.691] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned="J0151063.WMF" [0068.691] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.691] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.691] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.691] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.691] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0151067.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" [0068.691] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadfb24e8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3418, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151073.WMF", cAlternateFileName="")) returned 1 [0068.691] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.691] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0151073.WMF") returned -1 [0068.691] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0151073.WMF") returned -1 [0068.691] lstrcmpiA (lpString1="", lpString2="J0151073.WMF") returned -1 [0068.691] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned="J0151067.WMF" [0068.691] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.691] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.691] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.692] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.692] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0151073.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" [0068.692] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc348da3d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151581.WMF", cAlternateFileName="")) returned 1 [0068.692] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.692] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0151581.WMF") returned -1 [0068.692] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0151581.WMF") returned -1 [0068.692] lstrcmpiA (lpString1="", lpString2="J0151581.WMF") returned -1 [0068.692] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned="J0151073.WMF" [0068.692] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.692] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.692] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.692] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.692] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0151581.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" [0068.692] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadfb9aaf, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x610c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152414.WMF", cAlternateFileName="")) returned 1 [0068.692] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.692] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152414.WMF") returned -1 [0068.692] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152414.WMF") returned -1 [0068.692] lstrcmpiA (lpString1="", lpString2="J0152414.WMF") returned -1 [0068.692] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned="J0151581.WMF" [0068.692] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.692] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.692] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.692] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.692] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152414.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" [0068.693] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3493ba4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152430.WMF", cAlternateFileName="")) returned 1 [0068.693] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.693] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152430.WMF") returned -1 [0068.693] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152430.WMF") returned -1 [0068.693] lstrcmpiA (lpString1="", lpString2="J0152430.WMF") returned -1 [0068.693] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned="J0152414.WMF" [0068.693] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.693] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.693] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.693] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.693] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152430.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" [0068.693] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34989a2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x406c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152432.WMF", cAlternateFileName="")) returned 1 [0068.693] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.693] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152432.WMF") returned -1 [0068.693] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152432.WMF") returned -1 [0068.693] lstrcmpiA (lpString1="", lpString2="J0152432.WMF") returned -1 [0068.693] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned="J0152430.WMF" [0068.693] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.693] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.693] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.693] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.693] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152432.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" [0068.693] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadfbfb9a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2c4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152436.WMF", cAlternateFileName="")) returned 1 [0068.693] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.693] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152436.WMF") returned -1 [0068.694] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152436.WMF") returned -1 [0068.694] lstrcmpiA (lpString1="", lpString2="J0152436.WMF") returned -1 [0068.694] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned="J0152432.WMF" [0068.694] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.694] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.694] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.694] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.694] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152436.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" [0068.694] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34a2684, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4030, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152556.WMF", cAlternateFileName="")) returned 1 [0068.694] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.694] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152556.WMF") returned -1 [0068.694] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152556.WMF") returned -1 [0068.694] lstrcmpiA (lpString1="", lpString2="J0152556.WMF") returned -1 [0068.694] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned="J0152436.WMF" [0068.694] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.694] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.694] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.694] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.694] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152556.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" [0068.694] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34a7417, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3eb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152558.WMF", cAlternateFileName="")) returned 1 [0068.694] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.694] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152558.WMF") returned -1 [0068.694] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152558.WMF") returned -1 [0068.694] lstrcmpiA (lpString1="", lpString2="J0152558.WMF") returned -1 [0068.694] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned="J0152556.WMF" [0068.695] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.695] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.695] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.695] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.695] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152558.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" [0068.695] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34aea14, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2a80, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152560.WMF", cAlternateFileName="")) returned 1 [0068.695] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.695] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152560.WMF") returned -1 [0068.695] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152560.WMF") returned -1 [0068.695] lstrcmpiA (lpString1="", lpString2="J0152560.WMF") returned -1 [0068.695] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned="J0152558.WMF" [0068.695] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.695] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.695] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.695] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.695] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152560.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" [0068.695] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadfc5d43, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152568.WMF", cAlternateFileName="")) returned 1 [0068.695] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.695] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152568.WMF") returned -1 [0068.695] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152568.WMF") returned -1 [0068.695] lstrcmpiA (lpString1="", lpString2="J0152568.WMF") returned -1 [0068.695] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned="J0152560.WMF" [0068.695] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.695] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.695] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.695] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.696] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152568.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" [0068.696] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadfcabaf, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd28, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152570.WMF", cAlternateFileName="")) returned 1 [0068.696] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.696] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152570.WMF") returned -1 [0068.696] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152570.WMF") returned -1 [0068.696] lstrcmpiA (lpString1="", lpString2="J0152570.WMF") returned -1 [0068.696] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned="J0152568.WMF" [0068.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.696] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.696] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.707] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.708] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152570.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" [0068.709] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34b376a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2ab4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152590.WMF", cAlternateFileName="")) returned 1 [0068.709] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.709] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152590.WMF") returned -1 [0068.709] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152590.WMF") returned -1 [0068.709] lstrcmpiA (lpString1="", lpString2="J0152590.WMF") returned -1 [0068.709] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned="J0152570.WMF" [0068.709] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.709] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.709] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.709] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.709] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152590.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" [0068.709] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34b8595, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x18c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152594.WMF", cAlternateFileName="")) returned 1 [0068.709] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.710] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152594.WMF") returned -1 [0068.710] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152594.WMF") returned -1 [0068.710] lstrcmpiA (lpString1="", lpString2="J0152594.WMF") returned -1 [0068.710] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned="J0152590.WMF" [0068.710] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.710] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.710] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.710] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.710] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152594.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" [0068.710] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadfcf987, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2628, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152600.WMF", cAlternateFileName="")) returned 1 [0068.710] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.710] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152600.WMF") returned -1 [0068.710] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152600.WMF") returned -1 [0068.710] lstrcmpiA (lpString1="", lpString2="J0152600.WMF") returned -1 [0068.710] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned="J0152594.WMF" [0068.710] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.710] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.710] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.710] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.710] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152600.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" [0068.710] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadfd34b4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1884, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152602.WMF", cAlternateFileName="")) returned 1 [0068.710] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.710] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152602.WMF") returned -1 [0068.710] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152602.WMF") returned -1 [0068.710] lstrcmpiA (lpString1="", lpString2="J0152602.WMF") returned -1 [0068.710] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned="J0152600.WMF" [0068.711] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.711] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.711] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.711] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.711] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152602.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" [0068.711] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34be71b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x40f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152606.WMF", cAlternateFileName="")) returned 1 [0068.711] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.711] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152606.WMF") returned -1 [0068.711] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152606.WMF") returned -1 [0068.711] lstrcmpiA (lpString1="", lpString2="J0152606.WMF") returned -1 [0068.711] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned="J0152602.WMF" [0068.711] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.711] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.711] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.711] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.711] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152606.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" [0068.711] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadfda969, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3094, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152608.WMF", cAlternateFileName="")) returned 1 [0068.711] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.711] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152608.WMF") returned -1 [0068.711] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152608.WMF") returned -1 [0068.711] lstrcmpiA (lpString1="", lpString2="J0152608.WMF") returned -1 [0068.711] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned="J0152606.WMF" [0068.711] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.711] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.711] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.711] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.712] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152608.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" [0068.713] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadfdf802, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1748, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152610.WMF", cAlternateFileName="")) returned 1 [0068.713] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.713] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152610.WMF") returned -1 [0068.713] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152610.WMF") returned -1 [0068.713] lstrcmpiA (lpString1="", lpString2="J0152610.WMF") returned -1 [0068.713] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned="J0152608.WMF" [0068.713] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.713] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.713] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.713] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.713] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152610.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" [0068.713] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadfe461a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2584, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152622.WMF", cAlternateFileName="")) returned 1 [0068.713] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.713] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152622.WMF") returned -1 [0068.713] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152622.WMF") returned -1 [0068.713] lstrcmpiA (lpString1="", lpString2="J0152622.WMF") returned -1 [0068.713] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned="J0152610.WMF" [0068.713] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.713] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.713] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.713] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.713] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152622.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" [0068.713] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadfe93d8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6688, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152626.WMF", cAlternateFileName="")) returned 1 [0068.713] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.713] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152626.WMF") returned -1 [0068.714] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152626.WMF") returned -1 [0068.714] lstrcmpiA (lpString1="", lpString2="J0152626.WMF") returned -1 [0068.714] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned="J0152622.WMF" [0068.714] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.714] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.714] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.714] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.714] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152626.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" [0068.714] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadff0933, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x785c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152628.WMF", cAlternateFileName="")) returned 1 [0068.714] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.714] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152628.WMF") returned -1 [0068.714] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152628.WMF") returned -1 [0068.714] lstrcmpiA (lpString1="", lpString2="J0152628.WMF") returned -1 [0068.714] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned="J0152626.WMF" [0068.714] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.714] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.714] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.714] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.714] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152628.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" [0068.714] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34c4918, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8774, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152688.WMF", cAlternateFileName="")) returned 1 [0068.714] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.714] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152688.WMF") returned -1 [0068.714] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152688.WMF") returned -1 [0068.714] lstrcmpiA (lpString1="", lpString2="J0152688.WMF") returned -1 [0068.714] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned="J0152628.WMF" [0068.714] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.715] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.715] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.715] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.715] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152688.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" [0068.715] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadff4495, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152690.WMF", cAlternateFileName="")) returned 1 [0068.715] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.715] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152690.WMF") returned -1 [0068.715] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152690.WMF") returned -1 [0068.715] lstrcmpiA (lpString1="", lpString2="J0152690.WMF") returned -1 [0068.715] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned="J0152688.WMF" [0068.715] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.715] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.715] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.715] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.715] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152690.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" [0068.715] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadff9183, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x544, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152694.WMF", cAlternateFileName="")) returned 1 [0068.715] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.715] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152694.WMF") returned -1 [0068.715] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152694.WMF") returned -1 [0068.715] lstrcmpiA (lpString1="", lpString2="J0152694.WMF") returned -1 [0068.715] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned="J0152690.WMF" [0068.715] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.715] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.715] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.716] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.716] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152694.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" [0068.716] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34c96e9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1c98, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152696.WMF", cAlternateFileName="")) returned 1 [0068.716] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.716] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152696.WMF") returned -1 [0068.716] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152696.WMF") returned -1 [0068.716] lstrcmpiA (lpString1="", lpString2="J0152696.WMF") returned -1 [0068.716] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned="J0152694.WMF" [0068.716] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.716] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.716] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.716] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152696.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" [0068.716] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadffe012, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152698.WMF", cAlternateFileName="")) returned 1 [0068.716] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.716] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152698.WMF") returned -1 [0068.716] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152698.WMF") returned -1 [0068.716] lstrcmpiA (lpString1="", lpString2="J0152698.WMF") returned -1 [0068.716] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned="J0152696.WMF" [0068.716] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.716] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.716] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.716] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152698.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" [0068.716] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae004153, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152702.WMF", cAlternateFileName="")) returned 1 [0068.716] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.717] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152702.WMF") returned -1 [0068.717] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152702.WMF") returned -1 [0068.717] lstrcmpiA (lpString1="", lpString2="J0152702.WMF") returned -1 [0068.717] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned="J0152698.WMF" [0068.717] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.717] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.717] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.717] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152702.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" [0068.717] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34ce520, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x674, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152704.WMF", cAlternateFileName="")) returned 1 [0068.717] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.717] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152704.WMF") returned -1 [0068.717] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152704.WMF") returned -1 [0068.717] lstrcmpiA (lpString1="", lpString2="J0152704.WMF") returned -1 [0068.717] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned="J0152702.WMF" [0068.717] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.717] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.717] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.717] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152704.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" [0068.717] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34d3449, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x132c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152708.WMF", cAlternateFileName="")) returned 1 [0068.722] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.722] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152708.WMF") returned -1 [0068.722] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152708.WMF") returned -1 [0068.722] lstrcmpiA (lpString1="", lpString2="J0152708.WMF") returned -1 [0068.722] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned="J0152704.WMF" [0068.722] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.722] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.722] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.722] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152708.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" [0068.722] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae008fad, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x11e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152716.WMF", cAlternateFileName="")) returned 1 [0068.723] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.723] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152716.WMF") returned -1 [0068.723] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152716.WMF") returned -1 [0068.723] lstrcmpiA (lpString1="", lpString2="J0152716.WMF") returned -1 [0068.723] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned="J0152708.WMF" [0068.723] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.723] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.723] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.723] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152716.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" [0068.723] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae00ddff, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1b6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152722.WMF", cAlternateFileName="")) returned 1 [0068.723] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.728] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152722.WMF") returned -1 [0068.728] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152722.WMF") returned -1 [0068.728] lstrcmpiA (lpString1="", lpString2="J0152722.WMF") returned -1 [0068.728] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned="J0152716.WMF" [0068.728] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.728] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.728] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.728] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152722.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" [0068.728] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae012bf8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1ec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152876.WMF", cAlternateFileName="")) returned 1 [0068.728] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.728] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152876.WMF") returned -1 [0068.728] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152876.WMF") returned -1 [0068.728] lstrcmpiA (lpString1="", lpString2="J0152876.WMF") returned -1 [0068.728] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned="J0152722.WMF" [0068.728] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.728] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.728] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.729] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152876.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" [0068.729] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae018de3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3a28, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152878.WMF", cAlternateFileName="")) returned 1 [0068.729] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.729] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152878.WMF") returned -1 [0068.729] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152878.WMF") returned -1 [0068.729] lstrcmpiA (lpString1="", lpString2="J0152878.WMF") returned -1 [0068.729] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned="J0152876.WMF" [0068.729] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.729] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.729] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.729] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152878.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" [0068.729] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae01db79, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2370, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152882.WMF", cAlternateFileName="")) returned 1 [0068.729] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.729] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152882.WMF") returned -1 [0068.729] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152882.WMF") returned -1 [0068.729] lstrcmpiA (lpString1="", lpString2="J0152882.WMF") returned -1 [0068.729] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned="J0152878.WMF" [0068.729] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.729] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.729] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.729] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152882.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" [0068.729] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae023d59, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1b2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152884.WMF", cAlternateFileName="")) returned 1 [0068.729] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.729] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152884.WMF") returned -1 [0068.730] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152884.WMF") returned -1 [0068.730] lstrcmpiA (lpString1="", lpString2="J0152884.WMF") returned -1 [0068.730] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned="J0152882.WMF" [0068.730] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.730] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.730] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.730] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152884.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" [0068.730] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34d94f0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x794, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152890.WMF", cAlternateFileName="")) returned 1 [0068.730] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.730] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152890.WMF") returned -1 [0068.730] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152890.WMF") returned -1 [0068.730] lstrcmpiA (lpString1="", lpString2="J0152890.WMF") returned -1 [0068.730] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned="J0152884.WMF" [0068.730] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.730] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.730] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.730] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152890.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" [0068.730] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae028b61, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x29ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152892.WMF", cAlternateFileName="")) returned 1 [0068.730] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.730] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152892.WMF") returned -1 [0068.730] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152892.WMF") returned -1 [0068.730] lstrcmpiA (lpString1="", lpString2="J0152892.WMF") returned -1 [0068.730] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned="J0152890.WMF" [0068.731] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.731] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.731] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.731] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152892.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" [0068.731] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34dcf5d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2c54, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152894.WMF", cAlternateFileName="")) returned 1 [0068.731] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.731] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152894.WMF") returned -1 [0068.731] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152894.WMF") returned -1 [0068.731] lstrcmpiA (lpString1="", lpString2="J0152894.WMF") returned -1 [0068.731] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned="J0152892.WMF" [0068.731] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.731] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.731] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.731] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152894.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" [0068.731] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34e3133, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1190, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152898.WMF", cAlternateFileName="")) returned 1 [0068.731] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.731] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0152898.WMF") returned -1 [0068.731] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0152898.WMF") returned -1 [0068.731] lstrcmpiA (lpString1="", lpString2="J0152898.WMF") returned -1 [0068.731] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned="J0152894.WMF" [0068.731] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.731] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.731] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.731] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0152898.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" [0068.732] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34e92c0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x812c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153047.WMF", cAlternateFileName="")) returned 1 [0068.732] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.732] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0153047.WMF") returned -1 [0068.732] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0153047.WMF") returned -1 [0068.732] lstrcmpiA (lpString1="", lpString2="J0153047.WMF") returned -1 [0068.732] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned="J0152898.WMF" [0068.732] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.732] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.732] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.732] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0153047.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" [0068.732] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae02ed77, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153087.WMF", cAlternateFileName="")) returned 1 [0068.732] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.732] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0153087.WMF") returned -1 [0068.732] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0153087.WMF") returned -1 [0068.732] lstrcmpiA (lpString1="", lpString2="J0153087.WMF") returned -1 [0068.732] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned="J0153047.WMF" [0068.732] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.732] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.732] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.732] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0153087.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" [0068.732] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34ee158, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1ea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153089.WMF", cAlternateFileName="")) returned 1 [0068.732] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.732] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0153089.WMF") returned -1 [0068.732] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0153089.WMF") returned -1 [0068.732] lstrcmpiA (lpString1="", lpString2="J0153089.WMF") returned -1 [0068.732] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned="J0153087.WMF" [0068.733] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.733] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.733] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.733] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0153089.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" [0068.733] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34f2f0b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153091.WMF", cAlternateFileName="")) returned 1 [0068.733] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.733] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0153091.WMF") returned -1 [0068.733] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0153091.WMF") returned -1 [0068.733] lstrcmpiA (lpString1="", lpString2="J0153091.WMF") returned -1 [0068.733] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned="J0153089.WMF" [0068.733] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.733] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.733] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.733] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0153091.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" [0068.733] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34f7d1e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x22b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153093.WMF", cAlternateFileName="")) returned 1 [0068.733] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.733] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0153093.WMF") returned -1 [0068.733] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0153093.WMF") returned -1 [0068.733] lstrcmpiA (lpString1="", lpString2="J0153093.WMF") returned -1 [0068.733] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned="J0153091.WMF" [0068.733] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.733] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.733] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.733] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0153093.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" [0068.734] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34fcb47, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe78, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153095.WMF", cAlternateFileName="")) returned 1 [0068.734] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.734] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0153095.WMF") returned -1 [0068.734] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0153095.WMF") returned -1 [0068.734] lstrcmpiA (lpString1="", lpString2="J0153095.WMF") returned -1 [0068.734] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned="J0153093.WMF" [0068.734] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.734] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.734] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.734] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0153095.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" [0068.734] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae032794, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xbc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153265.WMF", cAlternateFileName="")) returned 1 [0068.734] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.734] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0153265.WMF") returned -1 [0068.734] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0153265.WMF") returned -1 [0068.734] lstrcmpiA (lpString1="", lpString2="J0153265.WMF") returned -1 [0068.734] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned="J0153095.WMF" [0068.734] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.734] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.734] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.734] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0153265.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" [0068.734] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3502d33, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4e80, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153273.WMF", cAlternateFileName="")) returned 1 [0068.734] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.734] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0153273.WMF") returned -1 [0068.734] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0153273.WMF") returned -1 [0068.734] lstrcmpiA (lpString1="", lpString2="J0153273.WMF") returned -1 [0068.735] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned="J0153265.WMF" [0068.735] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.735] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.735] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.735] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0153273.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" [0068.735] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3508ea9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8f0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153299.WMF", cAlternateFileName="")) returned 1 [0068.735] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.735] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0153299.WMF") returned -1 [0068.735] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0153299.WMF") returned -1 [0068.735] lstrcmpiA (lpString1="", lpString2="J0153299.WMF") returned -1 [0068.735] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned="J0153273.WMF" [0068.735] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.735] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.735] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.735] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0153299.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" [0068.735] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae038b92, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7850, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153302.WMF", cAlternateFileName="")) returned 1 [0068.735] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.735] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0153302.WMF") returned -1 [0068.735] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0153302.WMF") returned -1 [0068.735] lstrcmpiA (lpString1="", lpString2="J0153302.WMF") returned -1 [0068.735] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned="J0153299.WMF" [0068.735] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.735] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.736] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.736] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0153302.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" [0068.736] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae03feac, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x9658, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153305.WMF", cAlternateFileName="")) returned 1 [0068.736] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.736] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0153305.WMF") returned -1 [0068.736] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0153305.WMF") returned -1 [0068.736] lstrcmpiA (lpString1="", lpString2="J0153305.WMF") returned -1 [0068.736] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned="J0153302.WMF" [0068.736] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.736] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.736] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.736] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0153305.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" [0068.736] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0473ba, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153307.WMF", cAlternateFileName="")) returned 1 [0068.736] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.736] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0153307.WMF") returned -1 [0068.736] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0153307.WMF") returned -1 [0068.736] lstrcmpiA (lpString1="", lpString2="J0153307.WMF") returned -1 [0068.736] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned="J0153305.WMF" [0068.736] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.736] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.736] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.736] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0153307.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" [0068.736] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae04c264, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4238, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153313.WMF", cAlternateFileName="")) returned 1 [0068.736] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.737] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0153313.WMF") returned -1 [0068.737] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0153313.WMF") returned -1 [0068.737] lstrcmpiA (lpString1="", lpString2="J0153313.WMF") returned -1 [0068.737] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned="J0153307.WMF" [0068.737] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.737] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.737] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.737] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0153313.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" [0068.737] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0523b9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4464, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153398.WMF", cAlternateFileName="")) returned 1 [0068.737] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.737] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0153398.WMF") returned -1 [0068.737] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0153398.WMF") returned -1 [0068.737] lstrcmpiA (lpString1="", lpString2="J0153398.WMF") returned -1 [0068.737] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned="J0153313.WMF" [0068.737] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.737] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.737] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.737] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0153398.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" [0068.737] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae057198, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x85d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153508.WMF", cAlternateFileName="")) returned 1 [0068.737] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.737] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0153508.WMF") returned -1 [0068.737] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0153508.WMF") returned -1 [0068.737] lstrcmpiA (lpString1="", lpString2="J0153508.WMF") returned -1 [0068.737] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned="J0153398.WMF" [0068.737] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.737] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.738] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.738] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0153508.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" [0068.738] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc350dcf1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x31d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153514.WMF", cAlternateFileName="")) returned 1 [0068.738] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.738] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0153514.WMF") returned -1 [0068.738] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0153514.WMF") returned -1 [0068.738] lstrcmpiA (lpString1="", lpString2="J0153514.WMF") returned -1 [0068.738] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned="J0153508.WMF" [0068.738] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.738] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.738] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.738] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0153514.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" [0068.738] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3512aef, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1d08, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153516.WMF", cAlternateFileName="")) returned 1 [0068.738] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.738] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0153516.WMF") returned -1 [0068.738] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0153516.WMF") returned -1 [0068.738] lstrcmpiA (lpString1="", lpString2="J0153516.WMF") returned -1 [0068.738] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned="J0153514.WMF" [0068.738] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.738] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.738] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.738] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0153516.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" [0068.738] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3518c71, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x30f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153518.WMF", cAlternateFileName="")) returned 1 [0068.739] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.739] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0153518.WMF") returned -1 [0068.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0153518.WMF") returned -1 [0068.739] lstrcmpiA (lpString1="", lpString2="J0153518.WMF") returned -1 [0068.739] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned="J0153516.WMF" [0068.739] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.739] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.739] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.739] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0153518.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" [0068.739] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc351db24, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x560, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0156537.WMF", cAlternateFileName="")) returned 1 [0068.739] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.739] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0156537.WMF") returned -1 [0068.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0156537.WMF") returned -1 [0068.739] lstrcmpiA (lpString1="", lpString2="J0156537.WMF") returned -1 [0068.739] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned="J0153518.WMF" [0068.739] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.739] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.739] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.739] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0156537.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" [0068.739] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae05d35c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb66e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157167.WMF", cAlternateFileName="")) returned 1 [0068.739] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.739] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0157167.WMF") returned -1 [0068.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0157167.WMF") returned -1 [0068.739] lstrcmpiA (lpString1="", lpString2="J0157167.WMF") returned -1 [0068.739] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned="J0156537.WMF" [0068.739] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.739] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.740] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.740] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0157167.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" [0068.740] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3523d10, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x54d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157177.WMF", cAlternateFileName="")) returned 1 [0068.740] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.740] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0157177.WMF") returned -1 [0068.740] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0157177.WMF") returned -1 [0068.740] lstrcmpiA (lpString1="", lpString2="J0157177.WMF") returned -1 [0068.740] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned="J0157167.WMF" [0068.740] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.740] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.740] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.740] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0157177.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" [0068.740] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae063516, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x45f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157191.WMF", cAlternateFileName="")) returned 1 [0068.740] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.740] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0157191.WMF") returned -1 [0068.740] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0157191.WMF") returned -1 [0068.740] lstrcmpiA (lpString1="", lpString2="J0157191.WMF") returned -1 [0068.740] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned="J0157177.WMF" [0068.740] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.740] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.740] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.740] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0157191.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" [0068.741] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3528b2a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2c84, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157831.WMF", cAlternateFileName="")) returned 1 [0068.741] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.741] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0157831.WMF") returned -1 [0068.741] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0157831.WMF") returned -1 [0068.741] lstrcmpiA (lpString1="", lpString2="J0157831.WMF") returned -1 [0068.741] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned="J0157191.WMF" [0068.741] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.741] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.741] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.741] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0157831.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" [0068.741] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc352ffa1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x48dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0158071.WMF", cAlternateFileName="")) returned 1 [0068.742] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.742] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0158071.WMF") returned -1 [0068.742] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0158071.WMF") returned -1 [0068.742] lstrcmpiA (lpString1="", lpString2="J0158071.WMF") returned -1 [0068.742] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned="J0157831.WMF" [0068.742] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.742] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.742] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.743] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0158071.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" [0068.743] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3534db2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x462e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0158477.WMF", cAlternateFileName="")) returned 1 [0068.743] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.743] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0158477.WMF") returned -1 [0068.743] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0158477.WMF") returned -1 [0068.743] lstrcmpiA (lpString1="", lpString2="J0158477.WMF") returned -1 [0068.743] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned="J0158071.WMF" [0068.744] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.744] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.744] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.744] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0158477.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" [0068.744] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae06975d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x72de, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0160590.WMF", cAlternateFileName="")) returned 1 [0068.744] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.744] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0160590.WMF") returned -1 [0068.744] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0160590.WMF") returned -1 [0068.744] lstrcmpiA (lpString1="", lpString2="J0160590.WMF") returned -1 [0068.744] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned="J0158477.WMF" [0068.744] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.744] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.744] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.744] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0160590.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" [0068.744] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae06f831, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb594, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0164153.JPG", cAlternateFileName="")) returned 1 [0068.744] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.744] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0164153.JPG") returned -1 [0068.744] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0164153.JPG") returned -1 [0068.744] lstrcmpiA (lpString1="", lpString2="J0164153.JPG") returned -1 [0068.744] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned="J0160590.WMF" [0068.744] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.744] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.744] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.745] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0164153.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" [0068.745] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG." [0068.745] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.BD" [0068.745] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.746] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb594 [0068.746] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae06f831, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.747] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.747] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xb538, lpOverlapped=0x0) returned 1 [0068.750] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned="J0164153.JPG" [0068.751] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.751] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xb538, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xb538, lpOverlapped=0x0) returned 1 [0068.752] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.752] CloseHandle (hObject=0x1cc) returned 1 [0068.755] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.bd")) returned 1 [0068.756] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3539bf2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x51aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0168644.WMF", cAlternateFileName="")) returned 1 [0068.756] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.756] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0168644.WMF") returned -1 [0068.756] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0168644.WMF") returned -1 [0068.756] lstrcmpiA (lpString1="", lpString2="J0168644.WMF") returned -1 [0068.756] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned="J0164153.JPG" [0068.756] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.756] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.757] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.757] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.757] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0168644.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" [0068.757] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.zip") returned 0 [0068.757] lstrlenA (lpString="*.zip") returned 5 [0068.757] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.rar") returned 0 [0068.757] lstrlenA (lpString="*.rar") returned 5 [0068.757] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.7z") returned 0 [0068.757] lstrlenA (lpString="*.7z") returned 4 [0068.757] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.tar") returned 0 [0068.757] lstrlenA (lpString="*.tar") returned 5 [0068.757] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.gzip") returned 0 [0068.757] lstrlenA (lpString="*.gzip") returned 6 [0068.757] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.jpg") returned 0 [0068.757] lstrlenA (lpString="*.jpg") returned 5 [0068.757] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.jpeg") returned 0 [0068.757] lstrlenA (lpString="*.jpeg") returned 6 [0068.757] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.psd") returned 0 [0068.757] lstrlenA (lpString="*.psd") returned 5 [0068.757] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.cdr") returned 0 [0068.757] lstrlenA (lpString="*.cdr") returned 5 [0068.757] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.dwg") returned 0 [0068.757] lstrlenA (lpString="*.dwg") returned 5 [0068.757] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.max") returned 0 [0068.757] lstrlenA (lpString="*.max") returned 5 [0068.757] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.bmp") returned 0 [0068.757] lstrlenA (lpString="*.bmp") returned 5 [0068.757] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.gif") returned 0 [0068.757] lstrlenA (lpString="*.gif") returned 5 [0068.757] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.png") returned 0 [0068.758] lstrlenA (lpString="*.png") returned 5 [0068.758] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.doc") returned 0 [0068.758] lstrlenA (lpString="*.doc") returned 5 [0068.758] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.docx") returned 0 [0068.758] lstrlenA (lpString="*.docx") returned 6 [0068.758] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.xls") returned 0 [0068.758] lstrlenA (lpString="*.xls") returned 5 [0068.758] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.xlsx") returned 0 [0068.758] lstrlenA (lpString="*.xlsx") returned 6 [0068.758] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.ppt") returned 0 [0068.758] lstrlenA (lpString="*.ppt") returned 5 [0068.758] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.pptx") returned 0 [0068.758] lstrlenA (lpString="*.pptx") returned 6 [0068.758] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.txt") returned 0 [0068.758] lstrlenA (lpString="*.txt") returned 5 [0068.758] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.pdf") returned 0 [0068.758] lstrlenA (lpString="*.pdf") returned 5 [0068.758] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.djvu") returned 0 [0068.758] lstrlenA (lpString="*.djvu") returned 6 [0068.758] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.htm") returned 0 [0068.758] lstrlenA (lpString="*.htm") returned 5 [0068.758] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.html") returned 0 [0068.758] lstrlenA (lpString="*.html") returned 6 [0068.758] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.mdb") returned 0 [0068.758] lstrlenA (lpString="*.mdb") returned 5 [0068.758] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.cer") returned 0 [0068.758] lstrlenA (lpString="*.cer") returned 5 [0068.758] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.p12") returned 0 [0068.758] lstrlenA (lpString="*.p12") returned 5 [0068.758] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.pfx") returned 0 [0068.759] lstrlenA (lpString="*.pfx") returned 5 [0068.759] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.kwm") returned 0 [0068.759] lstrlenA (lpString="*.kwm") returned 5 [0068.759] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.pwm") returned 0 [0068.759] lstrlenA (lpString="*.pwm") returned 5 [0068.759] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.1cd") returned 0 [0068.759] lstrlenA (lpString="*.1cd") returned 5 [0068.759] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.md") returned 0 [0068.759] lstrlenA (lpString="*.md") returned 4 [0068.759] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.mdf") returned 0 [0068.759] lstrlenA (lpString="*.mdf") returned 5 [0068.759] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.dbf") returned 0 [0068.759] lstrlenA (lpString="*.dbf") returned 5 [0068.759] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.odt") returned 0 [0068.759] lstrlenA (lpString="*.odt") returned 5 [0068.759] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.vob") returned 0 [0068.759] lstrlenA (lpString="*.vob") returned 5 [0068.759] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.ifo") returned 0 [0068.759] lstrlenA (lpString="*.ifo") returned 5 [0068.759] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.lnk") returned 0 [0068.759] lstrlenA (lpString="*.lnk") returned 5 [0068.759] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.torrent") returned 0 [0068.759] lstrlenA (lpString="*.torrent") returned 9 [0068.759] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.mov") returned 0 [0068.759] lstrlenA (lpString="*.mov") returned 5 [0068.759] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.m2v") returned 0 [0068.759] lstrlenA (lpString="*.m2v") returned 5 [0068.759] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.3gp") returned 0 [0068.759] lstrlenA (lpString="*.3gp") returned 5 [0068.759] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.mpeg") returned 0 [0068.759] lstrlenA (lpString="*.mpeg") returned 6 [0068.759] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.mpg") returned 0 [0068.759] lstrlenA (lpString="*.mpg") returned 5 [0068.759] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.flv") returned 0 [0068.759] lstrlenA (lpString="*.flv") returned 5 [0068.760] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.avi") returned 0 [0068.760] lstrlenA (lpString="*.avi") returned 5 [0068.760] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.mp4") returned 0 [0068.760] lstrlenA (lpString="*.mp4") returned 5 [0068.760] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.wmv") returned 0 [0068.760] lstrlenA (lpString="*.wmv") returned 5 [0068.760] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.divx") returned 0 [0068.760] lstrlenA (lpString="*.divx") returned 6 [0068.760] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.mkv") returned 0 [0068.760] lstrlenA (lpString="*.mkv") returned 5 [0068.760] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.mp3") returned 0 [0068.760] lstrlenA (lpString="*.mp3") returned 5 [0068.760] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.wav") returned 0 [0068.760] lstrlenA (lpString="*.wav") returned 5 [0068.760] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.flac") returned 0 [0068.760] lstrlenA (lpString="*.flac") returned 6 [0068.760] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.ape") returned 0 [0068.760] lstrlenA (lpString="*.ape") returned 5 [0068.760] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.wma") returned 0 [0068.760] lstrlenA (lpString="*.wma") returned 5 [0068.760] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.ac3") returned 0 [0068.760] lstrlenA (lpString="*.ac3") returned 5 [0068.760] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0759ef, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3888, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0171685.WMF", cAlternateFileName="")) returned 1 [0068.760] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.760] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0171685.WMF") returned -1 [0068.760] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0171685.WMF") returned -1 [0068.760] lstrcmpiA (lpString1="", lpString2="J0171685.WMF") returned -1 [0068.760] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned="J0168644.WMF" [0068.760] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.760] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.760] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.761] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.761] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0171685.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" [0068.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.zip") returned 0 [0068.761] lstrlenA (lpString="*.zip") returned 5 [0068.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.rar") returned 0 [0068.761] lstrlenA (lpString="*.rar") returned 5 [0068.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.7z") returned 0 [0068.761] lstrlenA (lpString="*.7z") returned 4 [0068.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.tar") returned 0 [0068.761] lstrlenA (lpString="*.tar") returned 5 [0068.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.gzip") returned 0 [0068.761] lstrlenA (lpString="*.gzip") returned 6 [0068.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.jpg") returned 0 [0068.761] lstrlenA (lpString="*.jpg") returned 5 [0068.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.jpeg") returned 0 [0068.761] lstrlenA (lpString="*.jpeg") returned 6 [0068.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.psd") returned 0 [0068.761] lstrlenA (lpString="*.psd") returned 5 [0068.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.cdr") returned 0 [0068.761] lstrlenA (lpString="*.cdr") returned 5 [0068.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.dwg") returned 0 [0068.761] lstrlenA (lpString="*.dwg") returned 5 [0068.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.max") returned 0 [0068.761] lstrlenA (lpString="*.max") returned 5 [0068.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.bmp") returned 0 [0068.761] lstrlenA (lpString="*.bmp") returned 5 [0068.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.gif") returned 0 [0068.761] lstrlenA (lpString="*.gif") returned 5 [0068.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.png") returned 0 [0068.761] lstrlenA (lpString="*.png") returned 5 [0068.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.doc") returned 0 [0068.761] lstrlenA (lpString="*.doc") returned 5 [0068.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.docx") returned 0 [0068.762] lstrlenA (lpString="*.docx") returned 6 [0068.762] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.xls") returned 0 [0068.762] lstrlenA (lpString="*.xls") returned 5 [0068.762] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.xlsx") returned 0 [0068.762] lstrlenA (lpString="*.xlsx") returned 6 [0068.762] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.ppt") returned 0 [0068.762] lstrlenA (lpString="*.ppt") returned 5 [0068.762] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.pptx") returned 0 [0068.762] lstrlenA (lpString="*.pptx") returned 6 [0068.762] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.txt") returned 0 [0068.762] lstrlenA (lpString="*.txt") returned 5 [0068.762] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.pdf") returned 0 [0068.762] lstrlenA (lpString="*.pdf") returned 5 [0068.762] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.djvu") returned 0 [0068.762] lstrlenA (lpString="*.djvu") returned 6 [0068.762] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.htm") returned 0 [0068.762] lstrlenA (lpString="*.htm") returned 5 [0068.762] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.html") returned 0 [0068.762] lstrlenA (lpString="*.html") returned 6 [0068.762] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.mdb") returned 0 [0068.762] lstrlenA (lpString="*.mdb") returned 5 [0068.762] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.cer") returned 0 [0068.762] lstrlenA (lpString="*.cer") returned 5 [0068.762] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.p12") returned 0 [0068.762] lstrlenA (lpString="*.p12") returned 5 [0068.762] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.pfx") returned 0 [0068.762] lstrlenA (lpString="*.pfx") returned 5 [0068.762] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.kwm") returned 0 [0068.762] lstrlenA (lpString="*.kwm") returned 5 [0068.762] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.pwm") returned 0 [0068.762] lstrlenA (lpString="*.pwm") returned 5 [0068.762] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.1cd") returned 0 [0068.762] lstrlenA (lpString="*.1cd") returned 5 [0068.763] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.md") returned 0 [0068.763] lstrlenA (lpString="*.md") returned 4 [0068.763] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.mdf") returned 0 [0068.763] lstrlenA (lpString="*.mdf") returned 5 [0068.763] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.dbf") returned 0 [0068.763] lstrlenA (lpString="*.dbf") returned 5 [0068.763] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.odt") returned 0 [0068.763] lstrlenA (lpString="*.odt") returned 5 [0068.763] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.vob") returned 0 [0068.763] lstrlenA (lpString="*.vob") returned 5 [0068.763] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.ifo") returned 0 [0068.763] lstrlenA (lpString="*.ifo") returned 5 [0068.763] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.lnk") returned 0 [0068.763] lstrlenA (lpString="*.lnk") returned 5 [0068.763] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.torrent") returned 0 [0068.763] lstrlenA (lpString="*.torrent") returned 9 [0068.763] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.mov") returned 0 [0068.763] lstrlenA (lpString="*.mov") returned 5 [0068.763] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.m2v") returned 0 [0068.763] lstrlenA (lpString="*.m2v") returned 5 [0068.763] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.3gp") returned 0 [0068.763] lstrlenA (lpString="*.3gp") returned 5 [0068.763] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.mpeg") returned 0 [0068.763] lstrlenA (lpString="*.mpeg") returned 6 [0068.763] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.mpg") returned 0 [0068.763] lstrlenA (lpString="*.mpg") returned 5 [0068.763] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.flv") returned 0 [0068.763] lstrlenA (lpString="*.flv") returned 5 [0068.763] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.avi") returned 0 [0068.763] lstrlenA (lpString="*.avi") returned 5 [0068.763] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.mp4") returned 0 [0068.763] lstrlenA (lpString="*.mp4") returned 5 [0068.763] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.wmv") returned 0 [0068.763] lstrlenA (lpString="*.wmv") returned 5 [0068.763] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.divx") returned 0 [0068.764] lstrlenA (lpString="*.divx") returned 6 [0068.764] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.mkv") returned 0 [0068.764] lstrlenA (lpString="*.mkv") returned 5 [0068.764] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.mp3") returned 0 [0068.764] lstrlenA (lpString="*.mp3") returned 5 [0068.764] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.wav") returned 0 [0068.764] lstrlenA (lpString="*.wav") returned 5 [0068.764] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.flac") returned 0 [0068.764] lstrlenA (lpString="*.flac") returned 6 [0068.764] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.ape") returned 0 [0068.764] lstrlenA (lpString="*.ape") returned 5 [0068.764] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.wma") returned 0 [0068.764] lstrlenA (lpString="*.wma") returned 5 [0068.764] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.ac3") returned 0 [0068.764] lstrlenA (lpString="*.ac3") returned 5 [0068.764] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae07a7c3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1ae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0171847.WMF", cAlternateFileName="")) returned 1 [0068.764] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.764] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0171847.WMF") returned -1 [0068.764] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0171847.WMF") returned -1 [0068.764] lstrcmpiA (lpString1="", lpString2="J0171847.WMF") returned -1 [0068.764] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned="J0171685.WMF" [0068.764] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.764] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.764] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.764] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.764] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0171847.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" [0068.764] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.zip") returned 0 [0068.764] lstrlenA (lpString="*.zip") returned 5 [0068.764] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.rar") returned 0 [0068.764] lstrlenA (lpString="*.rar") returned 5 [0068.764] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.7z") returned 0 [0068.764] lstrlenA (lpString="*.7z") returned 4 [0068.765] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.tar") returned 0 [0068.765] lstrlenA (lpString="*.tar") returned 5 [0068.765] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.gzip") returned 0 [0068.765] lstrlenA (lpString="*.gzip") returned 6 [0068.765] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.jpg") returned 0 [0068.765] lstrlenA (lpString="*.jpg") returned 5 [0068.765] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.jpeg") returned 0 [0068.765] lstrlenA (lpString="*.jpeg") returned 6 [0068.765] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.psd") returned 0 [0068.765] lstrlenA (lpString="*.psd") returned 5 [0068.765] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.cdr") returned 0 [0068.765] lstrlenA (lpString="*.cdr") returned 5 [0068.765] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.dwg") returned 0 [0068.765] lstrlenA (lpString="*.dwg") returned 5 [0068.765] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.max") returned 0 [0068.765] lstrlenA (lpString="*.max") returned 5 [0068.765] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.bmp") returned 0 [0068.765] lstrlenA (lpString="*.bmp") returned 5 [0068.765] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.gif") returned 0 [0068.765] lstrlenA (lpString="*.gif") returned 5 [0068.765] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.png") returned 0 [0068.765] lstrlenA (lpString="*.png") returned 5 [0068.765] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.doc") returned 0 [0068.765] lstrlenA (lpString="*.doc") returned 5 [0068.765] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.docx") returned 0 [0068.765] lstrlenA (lpString="*.docx") returned 6 [0068.765] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.xls") returned 0 [0068.765] lstrlenA (lpString="*.xls") returned 5 [0068.765] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.xlsx") returned 0 [0068.765] lstrlenA (lpString="*.xlsx") returned 6 [0068.765] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.ppt") returned 0 [0068.765] lstrlenA (lpString="*.ppt") returned 5 [0068.765] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.pptx") returned 0 [0068.766] lstrlenA (lpString="*.pptx") returned 6 [0068.766] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.txt") returned 0 [0068.766] lstrlenA (lpString="*.txt") returned 5 [0068.766] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.pdf") returned 0 [0068.766] lstrlenA (lpString="*.pdf") returned 5 [0068.766] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.djvu") returned 0 [0068.766] lstrlenA (lpString="*.djvu") returned 6 [0068.766] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.htm") returned 0 [0068.766] lstrlenA (lpString="*.htm") returned 5 [0068.766] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.html") returned 0 [0068.766] lstrlenA (lpString="*.html") returned 6 [0068.766] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.mdb") returned 0 [0068.766] lstrlenA (lpString="*.mdb") returned 5 [0068.766] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.cer") returned 0 [0068.766] lstrlenA (lpString="*.cer") returned 5 [0068.766] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.p12") returned 0 [0068.766] lstrlenA (lpString="*.p12") returned 5 [0068.766] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.pfx") returned 0 [0068.766] lstrlenA (lpString="*.pfx") returned 5 [0068.766] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.kwm") returned 0 [0068.766] lstrlenA (lpString="*.kwm") returned 5 [0068.766] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.pwm") returned 0 [0068.766] lstrlenA (lpString="*.pwm") returned 5 [0068.766] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.1cd") returned 0 [0068.766] lstrlenA (lpString="*.1cd") returned 5 [0068.766] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.md") returned 0 [0068.766] lstrlenA (lpString="*.md") returned 4 [0068.766] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.mdf") returned 0 [0068.766] lstrlenA (lpString="*.mdf") returned 5 [0068.766] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.dbf") returned 0 [0068.766] lstrlenA (lpString="*.dbf") returned 5 [0068.766] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.odt") returned 0 [0068.766] lstrlenA (lpString="*.odt") returned 5 [0068.767] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.vob") returned 0 [0068.767] lstrlenA (lpString="*.vob") returned 5 [0068.767] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.ifo") returned 0 [0068.767] lstrlenA (lpString="*.ifo") returned 5 [0068.767] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.lnk") returned 0 [0068.767] lstrlenA (lpString="*.lnk") returned 5 [0068.767] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.torrent") returned 0 [0068.767] lstrlenA (lpString="*.torrent") returned 9 [0068.767] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.mov") returned 0 [0068.767] lstrlenA (lpString="*.mov") returned 5 [0068.767] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.m2v") returned 0 [0068.767] lstrlenA (lpString="*.m2v") returned 5 [0068.767] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.3gp") returned 0 [0068.767] lstrlenA (lpString="*.3gp") returned 5 [0068.767] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.mpeg") returned 0 [0068.767] lstrlenA (lpString="*.mpeg") returned 6 [0068.767] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.mpg") returned 0 [0068.767] lstrlenA (lpString="*.mpg") returned 5 [0068.767] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.flv") returned 0 [0068.767] lstrlenA (lpString="*.flv") returned 5 [0068.767] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.avi") returned 0 [0068.767] lstrlenA (lpString="*.avi") returned 5 [0068.767] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.mp4") returned 0 [0068.767] lstrlenA (lpString="*.mp4") returned 5 [0068.767] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.wmv") returned 0 [0068.767] lstrlenA (lpString="*.wmv") returned 5 [0068.767] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.divx") returned 0 [0068.767] lstrlenA (lpString="*.divx") returned 6 [0068.767] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.mkv") returned 0 [0068.767] lstrlenA (lpString="*.mkv") returned 5 [0068.767] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.mp3") returned 0 [0068.767] lstrlenA (lpString="*.mp3") returned 5 [0068.767] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.wav") returned 0 [0068.767] lstrlenA (lpString="*.wav") returned 5 [0068.767] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.flac") returned 0 [0068.768] lstrlenA (lpString="*.flac") returned 6 [0068.768] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.ape") returned 0 [0068.768] lstrlenA (lpString="*.ape") returned 5 [0068.768] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.wma") returned 0 [0068.768] lstrlenA (lpString="*.wma") returned 5 [0068.768] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.ac3") returned 0 [0068.768] lstrlenA (lpString="*.ac3") returned 5 [0068.768] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc353e9f5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1d18, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0172035.WMF", cAlternateFileName="")) returned 1 [0068.768] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.768] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0172035.WMF") returned -1 [0068.768] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0172035.WMF") returned -1 [0068.768] lstrcmpiA (lpString1="", lpString2="J0172035.WMF") returned -1 [0068.768] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned="J0171847.WMF" [0068.768] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.768] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.768] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.768] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.768] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0172035.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" [0068.768] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.zip") returned 0 [0068.768] lstrlenA (lpString="*.zip") returned 5 [0068.768] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.rar") returned 0 [0068.768] lstrlenA (lpString="*.rar") returned 5 [0068.768] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.7z") returned 0 [0068.768] lstrlenA (lpString="*.7z") returned 4 [0068.768] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.tar") returned 0 [0068.768] lstrlenA (lpString="*.tar") returned 5 [0068.768] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.gzip") returned 0 [0068.768] lstrlenA (lpString="*.gzip") returned 6 [0068.768] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.jpg") returned 0 [0068.768] lstrlenA (lpString="*.jpg") returned 5 [0068.768] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.jpeg") returned 0 [0068.768] lstrlenA (lpString="*.jpeg") returned 6 [0068.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.psd") returned 0 [0068.769] lstrlenA (lpString="*.psd") returned 5 [0068.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.cdr") returned 0 [0068.769] lstrlenA (lpString="*.cdr") returned 5 [0068.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.dwg") returned 0 [0068.769] lstrlenA (lpString="*.dwg") returned 5 [0068.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.max") returned 0 [0068.769] lstrlenA (lpString="*.max") returned 5 [0068.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.bmp") returned 0 [0068.769] lstrlenA (lpString="*.bmp") returned 5 [0068.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.gif") returned 0 [0068.769] lstrlenA (lpString="*.gif") returned 5 [0068.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.png") returned 0 [0068.769] lstrlenA (lpString="*.png") returned 5 [0068.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.doc") returned 0 [0068.769] lstrlenA (lpString="*.doc") returned 5 [0068.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.docx") returned 0 [0068.769] lstrlenA (lpString="*.docx") returned 6 [0068.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.xls") returned 0 [0068.769] lstrlenA (lpString="*.xls") returned 5 [0068.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.xlsx") returned 0 [0068.769] lstrlenA (lpString="*.xlsx") returned 6 [0068.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.ppt") returned 0 [0068.769] lstrlenA (lpString="*.ppt") returned 5 [0068.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.pptx") returned 0 [0068.769] lstrlenA (lpString="*.pptx") returned 6 [0068.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.txt") returned 0 [0068.769] lstrlenA (lpString="*.txt") returned 5 [0068.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.pdf") returned 0 [0068.769] lstrlenA (lpString="*.pdf") returned 5 [0068.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.djvu") returned 0 [0068.769] lstrlenA (lpString="*.djvu") returned 6 [0068.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.htm") returned 0 [0068.769] lstrlenA (lpString="*.htm") returned 5 [0068.770] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.html") returned 0 [0068.770] lstrlenA (lpString="*.html") returned 6 [0068.770] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.mdb") returned 0 [0068.770] lstrlenA (lpString="*.mdb") returned 5 [0068.770] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.cer") returned 0 [0068.770] lstrlenA (lpString="*.cer") returned 5 [0068.770] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.p12") returned 0 [0068.770] lstrlenA (lpString="*.p12") returned 5 [0068.770] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.pfx") returned 0 [0068.770] lstrlenA (lpString="*.pfx") returned 5 [0068.770] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.kwm") returned 0 [0068.770] lstrlenA (lpString="*.kwm") returned 5 [0068.770] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.pwm") returned 0 [0068.770] lstrlenA (lpString="*.pwm") returned 5 [0068.770] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.1cd") returned 0 [0068.770] lstrlenA (lpString="*.1cd") returned 5 [0068.770] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.md") returned 0 [0068.770] lstrlenA (lpString="*.md") returned 4 [0068.770] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.mdf") returned 0 [0068.770] lstrlenA (lpString="*.mdf") returned 5 [0068.770] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.dbf") returned 0 [0068.770] lstrlenA (lpString="*.dbf") returned 5 [0068.770] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.odt") returned 0 [0068.770] lstrlenA (lpString="*.odt") returned 5 [0068.770] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.vob") returned 0 [0068.770] lstrlenA (lpString="*.vob") returned 5 [0068.770] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.ifo") returned 0 [0068.770] lstrlenA (lpString="*.ifo") returned 5 [0068.770] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.lnk") returned 0 [0068.770] lstrlenA (lpString="*.lnk") returned 5 [0068.770] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.torrent") returned 0 [0068.770] lstrlenA (lpString="*.torrent") returned 9 [0068.770] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.mov") returned 0 [0068.770] lstrlenA (lpString="*.mov") returned 5 [0068.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.m2v") returned 0 [0068.771] lstrlenA (lpString="*.m2v") returned 5 [0068.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.3gp") returned 0 [0068.771] lstrlenA (lpString="*.3gp") returned 5 [0068.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.mpeg") returned 0 [0068.771] lstrlenA (lpString="*.mpeg") returned 6 [0068.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.mpg") returned 0 [0068.771] lstrlenA (lpString="*.mpg") returned 5 [0068.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.flv") returned 0 [0068.771] lstrlenA (lpString="*.flv") returned 5 [0068.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.avi") returned 0 [0068.771] lstrlenA (lpString="*.avi") returned 5 [0068.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.mp4") returned 0 [0068.771] lstrlenA (lpString="*.mp4") returned 5 [0068.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.wmv") returned 0 [0068.771] lstrlenA (lpString="*.wmv") returned 5 [0068.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.divx") returned 0 [0068.771] lstrlenA (lpString="*.divx") returned 6 [0068.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.mkv") returned 0 [0068.771] lstrlenA (lpString="*.mkv") returned 5 [0068.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.mp3") returned 0 [0068.771] lstrlenA (lpString="*.mp3") returned 5 [0068.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.wav") returned 0 [0068.771] lstrlenA (lpString="*.wav") returned 5 [0068.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.flac") returned 0 [0068.771] lstrlenA (lpString="*.flac") returned 6 [0068.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.ape") returned 0 [0068.771] lstrlenA (lpString="*.ape") returned 5 [0068.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.wma") returned 0 [0068.771] lstrlenA (lpString="*.wma") returned 5 [0068.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.ac3") returned 0 [0068.771] lstrlenA (lpString="*.ac3") returned 5 [0068.771] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc35c893f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1b74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0172067.WMF", cAlternateFileName="")) returned 1 [0068.771] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.772] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0172067.WMF") returned -1 [0068.772] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0172067.WMF") returned -1 [0068.772] lstrcmpiA (lpString1="", lpString2="J0172067.WMF") returned -1 [0068.772] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned="J0172035.WMF" [0068.772] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.772] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.772] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.772] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.772] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0172067.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" [0068.772] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF", pszSpec="*.zip") returned 0 [0068.772] lstrlenA (lpString="*.zip") returned 5 [0068.772] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF", pszSpec="*.rar") returned 0 [0068.772] lstrlenA (lpString="*.rar") returned 5 [0068.772] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF", pszSpec="*.7z") returned 0 [0068.772] lstrlenA (lpString="*.7z") returned 4 [0068.772] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF", pszSpec="*.tar") returned 0 [0068.772] lstrlenA (lpString="*.tar") returned 5 [0068.772] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF", pszSpec="*.gzip") returned 0 [0068.772] lstrlenA (lpString="*.gzip") returned 6 [0068.772] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF", pszSpec="*.jpg") returned 0 [0068.772] lstrlenA (lpString="*.jpg") returned 5 [0068.772] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF", pszSpec="*.jpeg") returned 0 [0068.772] lstrlenA (lpString="*.jpeg") returned 6 [0068.772] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF", pszSpec="*.psd") returned 0 [0068.772] lstrlenA (lpString="*.psd") returned 5 [0068.772] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF", pszSpec="*.cdr") returned 0 [0068.772] lstrlenA (lpString="*.cdr") returned 5 [0068.772] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF", pszSpec="*.dwg") returned 0 [0068.772] lstrlenA (lpString="*.dwg") returned 5 [0068.772] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF", pszSpec="*.max") returned 0 [0068.772] lstrlenA (lpString="*.max") returned 5 [0068.773] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF", pszSpec="*.bmp") returned 0 [0068.773] lstrlenA (lpString="*.bmp") returned 5 [0068.773] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF", pszSpec="*.gif") returned 0 [0068.773] lstrlenA (lpString="*.gif") returned 5 [0068.773] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF", pszSpec="*.png") returned 0 [0068.773] lstrlenA (lpString="*.png") returned 5 [0068.773] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF", pszSpec="*.doc") returned 0 [0068.773] lstrlenA (lpString="*.doc") returned 5 [0068.773] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF", pszSpec="*.docx") returned 0 [0068.773] lstrlenA (lpString="*.docx") returned 6 [0068.773] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF", pszSpec="*.xls") returned 0 [0068.773] lstrlenA (lpString="*.xls") returned 5 [0068.773] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF", pszSpec="*.xlsx") returned 0 [0068.773] lstrlenA (lpString="*.xlsx") returned 6 [0068.773] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF", pszSpec="*.ppt") returned 0 [0068.773] lstrlenA (lpString="*.ppt") returned 5 [0068.773] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF", pszSpec="*.pptx") returned 0 [0068.773] lstrlenA (lpString="*.pptx") returned 6 [0068.773] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF", pszSpec="*.txt") returned 0 [0068.773] lstrlenA (lpString="*.txt") returned 5 [0068.773] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae07f636, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3198, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0172193.WMF", cAlternateFileName="")) returned 1 [0068.773] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.773] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0172193.WMF") returned -1 [0068.773] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0172193.WMF") returned -1 [0068.774] lstrcmpiA (lpString1="", lpString2="J0172193.WMF") returned -1 [0068.774] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned="J0172067.WMF" [0068.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.774] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.774] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.774] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.774] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0172193.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" [0068.774] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae08442f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0174315.WMF", cAlternateFileName="")) returned 1 [0068.774] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.774] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0174315.WMF") returned -1 [0068.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0174315.WMF") returned -1 [0068.774] lstrcmpiA (lpString1="", lpString2="J0174315.WMF") returned -1 [0068.774] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned="J0172193.WMF" [0068.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.776] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.776] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.776] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.776] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0174315.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" [0068.777] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae08e068, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2608, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0174635.WMF", cAlternateFileName="")) returned 1 [0068.777] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.777] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0174635.WMF") returned -1 [0068.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0174635.WMF") returned -1 [0068.777] lstrcmpiA (lpString1="", lpString2="J0174635.WMF") returned -1 [0068.777] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned="J0174315.WMF" [0068.777] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.777] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.777] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.777] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.777] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0174635.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" [0068.777] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc35cfe0a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x13ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0174639.WMF", cAlternateFileName="")) returned 1 [0068.777] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.777] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned="J0174635.WMF" [0068.777] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.777] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.777] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.777] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.777] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0174639.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" [0068.777] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc35d4cba, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6196, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0174952.JPG", cAlternateFileName="")) returned 1 [0068.778] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.778] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned="J0174639.WMF" [0068.778] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.778] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.778] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.778] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.778] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0174952.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" [0068.778] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" [0068.778] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" [0068.778] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG." [0068.778] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.BD" [0068.778] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.779] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6196 [0068.779] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc35d4cba, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.780] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.780] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x613a, lpOverlapped=0x0) returned 1 [0068.783] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned="J0174952.JPG" [0068.784] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.784] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x613a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x613a, lpOverlapped=0x0) returned 1 [0068.784] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.784] CloseHandle (hObject=0x1cc) returned 1 [0068.786] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0174952.jpg.bd")) returned 1 [0068.786] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc35dc186, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb57d, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0175361.JPG", cAlternateFileName="")) returned 1 [0068.786] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.786] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0175361.JPG") returned -1 [0068.787] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0175361.JPG") returned -1 [0068.787] lstrcmpiA (lpString1="", lpString2="J0175361.JPG") returned -1 [0068.787] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned="J0174952.JPG" [0068.787] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.787] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.787] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.787] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.787] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0175361.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" [0068.787] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG", pszSpec="*.zip") returned 0 [0068.787] lstrlenA (lpString="*.zip") returned 5 [0068.787] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG", pszSpec="*.rar") returned 0 [0068.787] lstrlenA (lpString="*.rar") returned 5 [0068.787] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG", pszSpec="*.7z") returned 0 [0068.787] lstrlenA (lpString="*.7z") returned 4 [0068.787] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG", pszSpec="*.tar") returned 0 [0068.787] lstrlenA (lpString="*.tar") returned 5 [0068.787] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG", pszSpec="*.gzip") returned 0 [0068.787] lstrlenA (lpString="*.gzip") returned 6 [0068.787] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG", pszSpec="*.jpg") returned 1 [0068.787] lstrlenA (lpString="*.jpg") returned 5 [0068.787] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" [0068.787] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" [0068.787] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG." [0068.787] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.BD" [0068.787] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.788] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb57d [0068.788] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc35dc186, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.788] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.788] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xb521, lpOverlapped=0x0) returned 1 [0068.791] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned="J0175361.JPG" [0068.792] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.792] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xb521, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xb521, lpOverlapped=0x0) returned 1 [0068.792] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.792] CloseHandle (hObject=0x1cc) returned 1 [0068.794] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0175361.jpg.bd")) returned 1 [0068.795] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae092e89, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x38d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0175428.JPG", cAlternateFileName="")) returned 1 [0068.795] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.795] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0175428.JPG") returned -1 [0068.795] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0175428.JPG") returned -1 [0068.795] lstrcmpiA (lpString1="", lpString2="J0175428.JPG") returned -1 [0068.795] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned="J0175361.JPG" [0068.795] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.795] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.795] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.795] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.795] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0175428.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" [0068.795] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG", pszSpec="*.zip") returned 0 [0068.796] lstrlenA (lpString="*.zip") returned 5 [0068.796] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG", pszSpec="*.rar") returned 0 [0068.796] lstrlenA (lpString="*.rar") returned 5 [0068.796] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG", pszSpec="*.7z") returned 0 [0068.796] lstrlenA (lpString="*.7z") returned 4 [0068.796] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG", pszSpec="*.tar") returned 0 [0068.796] lstrlenA (lpString="*.tar") returned 5 [0068.796] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG", pszSpec="*.gzip") returned 0 [0068.796] lstrlenA (lpString="*.gzip") returned 6 [0068.796] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG", pszSpec="*.jpg") returned 1 [0068.796] lstrlenA (lpString="*.jpg") returned 5 [0068.796] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" [0068.796] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" [0068.796] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG." [0068.796] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.BD" [0068.796] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.797] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38d8 [0068.797] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae092e89, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.797] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.797] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x387c, lpOverlapped=0x0) returned 1 [0068.799] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned="J0175428.JPG" [0068.800] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.800] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x387c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x387c, lpOverlapped=0x0) returned 1 [0068.800] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.800] CloseHandle (hObject=0x1cc) returned 1 [0068.801] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0175428.jpg.bd")) returned 1 [0068.802] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc35e3754, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb12e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0177257.JPG", cAlternateFileName="")) returned 1 [0068.802] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.802] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0177257.JPG") returned -1 [0068.802] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0177257.JPG") returned -1 [0068.802] lstrcmpiA (lpString1="", lpString2="J0177257.JPG") returned -1 [0068.802] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned="J0175428.JPG" [0068.802] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.802] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.802] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.802] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.802] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0177257.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" [0068.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG", pszSpec="*.zip") returned 0 [0068.802] lstrlenA (lpString="*.zip") returned 5 [0068.803] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG", pszSpec="*.rar") returned 0 [0068.803] lstrlenA (lpString="*.rar") returned 5 [0068.803] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG", pszSpec="*.7z") returned 0 [0068.803] lstrlenA (lpString="*.7z") returned 4 [0068.803] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG", pszSpec="*.tar") returned 0 [0068.803] lstrlenA (lpString="*.tar") returned 5 [0068.803] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG", pszSpec="*.gzip") returned 0 [0068.803] lstrlenA (lpString="*.gzip") returned 6 [0068.803] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG", pszSpec="*.jpg") returned 1 [0068.803] lstrlenA (lpString="*.jpg") returned 5 [0068.803] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" [0068.803] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" [0068.803] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG." [0068.803] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.BD" [0068.803] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.804] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb12e [0068.804] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc35e3754, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.804] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.804] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xb0d2, lpOverlapped=0x0) returned 1 [0068.807] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned="J0177257.JPG" [0068.808] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.808] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xb0d2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xb0d2, lpOverlapped=0x0) returned 1 [0068.808] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.809] CloseHandle (hObject=0x1cc) returned 1 [0068.810] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0177257.jpg.bd")) returned 1 [0068.811] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc35eabbc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd902, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0177806.JPG", cAlternateFileName="")) returned 1 [0068.811] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.811] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0177806.JPG") returned -1 [0068.811] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0177806.JPG") returned -1 [0068.811] lstrcmpiA (lpString1="", lpString2="J0177806.JPG") returned -1 [0068.811] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned="J0177257.JPG" [0068.811] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.811] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.811] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.811] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.811] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0177806.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" [0068.811] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG", pszSpec="*.zip") returned 0 [0068.811] lstrlenA (lpString="*.zip") returned 5 [0068.811] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG", pszSpec="*.rar") returned 0 [0068.811] lstrlenA (lpString="*.rar") returned 5 [0068.811] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG", pszSpec="*.7z") returned 0 [0068.812] lstrlenA (lpString="*.7z") returned 4 [0068.812] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG", pszSpec="*.tar") returned 0 [0068.812] lstrlenA (lpString="*.tar") returned 5 [0068.812] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG", pszSpec="*.gzip") returned 0 [0068.812] lstrlenA (lpString="*.gzip") returned 6 [0068.812] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG", pszSpec="*.jpg") returned 1 [0068.812] lstrlenA (lpString="*.jpg") returned 5 [0068.812] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" [0068.812] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" [0068.812] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG." [0068.812] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.BD" [0068.812] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.812] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd902 [0068.812] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc35eabbc, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.812] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.812] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xd8a6, lpOverlapped=0x0) returned 1 [0068.814] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned="J0177806.JPG" [0068.816] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.816] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xd8a6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xd8a6, lpOverlapped=0x0) returned 1 [0068.816] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.816] CloseHandle (hObject=0x1cc) returned 1 [0068.818] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0177806.jpg.bd")) returned 1 [0068.819] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae099028, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x907d, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178348.JPG", cAlternateFileName="")) returned 1 [0068.819] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.819] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0178348.JPG") returned -1 [0068.819] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0178348.JPG") returned -1 [0068.819] lstrcmpiA (lpString1="", lpString2="J0178348.JPG") returned -1 [0068.819] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned="J0177806.JPG" [0068.819] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.819] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.819] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.819] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.819] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0178348.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" [0068.819] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG", pszSpec="*.zip") returned 0 [0068.819] lstrlenA (lpString="*.zip") returned 5 [0068.819] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG", pszSpec="*.rar") returned 0 [0068.819] lstrlenA (lpString="*.rar") returned 5 [0068.819] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG", pszSpec="*.7z") returned 0 [0068.819] lstrlenA (lpString="*.7z") returned 4 [0068.820] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG", pszSpec="*.tar") returned 0 [0068.820] lstrlenA (lpString="*.tar") returned 5 [0068.820] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG", pszSpec="*.gzip") returned 0 [0068.820] lstrlenA (lpString="*.gzip") returned 6 [0068.820] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG", pszSpec="*.jpg") returned 1 [0068.820] lstrlenA (lpString="*.jpg") returned 5 [0068.820] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" [0068.820] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" [0068.820] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG." [0068.820] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.BD" [0068.820] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.820] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x907d [0068.820] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae099028, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.820] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.820] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x9021, lpOverlapped=0x0) returned 1 [0068.837] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned="J0178348.JPG" [0068.838] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.838] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x9021, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x9021, lpOverlapped=0x0) returned 1 [0068.838] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.839] CloseHandle (hObject=0x1cc) returned 1 [0068.841] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178348.jpg.bd")) returned 1 [0068.842] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc35f2102, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7214, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178459.JPG", cAlternateFileName="")) returned 1 [0068.842] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.842] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0178459.JPG") returned -1 [0068.842] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0178459.JPG") returned -1 [0068.842] lstrcmpiA (lpString1="", lpString2="J0178459.JPG") returned -1 [0068.842] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned="J0178348.JPG" [0068.842] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.842] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.842] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.842] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.842] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0178459.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" [0068.842] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG", pszSpec="*.zip") returned 0 [0068.842] lstrlenA (lpString="*.zip") returned 5 [0068.842] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG", pszSpec="*.rar") returned 0 [0068.842] lstrlenA (lpString="*.rar") returned 5 [0068.842] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG", pszSpec="*.7z") returned 0 [0068.842] lstrlenA (lpString="*.7z") returned 4 [0068.842] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG", pszSpec="*.tar") returned 0 [0068.842] lstrlenA (lpString="*.tar") returned 5 [0068.842] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG", pszSpec="*.gzip") returned 0 [0068.842] lstrlenA (lpString="*.gzip") returned 6 [0068.842] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG", pszSpec="*.jpg") returned 1 [0068.842] lstrlenA (lpString="*.jpg") returned 5 [0068.842] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" [0068.843] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" [0068.843] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG." [0068.843] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.BD" [0068.843] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.843] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7214 [0068.843] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc35f2102, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.843] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.843] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x71b8, lpOverlapped=0x0) returned 1 [0068.845] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned="J0178459.JPG" [0068.845] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.845] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x71b8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x71b8, lpOverlapped=0x0) returned 1 [0068.846] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.846] CloseHandle (hObject=0x1cc) returned 1 [0068.847] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178459.jpg.bd")) returned 1 [0068.848] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae09f26a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x67a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178460.JPG", cAlternateFileName="")) returned 1 [0068.848] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.848] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0178460.JPG") returned -1 [0068.848] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0178460.JPG") returned -1 [0068.848] lstrcmpiA (lpString1="", lpString2="J0178460.JPG") returned -1 [0068.848] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned="J0178459.JPG" [0068.848] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.848] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.848] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.848] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.848] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0178460.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" [0068.848] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG", pszSpec="*.zip") returned 0 [0068.848] lstrlenA (lpString="*.zip") returned 5 [0068.848] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG", pszSpec="*.rar") returned 0 [0068.849] lstrlenA (lpString="*.rar") returned 5 [0068.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG", pszSpec="*.7z") returned 0 [0068.849] lstrlenA (lpString="*.7z") returned 4 [0068.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG", pszSpec="*.tar") returned 0 [0068.849] lstrlenA (lpString="*.tar") returned 5 [0068.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG", pszSpec="*.gzip") returned 0 [0068.849] lstrlenA (lpString="*.gzip") returned 6 [0068.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG", pszSpec="*.jpg") returned 1 [0068.849] lstrlenA (lpString="*.jpg") returned 5 [0068.849] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" [0068.849] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" [0068.849] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG." [0068.849] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.BD" [0068.849] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.849] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x67a3 [0068.849] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae09f26a, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.849] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.849] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x6747, lpOverlapped=0x0) returned 1 [0068.875] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned="J0178460.JPG" [0068.875] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.875] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x6747, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x6747, lpOverlapped=0x0) returned 1 [0068.876] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.876] CloseHandle (hObject=0x1cc) returned 1 [0068.878] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178460.jpg.bd")) returned 1 [0068.879] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc35f5c19, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5de2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178523.JPG", cAlternateFileName="")) returned 1 [0068.879] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.879] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0178523.JPG") returned -1 [0068.879] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0178523.JPG") returned -1 [0068.879] lstrcmpiA (lpString1="", lpString2="J0178523.JPG") returned -1 [0068.879] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned="J0178460.JPG" [0068.879] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.879] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.879] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.879] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.879] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0178523.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" [0068.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG", pszSpec="*.zip") returned 0 [0068.879] lstrlenA (lpString="*.zip") returned 5 [0068.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG", pszSpec="*.rar") returned 0 [0068.879] lstrlenA (lpString="*.rar") returned 5 [0068.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG", pszSpec="*.7z") returned 0 [0068.879] lstrlenA (lpString="*.7z") returned 4 [0068.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG", pszSpec="*.tar") returned 0 [0068.879] lstrlenA (lpString="*.tar") returned 5 [0068.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG", pszSpec="*.gzip") returned 0 [0068.879] lstrlenA (lpString="*.gzip") returned 6 [0068.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG", pszSpec="*.jpg") returned 1 [0068.879] lstrlenA (lpString="*.jpg") returned 5 [0068.879] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" [0068.879] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" [0068.879] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG." [0068.880] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.BD" [0068.880] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.880] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5de2 [0068.880] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc35f5c19, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.880] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.880] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x5d86, lpOverlapped=0x0) returned 1 [0068.882] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned="J0178523.JPG" [0068.882] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.882] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x5d86, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x5d86, lpOverlapped=0x0) returned 1 [0068.883] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.883] CloseHandle (hObject=0x1cc) returned 1 [0068.885] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178523.jpg.bd")) returned 1 [0068.885] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0a6728, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5b2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178632.JPG", cAlternateFileName="")) returned 1 [0068.885] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.885] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0178632.JPG") returned -1 [0068.885] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0178632.JPG") returned -1 [0068.885] lstrcmpiA (lpString1="", lpString2="J0178632.JPG") returned -1 [0068.885] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned="J0178523.JPG" [0068.885] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.885] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.885] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.885] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.886] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0178632.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" [0068.886] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG", pszSpec="*.zip") returned 0 [0068.886] lstrlenA (lpString="*.zip") returned 5 [0068.886] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG", pszSpec="*.rar") returned 0 [0068.886] lstrlenA (lpString="*.rar") returned 5 [0068.886] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG", pszSpec="*.7z") returned 0 [0068.886] lstrlenA (lpString="*.7z") returned 4 [0068.886] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG", pszSpec="*.tar") returned 0 [0068.886] lstrlenA (lpString="*.tar") returned 5 [0068.886] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG", pszSpec="*.gzip") returned 0 [0068.886] lstrlenA (lpString="*.gzip") returned 6 [0068.886] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG", pszSpec="*.jpg") returned 1 [0068.886] lstrlenA (lpString="*.jpg") returned 5 [0068.886] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" [0068.886] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" [0068.886] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG." [0068.886] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.BD" [0068.886] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.887] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5b2a [0068.887] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae0a6728, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.887] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.887] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x5ace, lpOverlapped=0x0) returned 1 [0068.889] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned="J0178632.JPG" [0068.889] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.889] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x5ace, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x5ace, lpOverlapped=0x0) returned 1 [0068.890] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.890] CloseHandle (hObject=0x1cc) returned 1 [0068.891] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178632.jpg.bd")) returned 1 [0068.892] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3611f16, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7d26, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178639.JPG", cAlternateFileName="")) returned 1 [0068.892] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.892] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0178639.JPG") returned -1 [0068.892] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0178639.JPG") returned -1 [0068.892] lstrcmpiA (lpString1="", lpString2="J0178639.JPG") returned -1 [0068.892] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned="J0178632.JPG" [0068.892] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.892] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.892] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.892] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.892] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0178639.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" [0068.892] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG", pszSpec="*.zip") returned 0 [0068.892] lstrlenA (lpString="*.zip") returned 5 [0068.892] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG", pszSpec="*.rar") returned 0 [0068.892] lstrlenA (lpString="*.rar") returned 5 [0068.892] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG", pszSpec="*.7z") returned 0 [0068.892] lstrlenA (lpString="*.7z") returned 4 [0068.892] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG", pszSpec="*.tar") returned 0 [0068.892] lstrlenA (lpString="*.tar") returned 5 [0068.892] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG", pszSpec="*.gzip") returned 0 [0068.892] lstrlenA (lpString="*.gzip") returned 6 [0068.892] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG", pszSpec="*.jpg") returned 1 [0068.892] lstrlenA (lpString="*.jpg") returned 5 [0068.892] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" [0068.892] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" [0068.892] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG." [0068.892] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.BD" [0068.893] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.893] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7d26 [0068.893] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc3611f16, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.893] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.893] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7cca, lpOverlapped=0x0) returned 1 [0068.895] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned="J0178639.JPG" [0068.896] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.896] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7cca, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7cca, lpOverlapped=0x0) returned 1 [0068.896] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.896] CloseHandle (hObject=0x1cc) returned 1 [0068.897] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178639.jpg.bd")) returned 1 [0068.898] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0ac8c1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8a0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178932.JPG", cAlternateFileName="")) returned 1 [0068.898] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.898] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0178932.JPG") returned -1 [0068.898] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0178932.JPG") returned -1 [0068.898] lstrcmpiA (lpString1="", lpString2="J0178932.JPG") returned -1 [0068.898] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned="J0178639.JPG" [0068.898] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.898] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.898] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.898] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.898] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0178932.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" [0068.898] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG", pszSpec="*.zip") returned 0 [0068.898] lstrlenA (lpString="*.zip") returned 5 [0068.898] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG", pszSpec="*.rar") returned 0 [0068.898] lstrlenA (lpString="*.rar") returned 5 [0068.898] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG", pszSpec="*.7z") returned 0 [0068.898] lstrlenA (lpString="*.7z") returned 4 [0068.899] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG", pszSpec="*.tar") returned 0 [0068.899] lstrlenA (lpString="*.tar") returned 5 [0068.899] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG", pszSpec="*.gzip") returned 0 [0068.899] lstrlenA (lpString="*.gzip") returned 6 [0068.899] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG", pszSpec="*.jpg") returned 1 [0068.899] lstrlenA (lpString="*.jpg") returned 5 [0068.899] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" [0068.899] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" [0068.899] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG." [0068.899] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.BD" [0068.899] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.899] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8a0c [0068.899] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae0ac8c1, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.899] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.900] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x89b0, lpOverlapped=0x0) returned 1 [0068.985] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned="J0178932.JPG" [0068.986] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.986] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x89b0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x89b0, lpOverlapped=0x0) returned 1 [0068.986] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.986] CloseHandle (hObject=0x1cc) returned 1 [0068.988] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178932.jpg.bd")) returned 1 [0068.990] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0b16e8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7d6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0179963.JPG", cAlternateFileName="")) returned 1 [0068.990] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0068.990] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0179963.JPG") returned -1 [0068.990] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0179963.JPG") returned -1 [0068.990] lstrcmpiA (lpString1="", lpString2="J0179963.JPG") returned -1 [0068.990] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned="J0178932.JPG" [0068.990] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0068.990] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0068.990] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0068.991] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0068.991] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0179963.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" [0068.991] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG", pszSpec="*.zip") returned 0 [0068.991] lstrlenA (lpString="*.zip") returned 5 [0068.991] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG", pszSpec="*.rar") returned 0 [0068.991] lstrlenA (lpString="*.rar") returned 5 [0068.991] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG", pszSpec="*.7z") returned 0 [0068.991] lstrlenA (lpString="*.7z") returned 4 [0068.991] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG", pszSpec="*.tar") returned 0 [0068.991] lstrlenA (lpString="*.tar") returned 5 [0068.991] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG", pszSpec="*.gzip") returned 0 [0068.991] lstrlenA (lpString="*.gzip") returned 6 [0068.991] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG", pszSpec="*.jpg") returned 1 [0068.991] lstrlenA (lpString="*.jpg") returned 5 [0068.991] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" [0068.992] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" [0068.992] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG." [0068.992] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.BD" [0068.992] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.992] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7d6e [0068.992] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae0b16e8, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0068.992] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.993] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7d12, lpOverlapped=0x0) returned 1 [0068.997] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned="J0179963.JPG" [0068.998] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0068.998] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7d12, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7d12, lpOverlapped=0x0) returned 1 [0068.998] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.998] CloseHandle (hObject=0x1cc) returned 1 [0069.000] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0179963.jpg.bd")) returned 1 [0069.001] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0b78f5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x40e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0182689.JPG", cAlternateFileName="")) returned 1 [0069.001] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.001] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0182689.JPG") returned -1 [0069.001] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0182689.JPG") returned -1 [0069.001] lstrcmpiA (lpString1="", lpString2="J0182689.JPG") returned -1 [0069.001] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned="J0179963.JPG" [0069.001] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.001] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.001] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.001] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.001] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0182689.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" [0069.001] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG", pszSpec="*.zip") returned 0 [0069.001] lstrlenA (lpString="*.zip") returned 5 [0069.001] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG", pszSpec="*.rar") returned 0 [0069.001] lstrlenA (lpString="*.rar") returned 5 [0069.001] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG", pszSpec="*.7z") returned 0 [0069.001] lstrlenA (lpString="*.7z") returned 4 [0069.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG", pszSpec="*.tar") returned 0 [0069.002] lstrlenA (lpString="*.tar") returned 5 [0069.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG", pszSpec="*.gzip") returned 0 [0069.002] lstrlenA (lpString="*.gzip") returned 6 [0069.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG", pszSpec="*.jpg") returned 1 [0069.002] lstrlenA (lpString="*.jpg") returned 5 [0069.002] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" [0069.002] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" [0069.002] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG." [0069.002] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.BD" [0069.002] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.002] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40e7 [0069.002] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae0b78f5, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.002] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.002] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x408b, lpOverlapped=0x0) returned 1 [0069.004] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned="J0182689.JPG" [0069.005] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.005] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x408b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x408b, lpOverlapped=0x0) returned 1 [0069.005] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.005] CloseHandle (hObject=0x1cc) returned 1 [0069.007] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0182689.jpg.bd")) returned 1 [0069.008] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0bda37, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5f48, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0182888.WMF", cAlternateFileName="")) returned 1 [0069.008] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.008] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0182888.WMF") returned -1 [0069.008] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0182888.WMF") returned -1 [0069.008] lstrcmpiA (lpString1="", lpString2="J0182888.WMF") returned -1 [0069.009] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned="J0182689.JPG" [0069.009] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.009] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.009] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.009] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.010] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0182888.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" [0069.010] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.zip") returned 0 [0069.010] lstrlenA (lpString="*.zip") returned 5 [0069.010] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.rar") returned 0 [0069.010] lstrlenA (lpString="*.rar") returned 5 [0069.010] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.7z") returned 0 [0069.010] lstrlenA (lpString="*.7z") returned 4 [0069.010] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.tar") returned 0 [0069.010] lstrlenA (lpString="*.tar") returned 5 [0069.010] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.gzip") returned 0 [0069.010] lstrlenA (lpString="*.gzip") returned 6 [0069.010] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.jpg") returned 0 [0069.010] lstrlenA (lpString="*.jpg") returned 5 [0069.011] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.jpeg") returned 0 [0069.011] lstrlenA (lpString="*.jpeg") returned 6 [0069.011] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.psd") returned 0 [0069.011] lstrlenA (lpString="*.psd") returned 5 [0069.011] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.cdr") returned 0 [0069.011] lstrlenA (lpString="*.cdr") returned 5 [0069.011] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.dwg") returned 0 [0069.011] lstrlenA (lpString="*.dwg") returned 5 [0069.011] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.max") returned 0 [0069.011] lstrlenA (lpString="*.max") returned 5 [0069.011] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.bmp") returned 0 [0069.011] lstrlenA (lpString="*.bmp") returned 5 [0069.011] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.gif") returned 0 [0069.011] lstrlenA (lpString="*.gif") returned 5 [0069.012] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.png") returned 0 [0069.012] lstrlenA (lpString="*.png") returned 5 [0069.012] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.doc") returned 0 [0069.012] lstrlenA (lpString="*.doc") returned 5 [0069.012] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.docx") returned 0 [0069.012] lstrlenA (lpString="*.docx") returned 6 [0069.012] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.xls") returned 0 [0069.012] lstrlenA (lpString="*.xls") returned 5 [0069.012] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.xlsx") returned 0 [0069.012] lstrlenA (lpString="*.xlsx") returned 6 [0069.012] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.ppt") returned 0 [0069.012] lstrlenA (lpString="*.ppt") returned 5 [0069.012] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.pptx") returned 0 [0069.012] lstrlenA (lpString="*.pptx") returned 6 [0069.013] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.txt") returned 0 [0069.013] lstrlenA (lpString="*.txt") returned 5 [0069.013] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.pdf") returned 0 [0069.013] lstrlenA (lpString="*.pdf") returned 5 [0069.013] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.djvu") returned 0 [0069.013] lstrlenA (lpString="*.djvu") returned 6 [0069.013] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.htm") returned 0 [0069.013] lstrlenA (lpString="*.htm") returned 5 [0069.013] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.html") returned 0 [0069.013] lstrlenA (lpString="*.html") returned 6 [0069.013] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.mdb") returned 0 [0069.013] lstrlenA (lpString="*.mdb") returned 5 [0069.013] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.cer") returned 0 [0069.013] lstrlenA (lpString="*.cer") returned 5 [0069.014] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.p12") returned 0 [0069.014] lstrlenA (lpString="*.p12") returned 5 [0069.014] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.pfx") returned 0 [0069.014] lstrlenA (lpString="*.pfx") returned 5 [0069.014] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.kwm") returned 0 [0069.014] lstrlenA (lpString="*.kwm") returned 5 [0069.014] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.pwm") returned 0 [0069.014] lstrlenA (lpString="*.pwm") returned 5 [0069.014] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.1cd") returned 0 [0069.014] lstrlenA (lpString="*.1cd") returned 5 [0069.014] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.md") returned 0 [0069.014] lstrlenA (lpString="*.md") returned 4 [0069.014] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.mdf") returned 0 [0069.014] lstrlenA (lpString="*.mdf") returned 5 [0069.015] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.dbf") returned 0 [0069.015] lstrlenA (lpString="*.dbf") returned 5 [0069.015] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.odt") returned 0 [0069.015] lstrlenA (lpString="*.odt") returned 5 [0069.015] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.vob") returned 0 [0069.015] lstrlenA (lpString="*.vob") returned 5 [0069.015] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.ifo") returned 0 [0069.015] lstrlenA (lpString="*.ifo") returned 5 [0069.015] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.lnk") returned 0 [0069.015] lstrlenA (lpString="*.lnk") returned 5 [0069.015] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.torrent") returned 0 [0069.015] lstrlenA (lpString="*.torrent") returned 9 [0069.015] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.mov") returned 0 [0069.015] lstrlenA (lpString="*.mov") returned 5 [0069.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.m2v") returned 0 [0069.016] lstrlenA (lpString="*.m2v") returned 5 [0069.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.3gp") returned 0 [0069.016] lstrlenA (lpString="*.3gp") returned 5 [0069.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.mpeg") returned 0 [0069.016] lstrlenA (lpString="*.mpeg") returned 6 [0069.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.mpg") returned 0 [0069.016] lstrlenA (lpString="*.mpg") returned 5 [0069.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.flv") returned 0 [0069.016] lstrlenA (lpString="*.flv") returned 5 [0069.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.avi") returned 0 [0069.016] lstrlenA (lpString="*.avi") returned 5 [0069.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.mp4") returned 0 [0069.016] lstrlenA (lpString="*.mp4") returned 5 [0069.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.wmv") returned 0 [0069.016] lstrlenA (lpString="*.wmv") returned 5 [0069.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.divx") returned 0 [0069.016] lstrlenA (lpString="*.divx") returned 6 [0069.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.mkv") returned 0 [0069.016] lstrlenA (lpString="*.mkv") returned 5 [0069.017] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.mp3") returned 0 [0069.017] lstrlenA (lpString="*.mp3") returned 5 [0069.017] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.wav") returned 0 [0069.017] lstrlenA (lpString="*.wav") returned 5 [0069.017] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.flac") returned 0 [0069.017] lstrlenA (lpString="*.flac") returned 6 [0069.017] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.ape") returned 0 [0069.017] lstrlenA (lpString="*.ape") returned 5 [0069.017] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.wma") returned 0 [0069.017] lstrlenA (lpString="*.wma") returned 5 [0069.017] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.ac3") returned 0 [0069.017] lstrlenA (lpString="*.ac3") returned 5 [0069.017] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0c3c1d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0182898.WMF", cAlternateFileName="")) returned 1 [0069.017] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.017] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0182898.WMF") returned -1 [0069.017] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0182898.WMF") returned -1 [0069.017] lstrcmpiA (lpString1="", lpString2="J0182898.WMF") returned -1 [0069.017] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned="J0182888.WMF" [0069.017] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.017] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.017] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.017] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.017] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0182898.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" [0069.017] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.zip") returned 0 [0069.017] lstrlenA (lpString="*.zip") returned 5 [0069.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.rar") returned 0 [0069.018] lstrlenA (lpString="*.rar") returned 5 [0069.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.7z") returned 0 [0069.018] lstrlenA (lpString="*.7z") returned 4 [0069.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.tar") returned 0 [0069.018] lstrlenA (lpString="*.tar") returned 5 [0069.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.gzip") returned 0 [0069.018] lstrlenA (lpString="*.gzip") returned 6 [0069.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.jpg") returned 0 [0069.018] lstrlenA (lpString="*.jpg") returned 5 [0069.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.jpeg") returned 0 [0069.018] lstrlenA (lpString="*.jpeg") returned 6 [0069.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.psd") returned 0 [0069.018] lstrlenA (lpString="*.psd") returned 5 [0069.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.cdr") returned 0 [0069.018] lstrlenA (lpString="*.cdr") returned 5 [0069.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.dwg") returned 0 [0069.018] lstrlenA (lpString="*.dwg") returned 5 [0069.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.max") returned 0 [0069.018] lstrlenA (lpString="*.max") returned 5 [0069.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.bmp") returned 0 [0069.018] lstrlenA (lpString="*.bmp") returned 5 [0069.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.gif") returned 0 [0069.018] lstrlenA (lpString="*.gif") returned 5 [0069.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.png") returned 0 [0069.018] lstrlenA (lpString="*.png") returned 5 [0069.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.doc") returned 0 [0069.018] lstrlenA (lpString="*.doc") returned 5 [0069.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.docx") returned 0 [0069.018] lstrlenA (lpString="*.docx") returned 6 [0069.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.xls") returned 0 [0069.018] lstrlenA (lpString="*.xls") returned 5 [0069.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.xlsx") returned 0 [0069.019] lstrlenA (lpString="*.xlsx") returned 6 [0069.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.ppt") returned 0 [0069.019] lstrlenA (lpString="*.ppt") returned 5 [0069.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.pptx") returned 0 [0069.019] lstrlenA (lpString="*.pptx") returned 6 [0069.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.txt") returned 0 [0069.019] lstrlenA (lpString="*.txt") returned 5 [0069.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.pdf") returned 0 [0069.019] lstrlenA (lpString="*.pdf") returned 5 [0069.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.djvu") returned 0 [0069.019] lstrlenA (lpString="*.djvu") returned 6 [0069.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.htm") returned 0 [0069.019] lstrlenA (lpString="*.htm") returned 5 [0069.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.html") returned 0 [0069.019] lstrlenA (lpString="*.html") returned 6 [0069.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.mdb") returned 0 [0069.019] lstrlenA (lpString="*.mdb") returned 5 [0069.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.cer") returned 0 [0069.019] lstrlenA (lpString="*.cer") returned 5 [0069.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.p12") returned 0 [0069.019] lstrlenA (lpString="*.p12") returned 5 [0069.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.pfx") returned 0 [0069.019] lstrlenA (lpString="*.pfx") returned 5 [0069.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.kwm") returned 0 [0069.019] lstrlenA (lpString="*.kwm") returned 5 [0069.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.pwm") returned 0 [0069.019] lstrlenA (lpString="*.pwm") returned 5 [0069.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.1cd") returned 0 [0069.019] lstrlenA (lpString="*.1cd") returned 5 [0069.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.md") returned 0 [0069.019] lstrlenA (lpString="*.md") returned 4 [0069.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.mdf") returned 0 [0069.019] lstrlenA (lpString="*.mdf") returned 5 [0069.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.dbf") returned 0 [0069.019] lstrlenA (lpString="*.dbf") returned 5 [0069.020] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.odt") returned 0 [0069.020] lstrlenA (lpString="*.odt") returned 5 [0069.020] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.vob") returned 0 [0069.020] lstrlenA (lpString="*.vob") returned 5 [0069.020] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.ifo") returned 0 [0069.020] lstrlenA (lpString="*.ifo") returned 5 [0069.020] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.lnk") returned 0 [0069.020] lstrlenA (lpString="*.lnk") returned 5 [0069.020] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.torrent") returned 0 [0069.020] lstrlenA (lpString="*.torrent") returned 9 [0069.020] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.mov") returned 0 [0069.020] lstrlenA (lpString="*.mov") returned 5 [0069.020] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.m2v") returned 0 [0069.020] lstrlenA (lpString="*.m2v") returned 5 [0069.020] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.3gp") returned 0 [0069.020] lstrlenA (lpString="*.3gp") returned 5 [0069.020] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.mpeg") returned 0 [0069.020] lstrlenA (lpString="*.mpeg") returned 6 [0069.020] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.mpg") returned 0 [0069.020] lstrlenA (lpString="*.mpg") returned 5 [0069.020] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.flv") returned 0 [0069.020] lstrlenA (lpString="*.flv") returned 5 [0069.020] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.avi") returned 0 [0069.020] lstrlenA (lpString="*.avi") returned 5 [0069.020] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.mp4") returned 0 [0069.020] lstrlenA (lpString="*.mp4") returned 5 [0069.020] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.wmv") returned 0 [0069.020] lstrlenA (lpString="*.wmv") returned 5 [0069.020] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.divx") returned 0 [0069.020] lstrlenA (lpString="*.divx") returned 6 [0069.020] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.mkv") returned 0 [0069.020] lstrlenA (lpString="*.mkv") returned 5 [0069.020] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.mp3") returned 0 [0069.020] lstrlenA (lpString="*.mp3") returned 5 [0069.021] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.wav") returned 0 [0069.021] lstrlenA (lpString="*.wav") returned 5 [0069.021] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.flac") returned 0 [0069.021] lstrlenA (lpString="*.flac") returned 6 [0069.021] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.ape") returned 0 [0069.021] lstrlenA (lpString="*.ape") returned 5 [0069.021] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.wma") returned 0 [0069.021] lstrlenA (lpString="*.wma") returned 5 [0069.021] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.ac3") returned 0 [0069.021] lstrlenA (lpString="*.ac3") returned 5 [0069.021] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc361b920, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1e8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0182902.WMF", cAlternateFileName="")) returned 1 [0069.021] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.021] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0182902.WMF") returned -1 [0069.021] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0182902.WMF") returned -1 [0069.021] lstrcmpiA (lpString1="", lpString2="J0182902.WMF") returned -1 [0069.021] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned="J0182898.WMF" [0069.021] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.021] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.021] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.021] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.021] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0182902.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" [0069.021] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.zip") returned 0 [0069.021] lstrlenA (lpString="*.zip") returned 5 [0069.021] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.rar") returned 0 [0069.021] lstrlenA (lpString="*.rar") returned 5 [0069.021] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.7z") returned 0 [0069.021] lstrlenA (lpString="*.7z") returned 4 [0069.021] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.tar") returned 0 [0069.021] lstrlenA (lpString="*.tar") returned 5 [0069.021] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.gzip") returned 0 [0069.022] lstrlenA (lpString="*.gzip") returned 6 [0069.022] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.jpg") returned 0 [0069.022] lstrlenA (lpString="*.jpg") returned 5 [0069.022] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.jpeg") returned 0 [0069.022] lstrlenA (lpString="*.jpeg") returned 6 [0069.022] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.psd") returned 0 [0069.022] lstrlenA (lpString="*.psd") returned 5 [0069.022] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.cdr") returned 0 [0069.022] lstrlenA (lpString="*.cdr") returned 5 [0069.022] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.dwg") returned 0 [0069.022] lstrlenA (lpString="*.dwg") returned 5 [0069.022] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.max") returned 0 [0069.022] lstrlenA (lpString="*.max") returned 5 [0069.022] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.bmp") returned 0 [0069.022] lstrlenA (lpString="*.bmp") returned 5 [0069.022] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.gif") returned 0 [0069.022] lstrlenA (lpString="*.gif") returned 5 [0069.022] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.png") returned 0 [0069.022] lstrlenA (lpString="*.png") returned 5 [0069.022] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.doc") returned 0 [0069.022] lstrlenA (lpString="*.doc") returned 5 [0069.022] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.docx") returned 0 [0069.022] lstrlenA (lpString="*.docx") returned 6 [0069.022] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.xls") returned 0 [0069.022] lstrlenA (lpString="*.xls") returned 5 [0069.022] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.xlsx") returned 0 [0069.022] lstrlenA (lpString="*.xlsx") returned 6 [0069.022] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.ppt") returned 0 [0069.022] lstrlenA (lpString="*.ppt") returned 5 [0069.022] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.pptx") returned 0 [0069.022] lstrlenA (lpString="*.pptx") returned 6 [0069.022] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.txt") returned 0 [0069.022] lstrlenA (lpString="*.txt") returned 5 [0069.022] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.pdf") returned 0 [0069.022] lstrlenA (lpString="*.pdf") returned 5 [0069.023] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.djvu") returned 0 [0069.023] lstrlenA (lpString="*.djvu") returned 6 [0069.023] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.htm") returned 0 [0069.023] lstrlenA (lpString="*.htm") returned 5 [0069.023] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.html") returned 0 [0069.023] lstrlenA (lpString="*.html") returned 6 [0069.023] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.mdb") returned 0 [0069.023] lstrlenA (lpString="*.mdb") returned 5 [0069.023] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.cer") returned 0 [0069.023] lstrlenA (lpString="*.cer") returned 5 [0069.023] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.p12") returned 0 [0069.023] lstrlenA (lpString="*.p12") returned 5 [0069.023] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.pfx") returned 0 [0069.023] lstrlenA (lpString="*.pfx") returned 5 [0069.023] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.kwm") returned 0 [0069.023] lstrlenA (lpString="*.kwm") returned 5 [0069.023] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.pwm") returned 0 [0069.023] lstrlenA (lpString="*.pwm") returned 5 [0069.023] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.1cd") returned 0 [0069.023] lstrlenA (lpString="*.1cd") returned 5 [0069.023] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.md") returned 0 [0069.023] lstrlenA (lpString="*.md") returned 4 [0069.023] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.mdf") returned 0 [0069.023] lstrlenA (lpString="*.mdf") returned 5 [0069.023] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.dbf") returned 0 [0069.023] lstrlenA (lpString="*.dbf") returned 5 [0069.023] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.odt") returned 0 [0069.023] lstrlenA (lpString="*.odt") returned 5 [0069.023] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.vob") returned 0 [0069.023] lstrlenA (lpString="*.vob") returned 5 [0069.023] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.ifo") returned 0 [0069.024] lstrlenA (lpString="*.ifo") returned 5 [0069.024] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.lnk") returned 0 [0069.024] lstrlenA (lpString="*.lnk") returned 5 [0069.024] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.torrent") returned 0 [0069.024] lstrlenA (lpString="*.torrent") returned 9 [0069.024] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.mov") returned 0 [0069.024] lstrlenA (lpString="*.mov") returned 5 [0069.024] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.m2v") returned 0 [0069.024] lstrlenA (lpString="*.m2v") returned 5 [0069.024] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.3gp") returned 0 [0069.024] lstrlenA (lpString="*.3gp") returned 5 [0069.024] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.mpeg") returned 0 [0069.024] lstrlenA (lpString="*.mpeg") returned 6 [0069.024] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.mpg") returned 0 [0069.024] lstrlenA (lpString="*.mpg") returned 5 [0069.024] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.flv") returned 0 [0069.024] lstrlenA (lpString="*.flv") returned 5 [0069.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.avi") returned 0 [0069.027] lstrlenA (lpString="*.avi") returned 5 [0069.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.mp4") returned 0 [0069.027] lstrlenA (lpString="*.mp4") returned 5 [0069.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.wmv") returned 0 [0069.027] lstrlenA (lpString="*.wmv") returned 5 [0069.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.divx") returned 0 [0069.027] lstrlenA (lpString="*.divx") returned 6 [0069.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.mkv") returned 0 [0069.027] lstrlenA (lpString="*.mkv") returned 5 [0069.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.mp3") returned 0 [0069.027] lstrlenA (lpString="*.mp3") returned 5 [0069.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.wav") returned 0 [0069.027] lstrlenA (lpString="*.wav") returned 5 [0069.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.flac") returned 0 [0069.027] lstrlenA (lpString="*.flac") returned 6 [0069.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.ape") returned 0 [0069.027] lstrlenA (lpString="*.ape") returned 5 [0069.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.wma") returned 0 [0069.027] lstrlenA (lpString="*.wma") returned 5 [0069.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.ac3") returned 0 [0069.027] lstrlenA (lpString="*.ac3") returned 5 [0069.027] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3620713, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3ed2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0182946.WMF", cAlternateFileName="")) returned 1 [0069.027] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.028] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0182946.WMF") returned -1 [0069.028] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0182946.WMF") returned -1 [0069.028] lstrcmpiA (lpString1="", lpString2="J0182946.WMF") returned -1 [0069.028] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned="J0182902.WMF" [0069.028] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.028] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.028] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.028] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.028] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0182946.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" [0069.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.zip") returned 0 [0069.028] lstrlenA (lpString="*.zip") returned 5 [0069.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.rar") returned 0 [0069.028] lstrlenA (lpString="*.rar") returned 5 [0069.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.7z") returned 0 [0069.028] lstrlenA (lpString="*.7z") returned 4 [0069.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.tar") returned 0 [0069.028] lstrlenA (lpString="*.tar") returned 5 [0069.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.gzip") returned 0 [0069.028] lstrlenA (lpString="*.gzip") returned 6 [0069.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.jpg") returned 0 [0069.028] lstrlenA (lpString="*.jpg") returned 5 [0069.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.jpeg") returned 0 [0069.028] lstrlenA (lpString="*.jpeg") returned 6 [0069.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.psd") returned 0 [0069.028] lstrlenA (lpString="*.psd") returned 5 [0069.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.cdr") returned 0 [0069.028] lstrlenA (lpString="*.cdr") returned 5 [0069.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.dwg") returned 0 [0069.029] lstrlenA (lpString="*.dwg") returned 5 [0069.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.max") returned 0 [0069.029] lstrlenA (lpString="*.max") returned 5 [0069.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.bmp") returned 0 [0069.029] lstrlenA (lpString="*.bmp") returned 5 [0069.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.gif") returned 0 [0069.029] lstrlenA (lpString="*.gif") returned 5 [0069.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.png") returned 0 [0069.029] lstrlenA (lpString="*.png") returned 5 [0069.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.doc") returned 0 [0069.029] lstrlenA (lpString="*.doc") returned 5 [0069.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.docx") returned 0 [0069.029] lstrlenA (lpString="*.docx") returned 6 [0069.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.xls") returned 0 [0069.029] lstrlenA (lpString="*.xls") returned 5 [0069.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.xlsx") returned 0 [0069.029] lstrlenA (lpString="*.xlsx") returned 6 [0069.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.ppt") returned 0 [0069.029] lstrlenA (lpString="*.ppt") returned 5 [0069.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.pptx") returned 0 [0069.029] lstrlenA (lpString="*.pptx") returned 6 [0069.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.txt") returned 0 [0069.029] lstrlenA (lpString="*.txt") returned 5 [0069.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.pdf") returned 0 [0069.029] lstrlenA (lpString="*.pdf") returned 5 [0069.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.djvu") returned 0 [0069.029] lstrlenA (lpString="*.djvu") returned 6 [0069.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.htm") returned 0 [0069.029] lstrlenA (lpString="*.htm") returned 5 [0069.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.html") returned 0 [0069.029] lstrlenA (lpString="*.html") returned 6 [0069.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.mdb") returned 0 [0069.030] lstrlenA (lpString="*.mdb") returned 5 [0069.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.cer") returned 0 [0069.030] lstrlenA (lpString="*.cer") returned 5 [0069.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.p12") returned 0 [0069.030] lstrlenA (lpString="*.p12") returned 5 [0069.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.pfx") returned 0 [0069.030] lstrlenA (lpString="*.pfx") returned 5 [0069.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.kwm") returned 0 [0069.030] lstrlenA (lpString="*.kwm") returned 5 [0069.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.pwm") returned 0 [0069.030] lstrlenA (lpString="*.pwm") returned 5 [0069.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.1cd") returned 0 [0069.030] lstrlenA (lpString="*.1cd") returned 5 [0069.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.md") returned 0 [0069.030] lstrlenA (lpString="*.md") returned 4 [0069.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.mdf") returned 0 [0069.030] lstrlenA (lpString="*.mdf") returned 5 [0069.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.dbf") returned 0 [0069.030] lstrlenA (lpString="*.dbf") returned 5 [0069.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.odt") returned 0 [0069.030] lstrlenA (lpString="*.odt") returned 5 [0069.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.vob") returned 0 [0069.030] lstrlenA (lpString="*.vob") returned 5 [0069.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.ifo") returned 0 [0069.030] lstrlenA (lpString="*.ifo") returned 5 [0069.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.lnk") returned 0 [0069.030] lstrlenA (lpString="*.lnk") returned 5 [0069.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.torrent") returned 0 [0069.030] lstrlenA (lpString="*.torrent") returned 9 [0069.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.mov") returned 0 [0069.030] lstrlenA (lpString="*.mov") returned 5 [0069.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.m2v") returned 0 [0069.030] lstrlenA (lpString="*.m2v") returned 5 [0069.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.3gp") returned 0 [0069.031] lstrlenA (lpString="*.3gp") returned 5 [0069.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.mpeg") returned 0 [0069.031] lstrlenA (lpString="*.mpeg") returned 6 [0069.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.mpg") returned 0 [0069.031] lstrlenA (lpString="*.mpg") returned 5 [0069.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.flv") returned 0 [0069.031] lstrlenA (lpString="*.flv") returned 5 [0069.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.avi") returned 0 [0069.031] lstrlenA (lpString="*.avi") returned 5 [0069.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.mp4") returned 0 [0069.031] lstrlenA (lpString="*.mp4") returned 5 [0069.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.wmv") returned 0 [0069.031] lstrlenA (lpString="*.wmv") returned 5 [0069.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.divx") returned 0 [0069.031] lstrlenA (lpString="*.divx") returned 6 [0069.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.mkv") returned 0 [0069.031] lstrlenA (lpString="*.mkv") returned 5 [0069.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.mp3") returned 0 [0069.031] lstrlenA (lpString="*.mp3") returned 5 [0069.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.wav") returned 0 [0069.031] lstrlenA (lpString="*.wav") returned 5 [0069.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.flac") returned 0 [0069.031] lstrlenA (lpString="*.flac") returned 6 [0069.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.ape") returned 0 [0069.031] lstrlenA (lpString="*.ape") returned 5 [0069.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.wma") returned 0 [0069.031] lstrlenA (lpString="*.wma") returned 5 [0069.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.ac3") returned 0 [0069.031] lstrlenA (lpString="*.ac3") returned 5 [0069.031] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36268ef, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x745c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183172.WMF", cAlternateFileName="")) returned 1 [0069.031] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.031] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0183172.WMF") returned -1 [0069.032] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0183172.WMF") returned -1 [0069.032] lstrcmpiA (lpString1="", lpString2="J0183172.WMF") returned -1 [0069.032] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned="J0182946.WMF" [0069.032] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.032] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.032] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.032] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.032] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0183172.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" [0069.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF", pszSpec="*.zip") returned 0 [0069.032] lstrlenA (lpString="*.zip") returned 5 [0069.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF", pszSpec="*.rar") returned 0 [0069.032] lstrlenA (lpString="*.rar") returned 5 [0069.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF", pszSpec="*.7z") returned 0 [0069.032] lstrlenA (lpString="*.7z") returned 4 [0069.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF", pszSpec="*.tar") returned 0 [0069.032] lstrlenA (lpString="*.tar") returned 5 [0069.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF", pszSpec="*.gzip") returned 0 [0069.032] lstrlenA (lpString="*.gzip") returned 6 [0069.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF", pszSpec="*.jpg") returned 0 [0069.032] lstrlenA (lpString="*.jpg") returned 5 [0069.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF", pszSpec="*.jpeg") returned 0 [0069.032] lstrlenA (lpString="*.jpeg") returned 6 [0069.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF", pszSpec="*.psd") returned 0 [0069.032] lstrlenA (lpString="*.psd") returned 5 [0069.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF", pszSpec="*.cdr") returned 0 [0069.033] lstrlenA (lpString="*.cdr") returned 5 [0069.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF", pszSpec="*.dwg") returned 0 [0069.033] lstrlenA (lpString="*.dwg") returned 5 [0069.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF", pszSpec="*.max") returned 0 [0069.033] lstrlenA (lpString="*.max") returned 5 [0069.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF", pszSpec="*.bmp") returned 0 [0069.033] lstrlenA (lpString="*.bmp") returned 5 [0069.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF", pszSpec="*.gif") returned 0 [0069.033] lstrlenA (lpString="*.gif") returned 5 [0069.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF", pszSpec="*.png") returned 0 [0069.033] lstrlenA (lpString="*.png") returned 5 [0069.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF", pszSpec="*.doc") returned 0 [0069.033] lstrlenA (lpString="*.doc") returned 5 [0069.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF", pszSpec="*.docx") returned 0 [0069.033] lstrlenA (lpString="*.docx") returned 6 [0069.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF", pszSpec="*.xls") returned 0 [0069.033] lstrlenA (lpString="*.xls") returned 5 [0069.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF", pszSpec="*.xlsx") returned 0 [0069.033] lstrlenA (lpString="*.xlsx") returned 6 [0069.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF", pszSpec="*.ppt") returned 0 [0069.033] lstrlenA (lpString="*.ppt") returned 5 [0069.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF", pszSpec="*.pptx") returned 0 [0069.033] lstrlenA (lpString="*.pptx") returned 6 [0069.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF", pszSpec="*.txt") returned 0 [0069.033] lstrlenA (lpString="*.txt") returned 5 [0069.034] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0c89d9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6fd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183174.WMF", cAlternateFileName="")) returned 1 [0069.034] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.034] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0183174.WMF") returned -1 [0069.034] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0183174.WMF") returned -1 [0069.034] lstrcmpiA (lpString1="", lpString2="J0183174.WMF") returned -1 [0069.034] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned="J0183172.WMF" [0069.034] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.034] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.034] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.034] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.034] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0183174.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" [0069.034] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0cebc7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183198.WMF", cAlternateFileName="")) returned 1 [0069.034] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.034] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0183198.WMF") returned -1 [0069.034] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0183198.WMF") returned -1 [0069.034] lstrcmpiA (lpString1="", lpString2="J0183198.WMF") returned -1 [0069.034] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned="J0183174.WMF" [0069.034] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.034] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.034] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.034] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.034] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0183198.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" [0069.035] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc362caaa, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4b4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183574.WMF", cAlternateFileName="")) returned 1 [0069.035] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.035] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0183574.WMF") returned -1 [0069.035] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0183574.WMF") returned -1 [0069.035] lstrcmpiA (lpString1="", lpString2="J0183574.WMF") returned -1 [0069.035] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned="J0183198.WMF" [0069.035] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.035] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.035] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.036] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.036] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0183574.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" [0069.036] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0d3a2a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1c88, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185670.WMF", cAlternateFileName="")) returned 1 [0069.036] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.036] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0185670.WMF") returned -1 [0069.036] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0185670.WMF") returned -1 [0069.036] lstrcmpiA (lpString1="", lpString2="J0185670.WMF") returned -1 [0069.036] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned="J0183574.WMF" [0069.036] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.036] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.036] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.036] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.036] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0185670.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" [0069.036] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0d9cbd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4e46, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185774.WMF", cAlternateFileName="")) returned 1 [0069.036] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.036] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0185774.WMF") returned -1 [0069.036] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0185774.WMF") returned -1 [0069.036] lstrcmpiA (lpString1="", lpString2="J0185774.WMF") returned -1 [0069.036] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned="J0185670.WMF" [0069.036] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.036] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.036] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.036] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.037] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0185774.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" [0069.037] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3632c45, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x69d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185776.WMF", cAlternateFileName="")) returned 1 [0069.037] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.037] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0185776.WMF") returned -1 [0069.037] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0185776.WMF") returned -1 [0069.037] lstrcmpiA (lpString1="", lpString2="J0185776.WMF") returned -1 [0069.037] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned="J0185774.WMF" [0069.037] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.037] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.037] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.037] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.037] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0185776.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" [0069.037] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3637ace, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x62e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185778.WMF", cAlternateFileName="")) returned 1 [0069.037] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.037] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0185778.WMF") returned -1 [0069.037] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0185778.WMF") returned -1 [0069.037] lstrcmpiA (lpString1="", lpString2="J0185778.WMF") returned -1 [0069.037] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned="J0185776.WMF" [0069.037] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.037] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.037] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.037] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.037] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0185778.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" [0069.038] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0dfd9a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe956, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185780.WMF", cAlternateFileName="")) returned 1 [0069.038] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.038] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0185780.WMF") returned -1 [0069.038] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0185780.WMF") returned -1 [0069.038] lstrcmpiA (lpString1="", lpString2="J0185780.WMF") returned -1 [0069.038] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned="J0185778.WMF" [0069.038] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.038] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.038] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.038] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.038] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0185780.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" [0069.038] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0e5f14, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x99a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185786.WMF", cAlternateFileName="")) returned 1 [0069.038] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.038] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0185786.WMF") returned -1 [0069.038] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0185786.WMF") returned -1 [0069.038] lstrcmpiA (lpString1="", lpString2="J0185786.WMF") returned -1 [0069.038] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned="J0185780.WMF" [0069.038] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.038] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.038] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.038] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.038] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0185786.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" [0069.038] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0ed3f2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x50b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185790.WMF", cAlternateFileName="")) returned 1 [0069.038] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.039] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0185790.WMF") returned -1 [0069.039] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0185790.WMF") returned -1 [0069.039] lstrcmpiA (lpString1="", lpString2="J0185790.WMF") returned -1 [0069.039] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned="J0185786.WMF" [0069.039] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.039] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.039] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.039] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.039] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0185790.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" [0069.039] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc363c893, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x650c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185796.WMF", cAlternateFileName="")) returned 1 [0069.039] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.039] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0185796.WMF") returned -1 [0069.039] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0185796.WMF") returned -1 [0069.039] lstrcmpiA (lpString1="", lpString2="J0185796.WMF") returned -1 [0069.039] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned="J0185790.WMF" [0069.039] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.039] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.039] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.039] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.039] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0185796.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" [0069.039] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0f231a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8420, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185798.WMF", cAlternateFileName="")) returned 1 [0069.039] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.039] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0185798.WMF") returned -1 [0069.039] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0185798.WMF") returned -1 [0069.039] lstrcmpiA (lpString1="", lpString2="J0185798.WMF") returned -1 [0069.040] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned="J0185796.WMF" [0069.040] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.040] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.040] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.040] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.040] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0185798.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" [0069.040] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0f703b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5eae, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185800.WMF", cAlternateFileName="")) returned 1 [0069.040] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.040] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0185800.WMF") returned -1 [0069.041] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0185800.WMF") returned -1 [0069.041] lstrcmpiA (lpString1="", lpString2="J0185800.WMF") returned -1 [0069.041] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned="J0185798.WMF" [0069.041] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.041] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.041] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.041] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.041] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0185800.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" [0069.041] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3646576, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x773a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185806.WMF", cAlternateFileName="")) returned 1 [0069.041] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.041] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0185806.WMF") returned -1 [0069.041] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0185806.WMF") returned -1 [0069.041] lstrcmpiA (lpString1="", lpString2="J0185806.WMF") returned -1 [0069.041] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned="J0185800.WMF" [0069.041] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.041] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.041] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.041] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.041] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0185806.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" [0069.041] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0fd20d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8b8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185818.WMF", cAlternateFileName="")) returned 1 [0069.041] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.041] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0185818.WMF") returned -1 [0069.041] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0185818.WMF") returned -1 [0069.041] lstrcmpiA (lpString1="", lpString2="J0185818.WMF") returned -1 [0069.042] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned="J0185806.WMF" [0069.042] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.042] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.042] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.042] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.042] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0185818.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" [0069.042] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae10475e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185828.WMF", cAlternateFileName="")) returned 1 [0069.042] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.042] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0185828.WMF") returned -1 [0069.042] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0185828.WMF") returned -1 [0069.042] lstrcmpiA (lpString1="", lpString2="J0185828.WMF") returned -1 [0069.042] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned="J0185818.WMF" [0069.042] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.042] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.042] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.042] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.042] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0185828.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" [0069.042] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc364b2af, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2182, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185834.WMF", cAlternateFileName="")) returned 1 [0069.042] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.042] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0185834.WMF") returned -1 [0069.042] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0185834.WMF") returned -1 [0069.042] lstrcmpiA (lpString1="", lpString2="J0185834.WMF") returned -1 [0069.042] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned="J0185828.WMF" [0069.042] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.042] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.042] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.043] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.043] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0185834.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" [0069.043] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae109523, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x37e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185842.WMF", cAlternateFileName="")) returned 1 [0069.043] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.043] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0185842.WMF") returned -1 [0069.043] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0185842.WMF") returned -1 [0069.043] lstrcmpiA (lpString1="", lpString2="J0185842.WMF") returned -1 [0069.043] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned="J0185834.WMF" [0069.043] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.043] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.043] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.043] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.043] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0185842.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" [0069.043] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae10e317, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x21da, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186346.WMF", cAlternateFileName="")) returned 1 [0069.043] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.043] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0186346.WMF") returned -1 [0069.043] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0186346.WMF") returned -1 [0069.043] lstrcmpiA (lpString1="", lpString2="J0186346.WMF") returned -1 [0069.043] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned="J0185842.WMF" [0069.043] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.043] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.043] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.043] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.044] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0186346.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" [0069.044] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36500e2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x843a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186360.WMF", cAlternateFileName="")) returned 1 [0069.044] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.044] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0186360.WMF") returned -1 [0069.044] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0186360.WMF") returned -1 [0069.044] lstrcmpiA (lpString1="", lpString2="J0186360.WMF") returned -1 [0069.044] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned="J0186346.WMF" [0069.044] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.044] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.044] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.044] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.044] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0186360.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" [0069.044] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae113158, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x44fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186362.WMF", cAlternateFileName="")) returned 1 [0069.044] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.044] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0186362.WMF") returned -1 [0069.044] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0186362.WMF") returned -1 [0069.044] lstrcmpiA (lpString1="", lpString2="J0186362.WMF") returned -1 [0069.044] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned="J0186360.WMF" [0069.044] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.044] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.044] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.044] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.044] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0186362.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" [0069.045] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae11a6aa, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4724, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186364.WMF", cAlternateFileName="")) returned 1 [0069.045] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.045] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0186364.WMF") returned -1 [0069.045] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0186364.WMF") returned -1 [0069.045] lstrcmpiA (lpString1="", lpString2="J0186364.WMF") returned -1 [0069.045] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned="J0186362.WMF" [0069.045] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.045] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.045] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.045] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.045] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0186364.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" [0069.045] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3656275, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x19c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187647.WMF", cAlternateFileName="")) returned 1 [0069.045] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.045] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0187647.WMF") returned -1 [0069.045] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0187647.WMF") returned -1 [0069.045] lstrcmpiA (lpString1="", lpString2="J0187647.WMF") returned -1 [0069.045] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned="J0186364.WMF" [0069.045] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.045] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.045] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.045] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.045] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0187647.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" [0069.045] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc365b018, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1500, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187815.WMF", cAlternateFileName="")) returned 1 [0069.045] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.045] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0187815.WMF") returned -1 [0069.045] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0187815.WMF") returned -1 [0069.046] lstrcmpiA (lpString1="", lpString2="J0187815.WMF") returned -1 [0069.046] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned="J0187647.WMF" [0069.046] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.046] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.046] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.046] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.046] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0187815.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" [0069.046] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae11e112, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2d7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187817.WMF", cAlternateFileName="")) returned 1 [0069.046] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.046] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0187817.WMF") returned -1 [0069.046] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0187817.WMF") returned -1 [0069.046] lstrcmpiA (lpString1="", lpString2="J0187817.WMF") returned -1 [0069.046] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned="J0187815.WMF" [0069.046] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.046] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.046] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.046] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.046] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0187817.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" [0069.046] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc365feb5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2870, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187819.WMF", cAlternateFileName="")) returned 1 [0069.046] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.046] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0187819.WMF") returned -1 [0069.046] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0187819.WMF") returned -1 [0069.046] lstrcmpiA (lpString1="", lpString2="J0187819.WMF") returned -1 [0069.046] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned="J0187817.WMF" [0069.046] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.047] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.047] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.047] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.047] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0187819.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" [0069.047] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae122ffb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1d4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187825.WMF", cAlternateFileName="")) returned 1 [0069.047] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.047] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0187825.WMF") returned -1 [0069.047] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0187825.WMF") returned -1 [0069.047] lstrcmpiA (lpString1="", lpString2="J0187825.WMF") returned -1 [0069.047] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned="J0187819.WMF" [0069.047] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.047] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.047] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.047] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.047] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0187825.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" [0069.047] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae127d3d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3040, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187829.WMF", cAlternateFileName="")) returned 1 [0069.047] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.047] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0187829.WMF") returned -1 [0069.047] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0187829.WMF") returned -1 [0069.047] lstrcmpiA (lpString1="", lpString2="J0187829.WMF") returned -1 [0069.047] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned="J0187825.WMF" [0069.047] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.047] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.047] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.047] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.048] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0187829.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" [0069.048] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3664cd3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2480, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187835.WMF", cAlternateFileName="")) returned 1 [0069.048] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.048] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0187835.WMF") returned -1 [0069.048] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0187835.WMF") returned -1 [0069.048] lstrcmpiA (lpString1="", lpString2="J0187835.WMF") returned -1 [0069.048] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned="J0187829.WMF" [0069.048] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.048] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.048] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.048] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.048] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0187835.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" [0069.048] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae12df70, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3fe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187837.WMF", cAlternateFileName="")) returned 1 [0069.048] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.048] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0187837.WMF") returned -1 [0069.048] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0187837.WMF") returned -1 [0069.048] lstrcmpiA (lpString1="", lpString2="J0187837.WMF") returned -1 [0069.048] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned="J0187835.WMF" [0069.049] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.049] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.049] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.049] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.049] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0187837.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" [0069.049] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae132d56, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187839.WMF", cAlternateFileName="")) returned 1 [0069.049] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.049] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0187839.WMF") returned -1 [0069.049] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0187839.WMF") returned -1 [0069.049] lstrcmpiA (lpString1="", lpString2="J0187839.WMF") returned -1 [0069.049] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned="J0187837.WMF" [0069.049] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.049] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.049] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.049] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.049] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0187839.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" [0069.049] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae137b40, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1bcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187847.WMF", cAlternateFileName="")) returned 1 [0069.049] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.049] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0187847.WMF") returned -1 [0069.049] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0187847.WMF") returned -1 [0069.049] lstrcmpiA (lpString1="", lpString2="J0187847.WMF") returned -1 [0069.049] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned="J0187839.WMF" [0069.049] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.049] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.050] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.050] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.050] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0187847.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" [0069.050] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3669b21, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1d94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187849.WMF", cAlternateFileName="")) returned 1 [0069.050] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.050] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0187849.WMF") returned -1 [0069.050] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0187849.WMF") returned -1 [0069.050] lstrcmpiA (lpString1="", lpString2="J0187849.WMF") returned -1 [0069.050] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned="J0187847.WMF" [0069.050] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.050] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.050] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.050] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.050] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0187849.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" [0069.050] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae13dd37, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x221c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187851.WMF", cAlternateFileName="")) returned 1 [0069.050] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.050] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0187851.WMF") returned -1 [0069.050] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0187851.WMF") returned -1 [0069.050] lstrcmpiA (lpString1="", lpString2="J0187851.WMF") returned -1 [0069.050] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned="J0187849.WMF" [0069.050] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.050] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.050] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.050] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.050] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0187851.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" [0069.051] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae143e6a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187859.WMF", cAlternateFileName="")) returned 1 [0069.051] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.051] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0187859.WMF") returned -1 [0069.051] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0187859.WMF") returned -1 [0069.051] lstrcmpiA (lpString1="", lpString2="J0187859.WMF") returned -1 [0069.051] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned="J0187851.WMF" [0069.051] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.051] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.051] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.051] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.051] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0187859.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" [0069.051] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc366fcab, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187861.WMF", cAlternateFileName="")) returned 1 [0069.051] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.051] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0187861.WMF") returned -1 [0069.051] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0187861.WMF") returned -1 [0069.051] lstrcmpiA (lpString1="", lpString2="J0187861.WMF") returned -1 [0069.051] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned="J0187859.WMF" [0069.051] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.051] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.051] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.051] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.051] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0187861.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" [0069.051] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36737d9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2a44, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187863.WMF", cAlternateFileName="")) returned 1 [0069.051] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.053] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0187863.WMF") returned -1 [0069.053] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0187863.WMF") returned -1 [0069.053] lstrcmpiA (lpString1="", lpString2="J0187863.WMF") returned -1 [0069.053] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned="J0187861.WMF" [0069.053] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.053] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.053] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.053] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.053] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0187863.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" [0069.053] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae148e99, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1258, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187881.WMF", cAlternateFileName="")) returned 1 [0069.053] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.053] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0187881.WMF") returned -1 [0069.053] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0187881.WMF") returned -1 [0069.053] lstrcmpiA (lpString1="", lpString2="J0187881.WMF") returned -1 [0069.053] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned="J0187863.WMF" [0069.053] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.053] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.053] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.054] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.054] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0187881.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" [0069.054] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3678625, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x834, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187883.WMF", cAlternateFileName="")) returned 1 [0069.054] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.054] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0187883.WMF") returned -1 [0069.054] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0187883.WMF") returned -1 [0069.054] lstrcmpiA (lpString1="", lpString2="J0187883.WMF") returned -1 [0069.054] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned="J0187881.WMF" [0069.054] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.054] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.054] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.054] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.054] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0187883.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" [0069.054] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc367d360, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187893.WMF", cAlternateFileName="")) returned 1 [0069.054] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.054] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0187893.WMF") returned -1 [0069.054] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0187893.WMF") returned -1 [0069.054] lstrcmpiA (lpString1="", lpString2="J0187893.WMF") returned -1 [0069.054] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned="J0187883.WMF" [0069.054] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.054] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.054] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.054] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.054] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0187893.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" [0069.055] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae14c74d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187895.WMF", cAlternateFileName="")) returned 1 [0069.055] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.055] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0187895.WMF") returned -1 [0069.055] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0187895.WMF") returned -1 [0069.055] lstrcmpiA (lpString1="", lpString2="J0187895.WMF") returned -1 [0069.055] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned="J0187893.WMF" [0069.055] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.055] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.055] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.055] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.055] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0187895.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" [0069.055] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae15154b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1388, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187921.WMF", cAlternateFileName="")) returned 1 [0069.055] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.055] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0187921.WMF") returned -1 [0069.055] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0187921.WMF") returned -1 [0069.055] lstrcmpiA (lpString1="", lpString2="J0187921.WMF") returned -1 [0069.055] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned="J0187895.WMF" [0069.055] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.055] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.055] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.056] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.056] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0187921.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" [0069.056] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae15770b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x29dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188511.WMF", cAlternateFileName="")) returned 1 [0069.056] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.056] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0188511.WMF") returned -1 [0069.056] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0188511.WMF") returned -1 [0069.056] lstrcmpiA (lpString1="", lpString2="J0188511.WMF") returned -1 [0069.056] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned="J0187921.WMF" [0069.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.056] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.056] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.056] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.056] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0188511.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" [0069.056] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae15ec55, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3004, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188513.WMF", cAlternateFileName="")) returned 1 [0069.056] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.056] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0188513.WMF") returned -1 [0069.056] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0188513.WMF") returned -1 [0069.056] lstrcmpiA (lpString1="", lpString2="J0188513.WMF") returned -1 [0069.056] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned="J0188511.WMF" [0069.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.056] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.056] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.056] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.057] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0188513.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" [0069.057] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc368353f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188519.WMF", cAlternateFileName="")) returned 1 [0069.057] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.057] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0188519.WMF") returned -1 [0069.057] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0188519.WMF") returned -1 [0069.057] lstrcmpiA (lpString1="", lpString2="J0188519.WMF") returned -1 [0069.057] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned="J0188513.WMF" [0069.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.057] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.057] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.057] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.057] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0188519.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" [0069.057] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae163a95, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3b5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188587.WMF", cAlternateFileName="")) returned 1 [0069.057] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.057] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0188587.WMF") returned -1 [0069.057] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0188587.WMF") returned -1 [0069.057] lstrcmpiA (lpString1="", lpString2="J0188587.WMF") returned -1 [0069.057] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned="J0188519.WMF" [0069.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.057] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.057] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.057] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.057] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0188587.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" [0069.058] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1688b1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3e9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188667.WMF", cAlternateFileName="")) returned 1 [0069.058] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.058] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0188667.WMF") returned -1 [0069.058] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0188667.WMF") returned -1 [0069.058] lstrcmpiA (lpString1="", lpString2="J0188667.WMF") returned -1 [0069.058] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned="J0188587.WMF" [0069.058] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.058] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.058] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.058] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.058] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0188667.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" [0069.058] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3688358, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x73a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188669.WMF", cAlternateFileName="")) returned 1 [0069.058] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.058] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0188669.WMF") returned -1 [0069.058] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0188669.WMF") returned -1 [0069.058] lstrcmpiA (lpString1="", lpString2="J0188669.WMF") returned -1 [0069.058] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned="J0188667.WMF" [0069.058] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.058] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.058] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.058] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.058] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0188669.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" [0069.058] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae16ead3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x336a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188679.WMF", cAlternateFileName="")) returned 1 [0069.058] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.059] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0188679.WMF") returned -1 [0069.059] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0188679.WMF") returned -1 [0069.059] lstrcmpiA (lpString1="", lpString2="J0188679.WMF") returned -1 [0069.059] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned="J0188669.WMF" [0069.059] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.059] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.059] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.059] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.059] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0188679.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" [0069.059] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae17384d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1ca4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195248.WMF", cAlternateFileName="")) returned 1 [0069.059] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.059] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0195248.WMF") returned -1 [0069.059] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0195248.WMF") returned -1 [0069.059] lstrcmpiA (lpString1="", lpString2="J0195248.WMF") returned -1 [0069.059] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned="J0188679.WMF" [0069.059] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.059] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.059] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.059] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.059] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0195248.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" [0069.059] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae17ae05, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x11b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195254.WMF", cAlternateFileName="")) returned 1 [0069.059] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.059] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0195254.WMF") returned -1 [0069.059] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0195254.WMF") returned -1 [0069.059] lstrcmpiA (lpString1="", lpString2="J0195254.WMF") returned -1 [0069.060] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned="J0195248.WMF" [0069.060] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.060] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.060] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.060] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.060] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0195254.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" [0069.060] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc368d19f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x207a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195260.WMF", cAlternateFileName="")) returned 1 [0069.060] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.060] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0195260.WMF") returned -1 [0069.060] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0195260.WMF") returned -1 [0069.060] lstrcmpiA (lpString1="", lpString2="J0195260.WMF") returned -1 [0069.060] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned="J0195254.WMF" [0069.060] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.060] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.060] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.060] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.060] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0195260.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" [0069.060] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc369d1aa, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x72f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195320.WMF", cAlternateFileName="")) returned 1 [0069.060] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.060] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0195320.WMF") returned -1 [0069.060] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0195320.WMF") returned -1 [0069.060] lstrcmpiA (lpString1="", lpString2="J0195320.WMF") returned -1 [0069.060] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned="J0195260.WMF" [0069.060] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.060] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.060] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.061] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.061] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0195320.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" [0069.061] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36acd3c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5350, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195342.WMF", cAlternateFileName="")) returned 1 [0069.061] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.061] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0195342.WMF") returned -1 [0069.061] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0195342.WMF") returned -1 [0069.061] lstrcmpiA (lpString1="", lpString2="J0195342.WMF") returned -1 [0069.061] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned="J0195320.WMF" [0069.061] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.061] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.061] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.061] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.061] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0195342.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" [0069.061] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae17fbb2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x48be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195428.WMF", cAlternateFileName="")) returned 1 [0069.061] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.061] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0195428.WMF") returned -1 [0069.061] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0195428.WMF") returned -1 [0069.061] lstrcmpiA (lpString1="", lpString2="J0195428.WMF") returned -1 [0069.061] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned="J0195342.WMF" [0069.061] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.061] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.061] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.061] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.061] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0195428.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" [0069.062] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae184ab7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe60, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195772.WMF", cAlternateFileName="")) returned 1 [0069.062] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.062] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0195772.WMF") returned -1 [0069.062] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0195772.WMF") returned -1 [0069.062] lstrcmpiA (lpString1="", lpString2="J0195772.WMF") returned -1 [0069.062] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned="J0195428.WMF" [0069.062] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.062] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.062] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.062] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.062] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0195772.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" [0069.062] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae18bf65, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xbbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195788.WMF", cAlternateFileName="")) returned 1 [0069.062] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.062] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0195788.WMF") returned -1 [0069.062] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0195788.WMF") returned -1 [0069.062] lstrcmpiA (lpString1="", lpString2="J0195788.WMF") returned -1 [0069.062] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned="J0195772.WMF" [0069.062] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.062] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.062] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.062] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.062] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0195788.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" [0069.062] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36b1b8b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x128e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196060.WMF", cAlternateFileName="")) returned 1 [0069.062] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.062] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0196060.WMF") returned -1 [0069.063] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0196060.WMF") returned -1 [0069.063] lstrcmpiA (lpString1="", lpString2="J0196060.WMF") returned -1 [0069.063] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned="J0195788.WMF" [0069.063] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.063] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.063] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.063] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.063] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0196060.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" [0069.063] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae18f9c7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x14ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196110.WMF", cAlternateFileName="")) returned 1 [0069.063] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.063] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0196110.WMF") returned -1 [0069.063] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0196110.WMF") returned -1 [0069.063] lstrcmpiA (lpString1="", lpString2="J0196110.WMF") returned -1 [0069.063] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned="J0196060.WMF" [0069.063] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.063] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.063] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.063] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.063] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0196110.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" [0069.063] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae195b52, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xef2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196142.WMF", cAlternateFileName="")) returned 1 [0069.063] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.063] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0196142.WMF") returned -1 [0069.063] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0196142.WMF") returned -1 [0069.064] lstrcmpiA (lpString1="", lpString2="J0196142.WMF") returned -1 [0069.064] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned="J0196110.WMF" [0069.064] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.064] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.064] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.064] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.064] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0196142.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" [0069.064] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae19bcd1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3586, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196354.WMF", cAlternateFileName="")) returned 1 [0069.064] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.064] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0196354.WMF") returned -1 [0069.064] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0196354.WMF") returned -1 [0069.064] lstrcmpiA (lpString1="", lpString2="J0196354.WMF") returned -1 [0069.064] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned="J0196142.WMF" [0069.064] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.064] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.064] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.064] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.064] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0196354.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" [0069.065] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1a0b59, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196358.WMF", cAlternateFileName="")) returned 1 [0069.065] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.065] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0196358.WMF") returned -1 [0069.065] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0196358.WMF") returned -1 [0069.065] lstrcmpiA (lpString1="", lpString2="J0196358.WMF") returned -1 [0069.065] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned="J0196354.WMF" [0069.065] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.065] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.065] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.065] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.065] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0196358.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" [0069.065] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36b7d4f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x164c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196364.WMF", cAlternateFileName="")) returned 1 [0069.065] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.065] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0196364.WMF") returned -1 [0069.065] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0196364.WMF") returned -1 [0069.065] lstrcmpiA (lpString1="", lpString2="J0196364.WMF") returned -1 [0069.065] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned="J0196358.WMF" [0069.065] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.065] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.066] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.066] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.066] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0196364.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" [0069.066] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1a5969, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x9d26, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0197979.WMF", cAlternateFileName="")) returned 1 [0069.066] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.066] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0197979.WMF") returned -1 [0069.066] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0197979.WMF") returned -1 [0069.066] lstrcmpiA (lpString1="", lpString2="J0197979.WMF") returned -1 [0069.066] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF") returned="J0196364.WMF" [0069.066] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.066] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.066] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.066] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.066] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0197979.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" [0069.066] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1abb99, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x668c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0197983.WMF", cAlternateFileName="")) returned 1 [0069.066] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.066] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0197983.WMF") returned -1 [0069.066] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0197983.WMF") returned -1 [0069.066] lstrcmpiA (lpString1="", lpString2="J0197983.WMF") returned -1 [0069.066] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned="J0197979.WMF" [0069.066] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.066] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.066] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.066] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.067] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0197983.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" [0069.067] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36bded3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x849c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198016.WMF", cAlternateFileName="")) returned 1 [0069.067] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.067] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0198016.WMF") returned -1 [0069.067] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0198016.WMF") returned -1 [0069.067] lstrcmpiA (lpString1="", lpString2="J0198016.WMF") returned -1 [0069.067] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned="J0197983.WMF" [0069.067] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.067] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.067] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.067] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.067] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0198016.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" [0069.067] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1b1c74, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5cae, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198020.WMF", cAlternateFileName="")) returned 1 [0069.067] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.067] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0198020.WMF") returned -1 [0069.067] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0198020.WMF") returned -1 [0069.067] lstrcmpiA (lpString1="", lpString2="J0198020.WMF") returned -1 [0069.067] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned="J0198016.WMF" [0069.067] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.067] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.067] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.067] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.067] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0198020.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" [0069.067] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1b7e51, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8860, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198021.WMF", cAlternateFileName="")) returned 1 [0069.068] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.068] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0198021.WMF") returned -1 [0069.068] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0198021.WMF") returned -1 [0069.068] lstrcmpiA (lpString1="", lpString2="J0198021.WMF") returned -1 [0069.068] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned="J0198020.WMF" [0069.068] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.068] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.068] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.068] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.068] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0198021.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" [0069.068] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36c4077, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6624, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198022.WMF", cAlternateFileName="")) returned 1 [0069.068] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.068] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0198022.WMF") returned -1 [0069.068] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0198022.WMF") returned -1 [0069.068] lstrcmpiA (lpString1="", lpString2="J0198022.WMF") returned -1 [0069.068] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned="J0198021.WMF" [0069.068] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.068] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.068] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.068] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.068] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0198022.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" [0069.068] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36c8ed5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3cce, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198025.WMF", cAlternateFileName="")) returned 1 [0069.068] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.068] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0198025.WMF") returned -1 [0069.069] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0198025.WMF") returned -1 [0069.069] lstrcmpiA (lpString1="", lpString2="J0198025.WMF") returned -1 [0069.069] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned="J0198022.WMF" [0069.069] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.069] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.069] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.069] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.069] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0198025.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" [0069.069] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1bf3da, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd6b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198102.WMF", cAlternateFileName="")) returned 1 [0069.097] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.097] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0198102.WMF") returned -1 [0069.097] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0198102.WMF") returned -1 [0069.097] lstrcmpiA (lpString1="", lpString2="J0198102.WMF") returned -1 [0069.097] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned="J0198025.WMF" [0069.097] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.097] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.097] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.097] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.097] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0198102.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" [0069.097] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1c55af, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa520, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198113.WMF", cAlternateFileName="")) returned 1 [0069.097] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.097] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0198113.WMF") returned -1 [0069.098] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0198113.WMF") returned -1 [0069.098] lstrcmpiA (lpString1="", lpString2="J0198113.WMF") returned -1 [0069.098] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned="J0198102.WMF" [0069.098] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.098] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.098] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.098] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.098] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0198113.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" [0069.098] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36cdcd6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa3b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198226.WMF", cAlternateFileName="")) returned 1 [0069.098] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.098] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0198226.WMF") returned -1 [0069.098] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0198226.WMF") returned -1 [0069.098] lstrcmpiA (lpString1="", lpString2="J0198226.WMF") returned -1 [0069.098] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned="J0198113.WMF" [0069.098] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.098] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.098] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.098] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.098] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0198226.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" [0069.098] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36d3e76, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa69e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198234.WMF", cAlternateFileName="")) returned 1 [0069.098] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.099] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0198234.WMF") returned -1 [0069.099] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0198234.WMF") returned -1 [0069.099] lstrcmpiA (lpString1="", lpString2="J0198234.WMF") returned -1 [0069.099] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned="J0198226.WMF" [0069.099] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.099] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.099] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.099] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.099] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0198234.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" [0069.099] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36db3ca, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6f9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198372.WMF", cAlternateFileName="")) returned 1 [0069.099] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.099] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0198372.WMF") returned -1 [0069.099] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0198372.WMF") returned -1 [0069.099] lstrcmpiA (lpString1="", lpString2="J0198372.WMF") returned -1 [0069.099] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF") returned="J0198234.WMF" [0069.099] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.099] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.099] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.099] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.099] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0198372.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" [0069.099] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1cca1e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x9d6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198377.WMF", cAlternateFileName="")) returned 1 [0069.099] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.100] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0198377.WMF") returned -1 [0069.100] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0198377.WMF") returned -1 [0069.100] lstrcmpiA (lpString1="", lpString2="J0198377.WMF") returned -1 [0069.100] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned="J0198372.WMF" [0069.100] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.100] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.100] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.100] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.100] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0198377.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" [0069.100] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1d2c51, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xc20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198447.WMF", cAlternateFileName="")) returned 1 [0069.100] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.100] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0198447.WMF") returned -1 [0069.100] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0198447.WMF") returned -1 [0069.100] lstrcmpiA (lpString1="", lpString2="J0198447.WMF") returned -1 [0069.100] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned="J0198377.WMF" [0069.100] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.100] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.100] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.100] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.100] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0198447.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" [0069.100] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36e290f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xae08, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198494.WMF", cAlternateFileName="")) returned 1 [0069.100] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.100] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0198494.WMF") returned -1 [0069.101] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0198494.WMF") returned -1 [0069.101] lstrcmpiA (lpString1="", lpString2="J0198494.WMF") returned -1 [0069.101] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF") returned="J0198447.WMF" [0069.101] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.101] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.101] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.101] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.101] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0198494.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" [0069.101] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36e8aab, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198712.WMF", cAlternateFileName="")) returned 1 [0069.101] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.101] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF") returned="J0198494.WMF" [0069.101] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.101] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.101] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.101] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.101] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0198712.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" [0069.101] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1d8d6c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x714e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199279.WMF", cAlternateFileName="")) returned 1 [0069.101] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.101] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF") returned="J0198712.WMF" [0069.101] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.101] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.101] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.102] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.102] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0199279.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" [0069.102] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1e1611, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7c4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199303.WMF", cAlternateFileName="")) returned 1 [0069.102] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.102] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF") returned="J0199279.WMF" [0069.102] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.102] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.102] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.102] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.102] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0199303.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" [0069.102] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1e8b98, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xc37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199307.WMF", cAlternateFileName="")) returned 1 [0069.102] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.103] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF") returned="J0199303.WMF" [0069.103] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.103] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.103] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.103] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.104] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0199307.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" [0069.104] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36ed8e1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x662a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199423.WMF", cAlternateFileName="")) returned 1 [0069.104] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.104] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF") returned="J0199307.WMF" [0069.104] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.104] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.104] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.104] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.104] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0199423.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" [0069.104] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1ed985, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199429.WMF", cAlternateFileName="")) returned 1 [0069.104] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.104] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF") returned="J0199423.WMF" [0069.104] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.104] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.104] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.104] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.104] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0199429.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" [0069.104] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36f3b3c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x13c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199465.WMF", cAlternateFileName="")) returned 1 [0069.104] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.105] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF") returned="J0199429.WMF" [0069.105] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.105] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.105] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.105] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.105] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0199465.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" [0069.105] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1f2784, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x35bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199469.WMF", cAlternateFileName="")) returned 1 [0069.105] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.105] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF") returned="J0199465.WMF" [0069.105] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.105] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.105] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.105] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.105] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0199469.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" [0069.105] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36f9bfd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199473.WMF", cAlternateFileName="")) returned 1 [0069.105] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.105] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF") returned="J0199469.WMF" [0069.105] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.105] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.105] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.105] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.106] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0199473.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" [0069.106] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36fe9f6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199475.WMF", cAlternateFileName="")) returned 1 [0069.106] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.106] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF") returned="J0199473.WMF" [0069.106] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.106] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.106] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.106] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.106] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0199475.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" [0069.106] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1f75cc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x27b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199483.WMF", cAlternateFileName="")) returned 1 [0069.106] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.106] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF") returned="J0199475.WMF" [0069.106] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.106] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.106] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.106] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.106] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0199483.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" [0069.106] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae24a5e8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x302c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199609.WMF", cAlternateFileName="")) returned 1 [0069.106] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.106] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF") returned="J0199483.WMF" [0069.106] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.107] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.107] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.107] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.107] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0199609.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" [0069.107] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3703845, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2004, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200151.WMF", cAlternateFileName="")) returned 1 [0069.107] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.107] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF") returned="J0199609.WMF" [0069.107] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.107] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.107] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.107] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.107] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0200151.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" [0069.107] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae24f3ef, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1c0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200163.WMF", cAlternateFileName="")) returned 1 [0069.107] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.107] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF") returned="J0200151.WMF" [0069.107] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.107] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.107] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.107] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.107] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0200163.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" [0069.107] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae254209, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x14c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200183.WMF", cAlternateFileName="")) returned 1 [0069.108] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.108] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF") returned="J0200163.WMF" [0069.108] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.108] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.108] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.108] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.108] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0200183.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" [0069.108] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae259095, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1f7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200189.WMF", cAlternateFileName="")) returned 1 [0069.108] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.108] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF") returned="J0200183.WMF" [0069.108] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.108] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.108] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.108] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.108] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0200189.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" [0069.108] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37099cc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7a46, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200273.WMF", cAlternateFileName="")) returned 1 [0069.108] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.108] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF") returned="J0200189.WMF" [0069.108] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.108] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.108] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.109] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.109] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0200273.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" [0069.109] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae25f1e2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4c0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200279.WMF", cAlternateFileName="")) returned 1 [0069.109] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.109] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF") returned="J0200273.WMF" [0069.109] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.109] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.109] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.109] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.109] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0200279.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" [0069.109] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc370e7e1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa0b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200289.WMF", cAlternateFileName="")) returned 1 [0069.109] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.109] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF") returned="J0200279.WMF" [0069.109] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.109] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.109] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.109] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.109] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0200289.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" [0069.109] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37149a6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4f08, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200377.WMF", cAlternateFileName="")) returned 1 [0069.110] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.110] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF") returned="J0200289.WMF" [0069.110] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.110] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.110] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.110] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.110] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0200377.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" [0069.110] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc371ab15, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5398, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200383.WMF", cAlternateFileName="")) returned 1 [0069.110] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.110] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF") returned="J0200377.WMF" [0069.110] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.110] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.110] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.110] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.110] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0200383.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" [0069.110] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae263fdf, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x366e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200467.WMF", cAlternateFileName="")) returned 1 [0069.110] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.110] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF") returned="J0200383.WMF" [0069.110] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.110] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.110] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.110] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.111] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0200467.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" [0069.111] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3720ccf, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x273e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200521.WMF", cAlternateFileName="")) returned 1 [0069.111] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.111] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF") returned="J0200467.WMF" [0069.111] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.111] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.111] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.111] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.111] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0200521.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" [0069.111] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae268e06, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xf36, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200611.WMF", cAlternateFileName="")) returned 1 [0069.111] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.111] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF") returned="J0200521.WMF" [0069.111] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.111] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.111] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.111] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.111] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0200611.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" [0069.111] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae271712, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa50e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0202045.JPG", cAlternateFileName="")) returned 1 [0069.111] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.111] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF") returned="J0200611.WMF" [0069.111] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.111] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.112] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.112] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.112] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0202045.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" [0069.112] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" [0069.112] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" [0069.112] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG." [0069.112] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.BD" [0069.112] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.113] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa50e [0069.113] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae271712, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.113] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.113] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xa4b2, lpOverlapped=0x0) returned 1 [0069.116] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") returned="J0202045.JPG" [0069.117] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.117] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xa4b2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xa4b2, lpOverlapped=0x0) returned 1 [0069.117] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.118] CloseHandle (hObject=0x1cc) returned 1 [0069.120] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0202045.jpg.bd")) returned 1 [0069.121] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae278cd9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0211981.WMF", cAlternateFileName="")) returned 1 [0069.121] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.121] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0211981.WMF") returned -1 [0069.121] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0211981.WMF") returned -1 [0069.121] lstrcmpiA (lpString1="", lpString2="J0211981.WMF") returned -1 [0069.121] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") returned="J0202045.JPG" [0069.121] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.121] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.121] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.122] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.122] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0211981.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" [0069.122] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.zip") returned 0 [0069.122] lstrlenA (lpString="*.zip") returned 5 [0069.122] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.rar") returned 0 [0069.122] lstrlenA (lpString="*.rar") returned 5 [0069.122] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.7z") returned 0 [0069.122] lstrlenA (lpString="*.7z") returned 4 [0069.122] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.tar") returned 0 [0069.122] lstrlenA (lpString="*.tar") returned 5 [0069.122] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.gzip") returned 0 [0069.122] lstrlenA (lpString="*.gzip") returned 6 [0069.122] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.jpg") returned 0 [0069.122] lstrlenA (lpString="*.jpg") returned 5 [0069.122] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.jpeg") returned 0 [0069.122] lstrlenA (lpString="*.jpeg") returned 6 [0069.122] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.psd") returned 0 [0069.122] lstrlenA (lpString="*.psd") returned 5 [0069.122] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.cdr") returned 0 [0069.122] lstrlenA (lpString="*.cdr") returned 5 [0069.122] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.dwg") returned 0 [0069.122] lstrlenA (lpString="*.dwg") returned 5 [0069.123] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.max") returned 0 [0069.123] lstrlenA (lpString="*.max") returned 5 [0069.123] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.bmp") returned 0 [0069.123] lstrlenA (lpString="*.bmp") returned 5 [0069.123] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.gif") returned 0 [0069.123] lstrlenA (lpString="*.gif") returned 5 [0069.123] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.png") returned 0 [0069.123] lstrlenA (lpString="*.png") returned 5 [0069.123] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.doc") returned 0 [0069.123] lstrlenA (lpString="*.doc") returned 5 [0069.123] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.docx") returned 0 [0069.123] lstrlenA (lpString="*.docx") returned 6 [0069.123] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.xls") returned 0 [0069.123] lstrlenA (lpString="*.xls") returned 5 [0069.123] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.xlsx") returned 0 [0069.123] lstrlenA (lpString="*.xlsx") returned 6 [0069.123] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.ppt") returned 0 [0069.123] lstrlenA (lpString="*.ppt") returned 5 [0069.123] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.pptx") returned 0 [0069.123] lstrlenA (lpString="*.pptx") returned 6 [0069.123] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.txt") returned 0 [0069.123] lstrlenA (lpString="*.txt") returned 5 [0069.124] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.pdf") returned 0 [0069.124] lstrlenA (lpString="*.pdf") returned 5 [0069.124] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.djvu") returned 0 [0069.124] lstrlenA (lpString="*.djvu") returned 6 [0069.124] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.htm") returned 0 [0069.124] lstrlenA (lpString="*.htm") returned 5 [0069.124] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.html") returned 0 [0069.124] lstrlenA (lpString="*.html") returned 6 [0069.124] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.mdb") returned 0 [0069.124] lstrlenA (lpString="*.mdb") returned 5 [0069.124] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.cer") returned 0 [0069.124] lstrlenA (lpString="*.cer") returned 5 [0069.124] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.p12") returned 0 [0069.124] lstrlenA (lpString="*.p12") returned 5 [0069.124] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.pfx") returned 0 [0069.124] lstrlenA (lpString="*.pfx") returned 5 [0069.124] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.kwm") returned 0 [0069.124] lstrlenA (lpString="*.kwm") returned 5 [0069.124] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.pwm") returned 0 [0069.124] lstrlenA (lpString="*.pwm") returned 5 [0069.124] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.1cd") returned 0 [0069.124] lstrlenA (lpString="*.1cd") returned 5 [0069.124] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.md") returned 0 [0069.125] lstrlenA (lpString="*.md") returned 4 [0069.125] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.mdf") returned 0 [0069.125] lstrlenA (lpString="*.mdf") returned 5 [0069.125] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.dbf") returned 0 [0069.125] lstrlenA (lpString="*.dbf") returned 5 [0069.125] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.odt") returned 0 [0069.125] lstrlenA (lpString="*.odt") returned 5 [0069.125] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.vob") returned 0 [0069.125] lstrlenA (lpString="*.vob") returned 5 [0069.125] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.ifo") returned 0 [0069.125] lstrlenA (lpString="*.ifo") returned 5 [0069.125] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.lnk") returned 0 [0069.125] lstrlenA (lpString="*.lnk") returned 5 [0069.125] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.torrent") returned 0 [0069.125] lstrlenA (lpString="*.torrent") returned 9 [0069.125] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.mov") returned 0 [0069.125] lstrlenA (lpString="*.mov") returned 5 [0069.125] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.m2v") returned 0 [0069.125] lstrlenA (lpString="*.m2v") returned 5 [0069.125] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.3gp") returned 0 [0069.125] lstrlenA (lpString="*.3gp") returned 5 [0069.125] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.mpeg") returned 0 [0069.126] lstrlenA (lpString="*.mpeg") returned 6 [0069.126] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.mpg") returned 0 [0069.126] lstrlenA (lpString="*.mpg") returned 5 [0069.126] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.flv") returned 0 [0069.126] lstrlenA (lpString="*.flv") returned 5 [0069.126] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.avi") returned 0 [0069.126] lstrlenA (lpString="*.avi") returned 5 [0069.126] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.mp4") returned 0 [0069.126] lstrlenA (lpString="*.mp4") returned 5 [0069.126] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.wmv") returned 0 [0069.126] lstrlenA (lpString="*.wmv") returned 5 [0069.126] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.divx") returned 0 [0069.126] lstrlenA (lpString="*.divx") returned 6 [0069.126] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.mkv") returned 0 [0069.126] lstrlenA (lpString="*.mkv") returned 5 [0069.126] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.mp3") returned 0 [0069.126] lstrlenA (lpString="*.mp3") returned 5 [0069.126] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.wav") returned 0 [0069.126] lstrlenA (lpString="*.wav") returned 5 [0069.126] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.flac") returned 0 [0069.126] lstrlenA (lpString="*.flac") returned 6 [0069.126] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.ape") returned 0 [0069.126] lstrlenA (lpString="*.ape") returned 5 [0069.126] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.wma") returned 0 [0069.127] lstrlenA (lpString="*.wma") returned 5 [0069.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.ac3") returned 0 [0069.127] lstrlenA (lpString="*.ac3") returned 5 [0069.127] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3725b17, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x180e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212299.WMF", cAlternateFileName="")) returned 1 [0069.128] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.129] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0212299.WMF") returned -1 [0069.129] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0212299.WMF") returned -1 [0069.129] lstrcmpiA (lpString1="", lpString2="J0212299.WMF") returned -1 [0069.129] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF") returned="J0211981.WMF" [0069.129] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.129] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.129] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.129] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.129] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0212299.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" [0069.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.zip") returned 0 [0069.129] lstrlenA (lpString="*.zip") returned 5 [0069.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.rar") returned 0 [0069.129] lstrlenA (lpString="*.rar") returned 5 [0069.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.7z") returned 0 [0069.129] lstrlenA (lpString="*.7z") returned 4 [0069.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.tar") returned 0 [0069.129] lstrlenA (lpString="*.tar") returned 5 [0069.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.gzip") returned 0 [0069.129] lstrlenA (lpString="*.gzip") returned 6 [0069.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.jpg") returned 0 [0069.130] lstrlenA (lpString="*.jpg") returned 5 [0069.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.jpeg") returned 0 [0069.130] lstrlenA (lpString="*.jpeg") returned 6 [0069.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.psd") returned 0 [0069.130] lstrlenA (lpString="*.psd") returned 5 [0069.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.cdr") returned 0 [0069.130] lstrlenA (lpString="*.cdr") returned 5 [0069.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.dwg") returned 0 [0069.130] lstrlenA (lpString="*.dwg") returned 5 [0069.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.max") returned 0 [0069.130] lstrlenA (lpString="*.max") returned 5 [0069.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.bmp") returned 0 [0069.130] lstrlenA (lpString="*.bmp") returned 5 [0069.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.gif") returned 0 [0069.130] lstrlenA (lpString="*.gif") returned 5 [0069.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.png") returned 0 [0069.130] lstrlenA (lpString="*.png") returned 5 [0069.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.doc") returned 0 [0069.130] lstrlenA (lpString="*.doc") returned 5 [0069.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.docx") returned 0 [0069.130] lstrlenA (lpString="*.docx") returned 6 [0069.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.xls") returned 0 [0069.131] lstrlenA (lpString="*.xls") returned 5 [0069.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.xlsx") returned 0 [0069.131] lstrlenA (lpString="*.xlsx") returned 6 [0069.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.ppt") returned 0 [0069.131] lstrlenA (lpString="*.ppt") returned 5 [0069.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.pptx") returned 0 [0069.131] lstrlenA (lpString="*.pptx") returned 6 [0069.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.txt") returned 0 [0069.131] lstrlenA (lpString="*.txt") returned 5 [0069.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.pdf") returned 0 [0069.131] lstrlenA (lpString="*.pdf") returned 5 [0069.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.djvu") returned 0 [0069.131] lstrlenA (lpString="*.djvu") returned 6 [0069.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.htm") returned 0 [0069.131] lstrlenA (lpString="*.htm") returned 5 [0069.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.html") returned 0 [0069.131] lstrlenA (lpString="*.html") returned 6 [0069.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.mdb") returned 0 [0069.131] lstrlenA (lpString="*.mdb") returned 5 [0069.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.cer") returned 0 [0069.131] lstrlenA (lpString="*.cer") returned 5 [0069.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.p12") returned 0 [0069.131] lstrlenA (lpString="*.p12") returned 5 [0069.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.pfx") returned 0 [0069.132] lstrlenA (lpString="*.pfx") returned 5 [0069.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.kwm") returned 0 [0069.132] lstrlenA (lpString="*.kwm") returned 5 [0069.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.pwm") returned 0 [0069.132] lstrlenA (lpString="*.pwm") returned 5 [0069.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.1cd") returned 0 [0069.132] lstrlenA (lpString="*.1cd") returned 5 [0069.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.md") returned 0 [0069.132] lstrlenA (lpString="*.md") returned 4 [0069.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.mdf") returned 0 [0069.132] lstrlenA (lpString="*.mdf") returned 5 [0069.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.dbf") returned 0 [0069.132] lstrlenA (lpString="*.dbf") returned 5 [0069.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.odt") returned 0 [0069.132] lstrlenA (lpString="*.odt") returned 5 [0069.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.vob") returned 0 [0069.132] lstrlenA (lpString="*.vob") returned 5 [0069.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.ifo") returned 0 [0069.132] lstrlenA (lpString="*.ifo") returned 5 [0069.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.lnk") returned 0 [0069.132] lstrlenA (lpString="*.lnk") returned 5 [0069.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.torrent") returned 0 [0069.132] lstrlenA (lpString="*.torrent") returned 9 [0069.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.mov") returned 0 [0069.133] lstrlenA (lpString="*.mov") returned 5 [0069.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.m2v") returned 0 [0069.133] lstrlenA (lpString="*.m2v") returned 5 [0069.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.3gp") returned 0 [0069.133] lstrlenA (lpString="*.3gp") returned 5 [0069.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.mpeg") returned 0 [0069.133] lstrlenA (lpString="*.mpeg") returned 6 [0069.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.mpg") returned 0 [0069.133] lstrlenA (lpString="*.mpg") returned 5 [0069.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.flv") returned 0 [0069.133] lstrlenA (lpString="*.flv") returned 5 [0069.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.avi") returned 0 [0069.133] lstrlenA (lpString="*.avi") returned 5 [0069.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.mp4") returned 0 [0069.133] lstrlenA (lpString="*.mp4") returned 5 [0069.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.wmv") returned 0 [0069.133] lstrlenA (lpString="*.wmv") returned 5 [0069.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.divx") returned 0 [0069.133] lstrlenA (lpString="*.divx") returned 6 [0069.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.mkv") returned 0 [0069.133] lstrlenA (lpString="*.mkv") returned 5 [0069.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.mp3") returned 0 [0069.133] lstrlenA (lpString="*.mp3") returned 5 [0069.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.wav") returned 0 [0069.133] lstrlenA (lpString="*.wav") returned 5 [0069.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.flac") returned 0 [0069.133] lstrlenA (lpString="*.flac") returned 6 [0069.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.ape") returned 0 [0069.145] lstrlenA (lpString="*.ape") returned 5 [0069.145] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.wma") returned 0 [0069.145] lstrlenA (lpString="*.wma") returned 5 [0069.145] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.ac3") returned 0 [0069.145] lstrlenA (lpString="*.ac3") returned 5 [0069.145] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae27daf8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x25cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212601.WMF", cAlternateFileName="")) returned 1 [0069.145] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.145] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0212601.WMF") returned -1 [0069.145] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0212601.WMF") returned -1 [0069.145] lstrcmpiA (lpString1="", lpString2="J0212601.WMF") returned -1 [0069.145] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.145] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.145] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.145] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.145] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0212601.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" [0069.145] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.zip") returned 0 [0069.145] lstrlenA (lpString="*.zip") returned 5 [0069.145] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.rar") returned 0 [0069.145] lstrlenA (lpString="*.rar") returned 5 [0069.145] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.7z") returned 0 [0069.145] lstrlenA (lpString="*.7z") returned 4 [0069.145] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.tar") returned 0 [0069.145] lstrlenA (lpString="*.tar") returned 5 [0069.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.gzip") returned 0 [0069.146] lstrlenA (lpString="*.gzip") returned 6 [0069.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.jpg") returned 0 [0069.146] lstrlenA (lpString="*.jpg") returned 5 [0069.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.jpeg") returned 0 [0069.146] lstrlenA (lpString="*.jpeg") returned 6 [0069.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.psd") returned 0 [0069.146] lstrlenA (lpString="*.psd") returned 5 [0069.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.cdr") returned 0 [0069.146] lstrlenA (lpString="*.cdr") returned 5 [0069.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.dwg") returned 0 [0069.146] lstrlenA (lpString="*.dwg") returned 5 [0069.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.max") returned 0 [0069.146] lstrlenA (lpString="*.max") returned 5 [0069.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.bmp") returned 0 [0069.146] lstrlenA (lpString="*.bmp") returned 5 [0069.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.gif") returned 0 [0069.146] lstrlenA (lpString="*.gif") returned 5 [0069.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.png") returned 0 [0069.146] lstrlenA (lpString="*.png") returned 5 [0069.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.doc") returned 0 [0069.146] lstrlenA (lpString="*.doc") returned 5 [0069.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.docx") returned 0 [0069.146] lstrlenA (lpString="*.docx") returned 6 [0069.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.xls") returned 0 [0069.146] lstrlenA (lpString="*.xls") returned 5 [0069.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.xlsx") returned 0 [0069.146] lstrlenA (lpString="*.xlsx") returned 6 [0069.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.ppt") returned 0 [0069.146] lstrlenA (lpString="*.ppt") returned 5 [0069.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.pptx") returned 0 [0069.146] lstrlenA (lpString="*.pptx") returned 6 [0069.147] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.txt") returned 0 [0069.147] lstrlenA (lpString="*.txt") returned 5 [0069.147] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.pdf") returned 0 [0069.147] lstrlenA (lpString="*.pdf") returned 5 [0069.147] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.djvu") returned 0 [0069.147] lstrlenA (lpString="*.djvu") returned 6 [0069.147] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.htm") returned 0 [0069.147] lstrlenA (lpString="*.htm") returned 5 [0069.147] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.html") returned 0 [0069.147] lstrlenA (lpString="*.html") returned 6 [0069.147] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.mdb") returned 0 [0069.147] lstrlenA (lpString="*.mdb") returned 5 [0069.147] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.cer") returned 0 [0069.147] lstrlenA (lpString="*.cer") returned 5 [0069.147] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.p12") returned 0 [0069.147] lstrlenA (lpString="*.p12") returned 5 [0069.147] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.pfx") returned 0 [0069.147] lstrlenA (lpString="*.pfx") returned 5 [0069.147] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.kwm") returned 0 [0069.147] lstrlenA (lpString="*.kwm") returned 5 [0069.147] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.pwm") returned 0 [0069.147] lstrlenA (lpString="*.pwm") returned 5 [0069.147] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.1cd") returned 0 [0069.147] lstrlenA (lpString="*.1cd") returned 5 [0069.147] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.md") returned 0 [0069.147] lstrlenA (lpString="*.md") returned 4 [0069.147] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.mdf") returned 0 [0069.147] lstrlenA (lpString="*.mdf") returned 5 [0069.147] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.dbf") returned 0 [0069.147] lstrlenA (lpString="*.dbf") returned 5 [0069.147] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.odt") returned 0 [0069.147] lstrlenA (lpString="*.odt") returned 5 [0069.147] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.vob") returned 0 [0069.147] lstrlenA (lpString="*.vob") returned 5 [0069.148] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.ifo") returned 0 [0069.148] lstrlenA (lpString="*.ifo") returned 5 [0069.148] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.lnk") returned 0 [0069.148] lstrlenA (lpString="*.lnk") returned 5 [0069.148] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.torrent") returned 0 [0069.148] lstrlenA (lpString="*.torrent") returned 9 [0069.148] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.mov") returned 0 [0069.148] lstrlenA (lpString="*.mov") returned 5 [0069.148] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.m2v") returned 0 [0069.148] lstrlenA (lpString="*.m2v") returned 5 [0069.148] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.3gp") returned 0 [0069.148] lstrlenA (lpString="*.3gp") returned 5 [0069.148] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.mpeg") returned 0 [0069.148] lstrlenA (lpString="*.mpeg") returned 6 [0069.148] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.mpg") returned 0 [0069.148] lstrlenA (lpString="*.mpg") returned 5 [0069.148] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.flv") returned 0 [0069.148] lstrlenA (lpString="*.flv") returned 5 [0069.148] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.avi") returned 0 [0069.148] lstrlenA (lpString="*.avi") returned 5 [0069.148] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.mp4") returned 0 [0069.148] lstrlenA (lpString="*.mp4") returned 5 [0069.148] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.wmv") returned 0 [0069.148] lstrlenA (lpString="*.wmv") returned 5 [0069.148] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.divx") returned 0 [0069.148] lstrlenA (lpString="*.divx") returned 6 [0069.148] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.mkv") returned 0 [0069.148] lstrlenA (lpString="*.mkv") returned 5 [0069.148] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.mp3") returned 0 [0069.148] lstrlenA (lpString="*.mp3") returned 5 [0069.148] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.wav") returned 0 [0069.148] lstrlenA (lpString="*.wav") returned 5 [0069.148] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.flac") returned 0 [0069.149] lstrlenA (lpString="*.flac") returned 6 [0069.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.ape") returned 0 [0069.149] lstrlenA (lpString="*.ape") returned 5 [0069.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.wma") returned 0 [0069.149] lstrlenA (lpString="*.wma") returned 5 [0069.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.ac3") returned 0 [0069.149] lstrlenA (lpString="*.ac3") returned 5 [0069.149] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae283bc9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x199a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212685.WMF", cAlternateFileName="")) returned 1 [0069.149] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.149] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0212685.WMF") returned -1 [0069.149] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0212685.WMF") returned -1 [0069.149] lstrcmpiA (lpString1="", lpString2="J0212685.WMF") returned -1 [0069.149] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.149] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.149] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.149] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.150] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0212685.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" [0069.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.zip") returned 0 [0069.150] lstrlenA (lpString="*.zip") returned 5 [0069.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.rar") returned 0 [0069.150] lstrlenA (lpString="*.rar") returned 5 [0069.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.7z") returned 0 [0069.150] lstrlenA (lpString="*.7z") returned 4 [0069.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.tar") returned 0 [0069.150] lstrlenA (lpString="*.tar") returned 5 [0069.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.gzip") returned 0 [0069.150] lstrlenA (lpString="*.gzip") returned 6 [0069.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.jpg") returned 0 [0069.150] lstrlenA (lpString="*.jpg") returned 5 [0069.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.jpeg") returned 0 [0069.150] lstrlenA (lpString="*.jpeg") returned 6 [0069.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.psd") returned 0 [0069.150] lstrlenA (lpString="*.psd") returned 5 [0069.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.cdr") returned 0 [0069.150] lstrlenA (lpString="*.cdr") returned 5 [0069.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.dwg") returned 0 [0069.150] lstrlenA (lpString="*.dwg") returned 5 [0069.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.max") returned 0 [0069.150] lstrlenA (lpString="*.max") returned 5 [0069.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.bmp") returned 0 [0069.150] lstrlenA (lpString="*.bmp") returned 5 [0069.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.gif") returned 0 [0069.150] lstrlenA (lpString="*.gif") returned 5 [0069.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.png") returned 0 [0069.150] lstrlenA (lpString="*.png") returned 5 [0069.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.doc") returned 0 [0069.151] lstrlenA (lpString="*.doc") returned 5 [0069.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.docx") returned 0 [0069.151] lstrlenA (lpString="*.docx") returned 6 [0069.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.xls") returned 0 [0069.151] lstrlenA (lpString="*.xls") returned 5 [0069.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.xlsx") returned 0 [0069.151] lstrlenA (lpString="*.xlsx") returned 6 [0069.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.ppt") returned 0 [0069.151] lstrlenA (lpString="*.ppt") returned 5 [0069.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.pptx") returned 0 [0069.151] lstrlenA (lpString="*.pptx") returned 6 [0069.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.txt") returned 0 [0069.151] lstrlenA (lpString="*.txt") returned 5 [0069.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.pdf") returned 0 [0069.151] lstrlenA (lpString="*.pdf") returned 5 [0069.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.djvu") returned 0 [0069.151] lstrlenA (lpString="*.djvu") returned 6 [0069.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.htm") returned 0 [0069.151] lstrlenA (lpString="*.htm") returned 5 [0069.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.html") returned 0 [0069.151] lstrlenA (lpString="*.html") returned 6 [0069.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.mdb") returned 0 [0069.151] lstrlenA (lpString="*.mdb") returned 5 [0069.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.cer") returned 0 [0069.151] lstrlenA (lpString="*.cer") returned 5 [0069.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.p12") returned 0 [0069.151] lstrlenA (lpString="*.p12") returned 5 [0069.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.pfx") returned 0 [0069.151] lstrlenA (lpString="*.pfx") returned 5 [0069.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.kwm") returned 0 [0069.151] lstrlenA (lpString="*.kwm") returned 5 [0069.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.pwm") returned 0 [0069.152] lstrlenA (lpString="*.pwm") returned 5 [0069.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.1cd") returned 0 [0069.152] lstrlenA (lpString="*.1cd") returned 5 [0069.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.md") returned 0 [0069.152] lstrlenA (lpString="*.md") returned 4 [0069.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.mdf") returned 0 [0069.152] lstrlenA (lpString="*.mdf") returned 5 [0069.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.dbf") returned 0 [0069.152] lstrlenA (lpString="*.dbf") returned 5 [0069.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.odt") returned 0 [0069.152] lstrlenA (lpString="*.odt") returned 5 [0069.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.vob") returned 0 [0069.152] lstrlenA (lpString="*.vob") returned 5 [0069.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.ifo") returned 0 [0069.152] lstrlenA (lpString="*.ifo") returned 5 [0069.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.lnk") returned 0 [0069.152] lstrlenA (lpString="*.lnk") returned 5 [0069.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.torrent") returned 0 [0069.152] lstrlenA (lpString="*.torrent") returned 9 [0069.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.mov") returned 0 [0069.152] lstrlenA (lpString="*.mov") returned 5 [0069.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.m2v") returned 0 [0069.152] lstrlenA (lpString="*.m2v") returned 5 [0069.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.3gp") returned 0 [0069.152] lstrlenA (lpString="*.3gp") returned 5 [0069.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.mpeg") returned 0 [0069.152] lstrlenA (lpString="*.mpeg") returned 6 [0069.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.mpg") returned 0 [0069.152] lstrlenA (lpString="*.mpg") returned 5 [0069.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.flv") returned 0 [0069.152] lstrlenA (lpString="*.flv") returned 5 [0069.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.avi") returned 0 [0069.152] lstrlenA (lpString="*.avi") returned 5 [0069.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.mp4") returned 0 [0069.153] lstrlenA (lpString="*.mp4") returned 5 [0069.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.wmv") returned 0 [0069.153] lstrlenA (lpString="*.wmv") returned 5 [0069.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.divx") returned 0 [0069.153] lstrlenA (lpString="*.divx") returned 6 [0069.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.mkv") returned 0 [0069.153] lstrlenA (lpString="*.mkv") returned 5 [0069.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.mp3") returned 0 [0069.153] lstrlenA (lpString="*.mp3") returned 5 [0069.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.wav") returned 0 [0069.153] lstrlenA (lpString="*.wav") returned 5 [0069.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.flac") returned 0 [0069.153] lstrlenA (lpString="*.flac") returned 6 [0069.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.ape") returned 0 [0069.153] lstrlenA (lpString="*.ape") returned 5 [0069.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.wma") returned 0 [0069.153] lstrlenA (lpString="*.wma") returned 5 [0069.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.ac3") returned 0 [0069.153] lstrlenA (lpString="*.ac3") returned 5 [0069.153] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2889f2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x80c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212751.WMF", cAlternateFileName="")) returned 1 [0069.153] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.153] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0212751.WMF") returned -1 [0069.153] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0212751.WMF") returned -1 [0069.153] lstrcmpiA (lpString1="", lpString2="J0212751.WMF") returned -1 [0069.153] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.153] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.153] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.153] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.153] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0212751.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" [0069.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF", pszSpec="*.zip") returned 0 [0069.154] lstrlenA (lpString="*.zip") returned 5 [0069.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF", pszSpec="*.rar") returned 0 [0069.154] lstrlenA (lpString="*.rar") returned 5 [0069.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF", pszSpec="*.7z") returned 0 [0069.154] lstrlenA (lpString="*.7z") returned 4 [0069.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF", pszSpec="*.tar") returned 0 [0069.154] lstrlenA (lpString="*.tar") returned 5 [0069.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF", pszSpec="*.gzip") returned 0 [0069.154] lstrlenA (lpString="*.gzip") returned 6 [0069.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF", pszSpec="*.jpg") returned 0 [0069.154] lstrlenA (lpString="*.jpg") returned 5 [0069.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF", pszSpec="*.jpeg") returned 0 [0069.154] lstrlenA (lpString="*.jpeg") returned 6 [0069.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF", pszSpec="*.psd") returned 0 [0069.154] lstrlenA (lpString="*.psd") returned 5 [0069.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF", pszSpec="*.cdr") returned 0 [0069.154] lstrlenA (lpString="*.cdr") returned 5 [0069.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF", pszSpec="*.dwg") returned 0 [0069.154] lstrlenA (lpString="*.dwg") returned 5 [0069.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF", pszSpec="*.max") returned 0 [0069.154] lstrlenA (lpString="*.max") returned 5 [0069.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF", pszSpec="*.bmp") returned 0 [0069.154] lstrlenA (lpString="*.bmp") returned 5 [0069.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF", pszSpec="*.gif") returned 0 [0069.154] lstrlenA (lpString="*.gif") returned 5 [0069.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF", pszSpec="*.png") returned 0 [0069.154] lstrlenA (lpString="*.png") returned 5 [0069.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF", pszSpec="*.doc") returned 0 [0069.154] lstrlenA (lpString="*.doc") returned 5 [0069.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF", pszSpec="*.docx") returned 0 [0069.154] lstrlenA (lpString="*.docx") returned 6 [0069.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF", pszSpec="*.xls") returned 0 [0069.155] lstrlenA (lpString="*.xls") returned 5 [0069.155] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF", pszSpec="*.xlsx") returned 0 [0069.155] lstrlenA (lpString="*.xlsx") returned 6 [0069.155] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF", pszSpec="*.ppt") returned 0 [0069.155] lstrlenA (lpString="*.ppt") returned 5 [0069.155] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF", pszSpec="*.pptx") returned 0 [0069.155] lstrlenA (lpString="*.pptx") returned 6 [0069.155] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF", pszSpec="*.txt") returned 0 [0069.155] lstrlenA (lpString="*.txt") returned 5 [0069.155] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae28d875, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212953.WMF", cAlternateFileName="")) returned 1 [0069.155] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.155] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0212953.WMF") returned -1 [0069.155] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0212953.WMF") returned -1 [0069.155] lstrcmpiA (lpString1="", lpString2="J0212953.WMF") returned -1 [0069.155] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.155] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.155] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.155] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.155] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0212953.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" [0069.156] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2939b8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0213243.WMF", cAlternateFileName="")) returned 1 [0069.156] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.156] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0213243.WMF") returned -1 [0069.156] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0213243.WMF") returned -1 [0069.156] lstrcmpiA (lpString1="", lpString2="J0213243.WMF") returned -1 [0069.156] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.156] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.156] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.156] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.156] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0213243.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" [0069.156] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc372a935, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xf00, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0213449.WMF", cAlternateFileName="")) returned 1 [0069.156] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.156] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0213449.WMF") returned -1 [0069.156] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0213449.WMF") returned -1 [0069.156] lstrcmpiA (lpString1="", lpString2="J0213449.WMF") returned -1 [0069.156] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.156] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.156] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.156] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.156] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0213449.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" [0069.156] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae298858, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7cb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0214934.WMF", cAlternateFileName="")) returned 1 [0069.156] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.156] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0214934.WMF") returned -1 [0069.157] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0214934.WMF") returned -1 [0069.157] lstrcmpiA (lpString1="", lpString2="J0214934.WMF") returned -1 [0069.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.157] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.157] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.157] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.157] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0214934.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" [0069.157] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae29e97b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xaefa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0214948.WMF", cAlternateFileName="")) returned 1 [0069.157] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.157] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0214948.WMF") returned -1 [0069.157] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0214948.WMF") returned -1 [0069.157] lstrcmpiA (lpString1="", lpString2="J0214948.WMF") returned -1 [0069.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.157] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.157] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.157] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.157] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0214948.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" [0069.157] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2a4ba5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2d6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215070.WMF", cAlternateFileName="")) returned 1 [0069.157] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.157] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0215070.WMF") returned -1 [0069.157] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0215070.WMF") returned -1 [0069.157] lstrcmpiA (lpString1="", lpString2="J0215070.WMF") returned -1 [0069.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.158] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.158] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.158] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.158] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0215070.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" [0069.158] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2a99c6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1f50, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215076.WMF", cAlternateFileName="")) returned 1 [0069.158] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.158] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0215076.WMF") returned -1 [0069.158] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0215076.WMF") returned -1 [0069.158] lstrcmpiA (lpString1="", lpString2="J0215076.WMF") returned -1 [0069.158] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.158] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.158] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.158] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.158] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0215076.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" [0069.158] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc372f74d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x81ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215210.WMF", cAlternateFileName="")) returned 1 [0069.158] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.158] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0215210.WMF") returned -1 [0069.158] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0215210.WMF") returned -1 [0069.158] lstrcmpiA (lpString1="", lpString2="J0215210.WMF") returned -1 [0069.158] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.158] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.158] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.158] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.159] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0215210.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" [0069.159] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2afb35, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x244a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215709.WMF", cAlternateFileName="")) returned 1 [0069.159] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.159] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0215709.WMF") returned -1 [0069.159] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0215709.WMF") returned -1 [0069.159] lstrcmpiA (lpString1="", lpString2="J0215709.WMF") returned -1 [0069.159] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.159] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.159] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.159] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.159] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0215709.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" [0069.159] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2b4918, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x45a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215710.WMF", cAlternateFileName="")) returned 1 [0069.159] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.159] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0215710.WMF") returned -1 [0069.159] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0215710.WMF") returned -1 [0069.159] lstrcmpiA (lpString1="", lpString2="J0215710.WMF") returned -1 [0069.159] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.159] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.159] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.159] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.159] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0215710.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" [0069.159] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37358c6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x15f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215718.WMF", cAlternateFileName="")) returned 1 [0069.160] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.160] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0215718.WMF") returned -1 [0069.160] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0215718.WMF") returned -1 [0069.160] lstrcmpiA (lpString1="", lpString2="J0215718.WMF") returned -1 [0069.160] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.160] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.160] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.160] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.160] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc373ba8e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa783, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216112.JPG", cAlternateFileName="")) returned 1 [0069.160] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.160] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0216112.JPG") returned -1 [0069.160] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0216112.JPG") returned -1 [0069.160] lstrcmpiA (lpString1="", lpString2="J0216112.JPG") returned -1 [0069.160] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.160] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.160] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.160] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" [0069.160] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" [0069.160] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.162] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa783 [0069.162] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc373ba8e, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.162] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.162] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xa727, lpOverlapped=0x0) returned 1 [0069.165] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.165] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xa727, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xa727, lpOverlapped=0x0) returned 1 [0069.166] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.166] CloseHandle (hObject=0x1cc) returned 1 [0069.168] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216112.jpg.bd")) returned 1 [0069.168] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2bc094, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5474, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216153.JPG", cAlternateFileName="")) returned 1 [0069.168] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.168] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0216153.JPG") returned -1 [0069.168] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0216153.JPG") returned -1 [0069.168] lstrcmpiA (lpString1="", lpString2="J0216153.JPG") returned -1 [0069.168] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG") returned="J0216112.JPG" [0069.168] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.169] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.169] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.169] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.169] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0216153.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" [0069.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG", pszSpec="*.zip") returned 0 [0069.169] lstrlenA (lpString="*.zip") returned 5 [0069.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG", pszSpec="*.rar") returned 0 [0069.169] lstrlenA (lpString="*.rar") returned 5 [0069.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG", pszSpec="*.7z") returned 0 [0069.169] lstrlenA (lpString="*.7z") returned 4 [0069.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG", pszSpec="*.tar") returned 0 [0069.169] lstrlenA (lpString="*.tar") returned 5 [0069.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG", pszSpec="*.gzip") returned 0 [0069.169] lstrlenA (lpString="*.gzip") returned 6 [0069.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG", pszSpec="*.jpg") returned 1 [0069.169] lstrlenA (lpString="*.jpg") returned 5 [0069.169] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" [0069.169] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" [0069.169] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG." [0069.169] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.BD" [0069.169] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.170] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5474 [0069.170] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae2bc094, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.170] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.170] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x5418, lpOverlapped=0x0) returned 1 [0069.173] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") returned="J0216153.JPG" [0069.173] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.173] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x5418, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x5418, lpOverlapped=0x0) returned 1 [0069.174] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.174] CloseHandle (hObject=0x1cc) returned 1 [0069.175] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216153.jpg.bd")) returned 1 [0069.176] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3741c3b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa488, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216540.WMF", cAlternateFileName="")) returned 1 [0069.176] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.176] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0216540.WMF") returned -1 [0069.176] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0216540.WMF") returned -1 [0069.176] lstrcmpiA (lpString1="", lpString2="J0216540.WMF") returned -1 [0069.176] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") returned="J0216153.JPG" [0069.176] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.176] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.176] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.176] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.176] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0216540.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" [0069.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.zip") returned 0 [0069.176] lstrlenA (lpString="*.zip") returned 5 [0069.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.rar") returned 0 [0069.176] lstrlenA (lpString="*.rar") returned 5 [0069.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.7z") returned 0 [0069.176] lstrlenA (lpString="*.7z") returned 4 [0069.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.tar") returned 0 [0069.177] lstrlenA (lpString="*.tar") returned 5 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.gzip") returned 0 [0069.177] lstrlenA (lpString="*.gzip") returned 6 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.jpg") returned 0 [0069.177] lstrlenA (lpString="*.jpg") returned 5 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.jpeg") returned 0 [0069.177] lstrlenA (lpString="*.jpeg") returned 6 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.psd") returned 0 [0069.177] lstrlenA (lpString="*.psd") returned 5 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.cdr") returned 0 [0069.177] lstrlenA (lpString="*.cdr") returned 5 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.dwg") returned 0 [0069.177] lstrlenA (lpString="*.dwg") returned 5 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.max") returned 0 [0069.177] lstrlenA (lpString="*.max") returned 5 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.bmp") returned 0 [0069.177] lstrlenA (lpString="*.bmp") returned 5 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.gif") returned 0 [0069.177] lstrlenA (lpString="*.gif") returned 5 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.png") returned 0 [0069.177] lstrlenA (lpString="*.png") returned 5 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.doc") returned 0 [0069.177] lstrlenA (lpString="*.doc") returned 5 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.docx") returned 0 [0069.177] lstrlenA (lpString="*.docx") returned 6 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.xls") returned 0 [0069.177] lstrlenA (lpString="*.xls") returned 5 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.xlsx") returned 0 [0069.177] lstrlenA (lpString="*.xlsx") returned 6 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.ppt") returned 0 [0069.177] lstrlenA (lpString="*.ppt") returned 5 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.pptx") returned 0 [0069.178] lstrlenA (lpString="*.pptx") returned 6 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.txt") returned 0 [0069.178] lstrlenA (lpString="*.txt") returned 5 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.pdf") returned 0 [0069.178] lstrlenA (lpString="*.pdf") returned 5 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.djvu") returned 0 [0069.178] lstrlenA (lpString="*.djvu") returned 6 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.htm") returned 0 [0069.178] lstrlenA (lpString="*.htm") returned 5 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.html") returned 0 [0069.178] lstrlenA (lpString="*.html") returned 6 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.mdb") returned 0 [0069.178] lstrlenA (lpString="*.mdb") returned 5 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.cer") returned 0 [0069.178] lstrlenA (lpString="*.cer") returned 5 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.p12") returned 0 [0069.178] lstrlenA (lpString="*.p12") returned 5 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.pfx") returned 0 [0069.178] lstrlenA (lpString="*.pfx") returned 5 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.kwm") returned 0 [0069.178] lstrlenA (lpString="*.kwm") returned 5 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.pwm") returned 0 [0069.178] lstrlenA (lpString="*.pwm") returned 5 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.1cd") returned 0 [0069.178] lstrlenA (lpString="*.1cd") returned 5 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.md") returned 0 [0069.178] lstrlenA (lpString="*.md") returned 4 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.mdf") returned 0 [0069.178] lstrlenA (lpString="*.mdf") returned 5 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.dbf") returned 0 [0069.178] lstrlenA (lpString="*.dbf") returned 5 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.odt") returned 0 [0069.178] lstrlenA (lpString="*.odt") returned 5 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.vob") returned 0 [0069.179] lstrlenA (lpString="*.vob") returned 5 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.ifo") returned 0 [0069.179] lstrlenA (lpString="*.ifo") returned 5 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.lnk") returned 0 [0069.179] lstrlenA (lpString="*.lnk") returned 5 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.torrent") returned 0 [0069.179] lstrlenA (lpString="*.torrent") returned 9 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.mov") returned 0 [0069.179] lstrlenA (lpString="*.mov") returned 5 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.m2v") returned 0 [0069.179] lstrlenA (lpString="*.m2v") returned 5 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.3gp") returned 0 [0069.179] lstrlenA (lpString="*.3gp") returned 5 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.mpeg") returned 0 [0069.179] lstrlenA (lpString="*.mpeg") returned 6 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.mpg") returned 0 [0069.179] lstrlenA (lpString="*.mpg") returned 5 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.flv") returned 0 [0069.179] lstrlenA (lpString="*.flv") returned 5 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.avi") returned 0 [0069.179] lstrlenA (lpString="*.avi") returned 5 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.mp4") returned 0 [0069.179] lstrlenA (lpString="*.mp4") returned 5 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.wmv") returned 0 [0069.179] lstrlenA (lpString="*.wmv") returned 5 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.divx") returned 0 [0069.179] lstrlenA (lpString="*.divx") returned 6 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.mkv") returned 0 [0069.179] lstrlenA (lpString="*.mkv") returned 5 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.mp3") returned 0 [0069.179] lstrlenA (lpString="*.mp3") returned 5 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.wav") returned 0 [0069.179] lstrlenA (lpString="*.wav") returned 5 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.flac") returned 0 [0069.180] lstrlenA (lpString="*.flac") returned 6 [0069.180] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.ape") returned 0 [0069.180] lstrlenA (lpString="*.ape") returned 5 [0069.180] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.wma") returned 0 [0069.180] lstrlenA (lpString="*.wma") returned 5 [0069.180] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.ac3") returned 0 [0069.180] lstrlenA (lpString="*.ac3") returned 5 [0069.180] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3747dce, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x60dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216570.WMF", cAlternateFileName="")) returned 1 [0069.180] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.180] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0216570.WMF") returned -1 [0069.180] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0216570.WMF") returned -1 [0069.180] lstrcmpiA (lpString1="", lpString2="J0216570.WMF") returned -1 [0069.180] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF") returned="J0216540.WMF" [0069.180] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.180] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.180] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.180] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.180] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0216570.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" [0069.180] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.zip") returned 0 [0069.180] lstrlenA (lpString="*.zip") returned 5 [0069.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.rar") returned 0 [0069.203] lstrlenA (lpString="*.rar") returned 5 [0069.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.7z") returned 0 [0069.203] lstrlenA (lpString="*.7z") returned 4 [0069.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.tar") returned 0 [0069.203] lstrlenA (lpString="*.tar") returned 5 [0069.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.gzip") returned 0 [0069.203] lstrlenA (lpString="*.gzip") returned 6 [0069.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.jpg") returned 0 [0069.203] lstrlenA (lpString="*.jpg") returned 5 [0069.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.jpeg") returned 0 [0069.203] lstrlenA (lpString="*.jpeg") returned 6 [0069.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.psd") returned 0 [0069.203] lstrlenA (lpString="*.psd") returned 5 [0069.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.cdr") returned 0 [0069.203] lstrlenA (lpString="*.cdr") returned 5 [0069.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.dwg") returned 0 [0069.203] lstrlenA (lpString="*.dwg") returned 5 [0069.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.max") returned 0 [0069.203] lstrlenA (lpString="*.max") returned 5 [0069.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.bmp") returned 0 [0069.203] lstrlenA (lpString="*.bmp") returned 5 [0069.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.gif") returned 0 [0069.203] lstrlenA (lpString="*.gif") returned 5 [0069.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.png") returned 0 [0069.204] lstrlenA (lpString="*.png") returned 5 [0069.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.doc") returned 0 [0069.204] lstrlenA (lpString="*.doc") returned 5 [0069.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.docx") returned 0 [0069.204] lstrlenA (lpString="*.docx") returned 6 [0069.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.xls") returned 0 [0069.204] lstrlenA (lpString="*.xls") returned 5 [0069.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.xlsx") returned 0 [0069.204] lstrlenA (lpString="*.xlsx") returned 6 [0069.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.ppt") returned 0 [0069.204] lstrlenA (lpString="*.ppt") returned 5 [0069.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.pptx") returned 0 [0069.204] lstrlenA (lpString="*.pptx") returned 6 [0069.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.txt") returned 0 [0069.204] lstrlenA (lpString="*.txt") returned 5 [0069.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.pdf") returned 0 [0069.204] lstrlenA (lpString="*.pdf") returned 5 [0069.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.djvu") returned 0 [0069.204] lstrlenA (lpString="*.djvu") returned 6 [0069.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.htm") returned 0 [0069.204] lstrlenA (lpString="*.htm") returned 5 [0069.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.html") returned 0 [0069.204] lstrlenA (lpString="*.html") returned 6 [0069.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.mdb") returned 0 [0069.204] lstrlenA (lpString="*.mdb") returned 5 [0069.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.cer") returned 0 [0069.204] lstrlenA (lpString="*.cer") returned 5 [0069.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.p12") returned 0 [0069.204] lstrlenA (lpString="*.p12") returned 5 [0069.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.pfx") returned 0 [0069.204] lstrlenA (lpString="*.pfx") returned 5 [0069.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.kwm") returned 0 [0069.205] lstrlenA (lpString="*.kwm") returned 5 [0069.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.pwm") returned 0 [0069.205] lstrlenA (lpString="*.pwm") returned 5 [0069.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.1cd") returned 0 [0069.205] lstrlenA (lpString="*.1cd") returned 5 [0069.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.md") returned 0 [0069.205] lstrlenA (lpString="*.md") returned 4 [0069.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.mdf") returned 0 [0069.205] lstrlenA (lpString="*.mdf") returned 5 [0069.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.dbf") returned 0 [0069.205] lstrlenA (lpString="*.dbf") returned 5 [0069.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.odt") returned 0 [0069.205] lstrlenA (lpString="*.odt") returned 5 [0069.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.vob") returned 0 [0069.205] lstrlenA (lpString="*.vob") returned 5 [0069.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.ifo") returned 0 [0069.205] lstrlenA (lpString="*.ifo") returned 5 [0069.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.lnk") returned 0 [0069.205] lstrlenA (lpString="*.lnk") returned 5 [0069.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.torrent") returned 0 [0069.205] lstrlenA (lpString="*.torrent") returned 9 [0069.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.mov") returned 0 [0069.205] lstrlenA (lpString="*.mov") returned 5 [0069.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.m2v") returned 0 [0069.205] lstrlenA (lpString="*.m2v") returned 5 [0069.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.3gp") returned 0 [0069.205] lstrlenA (lpString="*.3gp") returned 5 [0069.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.mpeg") returned 0 [0069.205] lstrlenA (lpString="*.mpeg") returned 6 [0069.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.mpg") returned 0 [0069.205] lstrlenA (lpString="*.mpg") returned 5 [0069.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.flv") returned 0 [0069.206] lstrlenA (lpString="*.flv") returned 5 [0069.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.avi") returned 0 [0069.206] lstrlenA (lpString="*.avi") returned 5 [0069.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.mp4") returned 0 [0069.206] lstrlenA (lpString="*.mp4") returned 5 [0069.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.wmv") returned 0 [0069.206] lstrlenA (lpString="*.wmv") returned 5 [0069.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.divx") returned 0 [0069.206] lstrlenA (lpString="*.divx") returned 6 [0069.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.mkv") returned 0 [0069.206] lstrlenA (lpString="*.mkv") returned 5 [0069.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.mp3") returned 0 [0069.206] lstrlenA (lpString="*.mp3") returned 5 [0069.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.wav") returned 0 [0069.206] lstrlenA (lpString="*.wav") returned 5 [0069.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.flac") returned 0 [0069.206] lstrlenA (lpString="*.flac") returned 6 [0069.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.ape") returned 0 [0069.206] lstrlenA (lpString="*.ape") returned 5 [0069.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.wma") returned 0 [0069.206] lstrlenA (lpString="*.wma") returned 5 [0069.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.ac3") returned 0 [0069.206] lstrlenA (lpString="*.ac3") returned 5 [0069.206] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc374df5f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1f46, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216600.WMF", cAlternateFileName="")) returned 1 [0069.206] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.206] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0216600.WMF") returned -1 [0069.206] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0216600.WMF") returned -1 [0069.206] lstrcmpiA (lpString1="", lpString2="J0216600.WMF") returned -1 [0069.206] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF") returned="J0216570.WMF" [0069.206] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.207] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.207] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.207] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.207] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0216600.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" [0069.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.zip") returned 0 [0069.207] lstrlenA (lpString="*.zip") returned 5 [0069.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.rar") returned 0 [0069.207] lstrlenA (lpString="*.rar") returned 5 [0069.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.7z") returned 0 [0069.207] lstrlenA (lpString="*.7z") returned 4 [0069.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.tar") returned 0 [0069.207] lstrlenA (lpString="*.tar") returned 5 [0069.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.gzip") returned 0 [0069.207] lstrlenA (lpString="*.gzip") returned 6 [0069.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.jpg") returned 0 [0069.207] lstrlenA (lpString="*.jpg") returned 5 [0069.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.jpeg") returned 0 [0069.207] lstrlenA (lpString="*.jpeg") returned 6 [0069.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.psd") returned 0 [0069.207] lstrlenA (lpString="*.psd") returned 5 [0069.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.cdr") returned 0 [0069.207] lstrlenA (lpString="*.cdr") returned 5 [0069.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.dwg") returned 0 [0069.207] lstrlenA (lpString="*.dwg") returned 5 [0069.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.max") returned 0 [0069.207] lstrlenA (lpString="*.max") returned 5 [0069.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.bmp") returned 0 [0069.207] lstrlenA (lpString="*.bmp") returned 5 [0069.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.gif") returned 0 [0069.208] lstrlenA (lpString="*.gif") returned 5 [0069.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.png") returned 0 [0069.208] lstrlenA (lpString="*.png") returned 5 [0069.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.doc") returned 0 [0069.208] lstrlenA (lpString="*.doc") returned 5 [0069.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.docx") returned 0 [0069.208] lstrlenA (lpString="*.docx") returned 6 [0069.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.xls") returned 0 [0069.208] lstrlenA (lpString="*.xls") returned 5 [0069.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.xlsx") returned 0 [0069.208] lstrlenA (lpString="*.xlsx") returned 6 [0069.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.ppt") returned 0 [0069.208] lstrlenA (lpString="*.ppt") returned 5 [0069.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.pptx") returned 0 [0069.208] lstrlenA (lpString="*.pptx") returned 6 [0069.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.txt") returned 0 [0069.208] lstrlenA (lpString="*.txt") returned 5 [0069.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.pdf") returned 0 [0069.208] lstrlenA (lpString="*.pdf") returned 5 [0069.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.djvu") returned 0 [0069.208] lstrlenA (lpString="*.djvu") returned 6 [0069.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.htm") returned 0 [0069.208] lstrlenA (lpString="*.htm") returned 5 [0069.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.html") returned 0 [0069.208] lstrlenA (lpString="*.html") returned 6 [0069.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.mdb") returned 0 [0069.208] lstrlenA (lpString="*.mdb") returned 5 [0069.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.cer") returned 0 [0069.208] lstrlenA (lpString="*.cer") returned 5 [0069.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.p12") returned 0 [0069.208] lstrlenA (lpString="*.p12") returned 5 [0069.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.pfx") returned 0 [0069.209] lstrlenA (lpString="*.pfx") returned 5 [0069.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.kwm") returned 0 [0069.209] lstrlenA (lpString="*.kwm") returned 5 [0069.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.pwm") returned 0 [0069.209] lstrlenA (lpString="*.pwm") returned 5 [0069.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.1cd") returned 0 [0069.209] lstrlenA (lpString="*.1cd") returned 5 [0069.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.md") returned 0 [0069.209] lstrlenA (lpString="*.md") returned 4 [0069.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.mdf") returned 0 [0069.209] lstrlenA (lpString="*.mdf") returned 5 [0069.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.dbf") returned 0 [0069.209] lstrlenA (lpString="*.dbf") returned 5 [0069.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.odt") returned 0 [0069.209] lstrlenA (lpString="*.odt") returned 5 [0069.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.vob") returned 0 [0069.209] lstrlenA (lpString="*.vob") returned 5 [0069.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.ifo") returned 0 [0069.209] lstrlenA (lpString="*.ifo") returned 5 [0069.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.lnk") returned 0 [0069.209] lstrlenA (lpString="*.lnk") returned 5 [0069.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.torrent") returned 0 [0069.209] lstrlenA (lpString="*.torrent") returned 9 [0069.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.mov") returned 0 [0069.209] lstrlenA (lpString="*.mov") returned 5 [0069.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.m2v") returned 0 [0069.209] lstrlenA (lpString="*.m2v") returned 5 [0069.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.3gp") returned 0 [0069.209] lstrlenA (lpString="*.3gp") returned 5 [0069.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.mpeg") returned 0 [0069.209] lstrlenA (lpString="*.mpeg") returned 6 [0069.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.mpg") returned 0 [0069.210] lstrlenA (lpString="*.mpg") returned 5 [0069.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.flv") returned 0 [0069.210] lstrlenA (lpString="*.flv") returned 5 [0069.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.avi") returned 0 [0069.210] lstrlenA (lpString="*.avi") returned 5 [0069.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.mp4") returned 0 [0069.210] lstrlenA (lpString="*.mp4") returned 5 [0069.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.wmv") returned 0 [0069.210] lstrlenA (lpString="*.wmv") returned 5 [0069.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.divx") returned 0 [0069.210] lstrlenA (lpString="*.divx") returned 6 [0069.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.mkv") returned 0 [0069.210] lstrlenA (lpString="*.mkv") returned 5 [0069.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.mp3") returned 0 [0069.210] lstrlenA (lpString="*.mp3") returned 5 [0069.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.wav") returned 0 [0069.210] lstrlenA (lpString="*.wav") returned 5 [0069.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.flac") returned 0 [0069.210] lstrlenA (lpString="*.flac") returned 6 [0069.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.ape") returned 0 [0069.210] lstrlenA (lpString="*.ape") returned 5 [0069.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.wma") returned 0 [0069.210] lstrlenA (lpString="*.wma") returned 5 [0069.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.ac3") returned 0 [0069.210] lstrlenA (lpString="*.ac3") returned 5 [0069.210] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3752d7a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x24e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216612.WMF", cAlternateFileName="")) returned 1 [0069.210] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.210] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0216612.WMF") returned -1 [0069.210] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0216612.WMF") returned -1 [0069.210] lstrcmpiA (lpString1="", lpString2="J0216612.WMF") returned -1 [0069.210] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF") returned="J0216600.WMF" [0069.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.211] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.211] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.211] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.211] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0216612.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" [0069.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.zip") returned 0 [0069.211] lstrlenA (lpString="*.zip") returned 5 [0069.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.rar") returned 0 [0069.211] lstrlenA (lpString="*.rar") returned 5 [0069.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.7z") returned 0 [0069.211] lstrlenA (lpString="*.7z") returned 4 [0069.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.tar") returned 0 [0069.211] lstrlenA (lpString="*.tar") returned 5 [0069.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.gzip") returned 0 [0069.211] lstrlenA (lpString="*.gzip") returned 6 [0069.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.jpg") returned 0 [0069.211] lstrlenA (lpString="*.jpg") returned 5 [0069.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.jpeg") returned 0 [0069.211] lstrlenA (lpString="*.jpeg") returned 6 [0069.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.psd") returned 0 [0069.211] lstrlenA (lpString="*.psd") returned 5 [0069.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.cdr") returned 0 [0069.211] lstrlenA (lpString="*.cdr") returned 5 [0069.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.dwg") returned 0 [0069.211] lstrlenA (lpString="*.dwg") returned 5 [0069.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.max") returned 0 [0069.211] lstrlenA (lpString="*.max") returned 5 [0069.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.bmp") returned 0 [0069.211] lstrlenA (lpString="*.bmp") returned 5 [0069.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.gif") returned 0 [0069.211] lstrlenA (lpString="*.gif") returned 5 [0069.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.png") returned 0 [0069.212] lstrlenA (lpString="*.png") returned 5 [0069.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.doc") returned 0 [0069.212] lstrlenA (lpString="*.doc") returned 5 [0069.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.docx") returned 0 [0069.212] lstrlenA (lpString="*.docx") returned 6 [0069.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.xls") returned 0 [0069.212] lstrlenA (lpString="*.xls") returned 5 [0069.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.xlsx") returned 0 [0069.212] lstrlenA (lpString="*.xlsx") returned 6 [0069.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.ppt") returned 0 [0069.212] lstrlenA (lpString="*.ppt") returned 5 [0069.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.pptx") returned 0 [0069.212] lstrlenA (lpString="*.pptx") returned 6 [0069.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.txt") returned 0 [0069.212] lstrlenA (lpString="*.txt") returned 5 [0069.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.pdf") returned 0 [0069.212] lstrlenA (lpString="*.pdf") returned 5 [0069.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.djvu") returned 0 [0069.212] lstrlenA (lpString="*.djvu") returned 6 [0069.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.htm") returned 0 [0069.212] lstrlenA (lpString="*.htm") returned 5 [0069.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.html") returned 0 [0069.212] lstrlenA (lpString="*.html") returned 6 [0069.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.mdb") returned 0 [0069.212] lstrlenA (lpString="*.mdb") returned 5 [0069.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.cer") returned 0 [0069.213] lstrlenA (lpString="*.cer") returned 5 [0069.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.p12") returned 0 [0069.213] lstrlenA (lpString="*.p12") returned 5 [0069.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.pfx") returned 0 [0069.213] lstrlenA (lpString="*.pfx") returned 5 [0069.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.kwm") returned 0 [0069.213] lstrlenA (lpString="*.kwm") returned 5 [0069.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.pwm") returned 0 [0069.213] lstrlenA (lpString="*.pwm") returned 5 [0069.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.1cd") returned 0 [0069.213] lstrlenA (lpString="*.1cd") returned 5 [0069.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.md") returned 0 [0069.213] lstrlenA (lpString="*.md") returned 4 [0069.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.mdf") returned 0 [0069.213] lstrlenA (lpString="*.mdf") returned 5 [0069.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.dbf") returned 0 [0069.213] lstrlenA (lpString="*.dbf") returned 5 [0069.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.odt") returned 0 [0069.213] lstrlenA (lpString="*.odt") returned 5 [0069.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.vob") returned 0 [0069.213] lstrlenA (lpString="*.vob") returned 5 [0069.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.ifo") returned 0 [0069.213] lstrlenA (lpString="*.ifo") returned 5 [0069.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.lnk") returned 0 [0069.213] lstrlenA (lpString="*.lnk") returned 5 [0069.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.torrent") returned 0 [0069.213] lstrlenA (lpString="*.torrent") returned 9 [0069.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.mov") returned 0 [0069.213] lstrlenA (lpString="*.mov") returned 5 [0069.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.m2v") returned 0 [0069.213] lstrlenA (lpString="*.m2v") returned 5 [0069.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.3gp") returned 0 [0069.213] lstrlenA (lpString="*.3gp") returned 5 [0069.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.mpeg") returned 0 [0069.213] lstrlenA (lpString="*.mpeg") returned 6 [0069.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.mpg") returned 0 [0069.214] lstrlenA (lpString="*.mpg") returned 5 [0069.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.flv") returned 0 [0069.214] lstrlenA (lpString="*.flv") returned 5 [0069.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.avi") returned 0 [0069.214] lstrlenA (lpString="*.avi") returned 5 [0069.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.mp4") returned 0 [0069.214] lstrlenA (lpString="*.mp4") returned 5 [0069.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.wmv") returned 0 [0069.214] lstrlenA (lpString="*.wmv") returned 5 [0069.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.divx") returned 0 [0069.214] lstrlenA (lpString="*.divx") returned 6 [0069.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.mkv") returned 0 [0069.214] lstrlenA (lpString="*.mkv") returned 5 [0069.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.mp3") returned 0 [0069.214] lstrlenA (lpString="*.mp3") returned 5 [0069.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.wav") returned 0 [0069.214] lstrlenA (lpString="*.wav") returned 5 [0069.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.flac") returned 0 [0069.214] lstrlenA (lpString="*.flac") returned 6 [0069.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.ape") returned 0 [0069.214] lstrlenA (lpString="*.ape") returned 5 [0069.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.wma") returned 0 [0069.214] lstrlenA (lpString="*.wma") returned 5 [0069.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.ac3") returned 0 [0069.214] lstrlenA (lpString="*.ac3") returned 5 [0069.214] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3758f5c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x9b3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216874.WMF", cAlternateFileName="")) returned 1 [0069.214] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.214] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0216874.WMF") returned -1 [0069.214] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0216874.WMF") returned -1 [0069.214] lstrcmpiA (lpString1="", lpString2="J0216874.WMF") returned -1 [0069.214] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF") returned="J0216612.WMF" [0069.214] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.214] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.215] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.215] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.215] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0216874.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" [0069.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF", pszSpec="*.zip") returned 0 [0069.215] lstrlenA (lpString="*.zip") returned 5 [0069.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF", pszSpec="*.rar") returned 0 [0069.215] lstrlenA (lpString="*.rar") returned 5 [0069.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF", pszSpec="*.7z") returned 0 [0069.215] lstrlenA (lpString="*.7z") returned 4 [0069.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF", pszSpec="*.tar") returned 0 [0069.215] lstrlenA (lpString="*.tar") returned 5 [0069.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF", pszSpec="*.gzip") returned 0 [0069.215] lstrlenA (lpString="*.gzip") returned 6 [0069.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF", pszSpec="*.jpg") returned 0 [0069.215] lstrlenA (lpString="*.jpg") returned 5 [0069.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF", pszSpec="*.jpeg") returned 0 [0069.215] lstrlenA (lpString="*.jpeg") returned 6 [0069.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF", pszSpec="*.psd") returned 0 [0069.215] lstrlenA (lpString="*.psd") returned 5 [0069.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF", pszSpec="*.cdr") returned 0 [0069.215] lstrlenA (lpString="*.cdr") returned 5 [0069.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF", pszSpec="*.dwg") returned 0 [0069.215] lstrlenA (lpString="*.dwg") returned 5 [0069.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF", pszSpec="*.max") returned 0 [0069.215] lstrlenA (lpString="*.max") returned 5 [0069.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF", pszSpec="*.bmp") returned 0 [0069.215] lstrlenA (lpString="*.bmp") returned 5 [0069.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF", pszSpec="*.gif") returned 0 [0069.215] lstrlenA (lpString="*.gif") returned 5 [0069.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF", pszSpec="*.png") returned 0 [0069.215] lstrlenA (lpString="*.png") returned 5 [0069.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF", pszSpec="*.doc") returned 0 [0069.216] lstrlenA (lpString="*.doc") returned 5 [0069.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF", pszSpec="*.docx") returned 0 [0069.216] lstrlenA (lpString="*.docx") returned 6 [0069.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF", pszSpec="*.xls") returned 0 [0069.216] lstrlenA (lpString="*.xls") returned 5 [0069.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF", pszSpec="*.xlsx") returned 0 [0069.216] lstrlenA (lpString="*.xlsx") returned 6 [0069.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF", pszSpec="*.ppt") returned 0 [0069.216] lstrlenA (lpString="*.ppt") returned 5 [0069.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF", pszSpec="*.pptx") returned 0 [0069.216] lstrlenA (lpString="*.pptx") returned 6 [0069.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF", pszSpec="*.txt") returned 0 [0069.216] lstrlenA (lpString="*.txt") returned 5 [0069.216] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc375f149, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0217262.WMF", cAlternateFileName="")) returned 1 [0069.216] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.216] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0217262.WMF") returned -1 [0069.216] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0217262.WMF") returned -1 [0069.216] lstrcmpiA (lpString1="", lpString2="J0217262.WMF") returned -1 [0069.216] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF") returned="J0216874.WMF" [0069.216] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.216] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.216] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.216] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.217] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0217262.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" [0069.217] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2c0c27, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0217302.WMF", cAlternateFileName="")) returned 1 [0069.217] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.217] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0217302.WMF") returned -1 [0069.217] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0217302.WMF") returned -1 [0069.217] lstrcmpiA (lpString1="", lpString2="J0217302.WMF") returned -1 [0069.217] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF") returned="J0217262.WMF" [0069.217] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.217] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.217] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.217] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.217] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0217302.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" [0069.217] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2c5acb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1ca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0217872.WMF", cAlternateFileName="")) returned 1 [0069.217] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.217] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0217872.WMF") returned -1 [0069.217] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0217872.WMF") returned -1 [0069.217] lstrcmpiA (lpString1="", lpString2="J0217872.WMF") returned -1 [0069.217] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF") returned="J0217302.WMF" [0069.217] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.217] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.217] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.217] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.217] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0217872.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" [0069.217] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3765292, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8ad6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0227419.JPG", cAlternateFileName="")) returned 1 [0069.218] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.218] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0227419.JPG") returned -1 [0069.218] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0227419.JPG") returned -1 [0069.218] lstrcmpiA (lpString1="", lpString2="J0227419.JPG") returned -1 [0069.218] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF") returned="J0217872.WMF" [0069.218] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.218] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.218] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.218] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.218] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0227419.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" [0069.218] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" [0069.218] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" [0069.218] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG." [0069.218] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.BD" [0069.218] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.221] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8ad6 [0069.222] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc3765292, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.222] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.222] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x8a7a, lpOverlapped=0x0) returned 1 [0069.224] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") returned="J0227419.JPG" [0069.225] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.225] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x8a7a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x8a7a, lpOverlapped=0x0) returned 1 [0069.225] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.225] CloseHandle (hObject=0x1cc) returned 1 [0069.227] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0227419.jpg.bd")) returned 1 [0069.228] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc376c7b4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe2e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0227558.JPG", cAlternateFileName="")) returned 1 [0069.228] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.228] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0227558.JPG") returned -1 [0069.228] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0227558.JPG") returned -1 [0069.228] lstrcmpiA (lpString1="", lpString2="J0227558.JPG") returned -1 [0069.228] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") returned="J0227419.JPG" [0069.228] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.228] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.228] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.228] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.228] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0227558.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" [0069.228] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG", pszSpec="*.zip") returned 0 [0069.228] lstrlenA (lpString="*.zip") returned 5 [0069.228] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG", pszSpec="*.rar") returned 0 [0069.228] lstrlenA (lpString="*.rar") returned 5 [0069.228] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG", pszSpec="*.7z") returned 0 [0069.228] lstrlenA (lpString="*.7z") returned 4 [0069.228] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG", pszSpec="*.tar") returned 0 [0069.228] lstrlenA (lpString="*.tar") returned 5 [0069.228] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG", pszSpec="*.gzip") returned 0 [0069.228] lstrlenA (lpString="*.gzip") returned 6 [0069.228] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG", pszSpec="*.jpg") returned 1 [0069.228] lstrlenA (lpString="*.jpg") returned 5 [0069.229] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" [0069.229] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" [0069.229] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG." [0069.229] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.BD" [0069.229] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.229] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe2e9 [0069.229] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc376c7b4, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.229] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.229] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xe28d, lpOverlapped=0x0) returned 1 [0069.236] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") returned="J0227558.JPG" [0069.238] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.238] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xe28d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xe28d, lpOverlapped=0x0) returned 1 [0069.238] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.238] CloseHandle (hObject=0x1cc) returned 1 [0069.240] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0227558.jpg.bd")) returned 1 [0069.241] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2ca8d3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x65a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0228823.WMF", cAlternateFileName="")) returned 1 [0069.241] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.241] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0228823.WMF") returned -1 [0069.241] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0228823.WMF") returned -1 [0069.241] lstrcmpiA (lpString1="", lpString2="J0228823.WMF") returned -1 [0069.241] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") returned="J0227558.JPG" [0069.241] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.241] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.241] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.241] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.241] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0228823.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" [0069.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.zip") returned 0 [0069.242] lstrlenA (lpString="*.zip") returned 5 [0069.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.rar") returned 0 [0069.242] lstrlenA (lpString="*.rar") returned 5 [0069.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.7z") returned 0 [0069.242] lstrlenA (lpString="*.7z") returned 4 [0069.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.tar") returned 0 [0069.242] lstrlenA (lpString="*.tar") returned 5 [0069.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.gzip") returned 0 [0069.242] lstrlenA (lpString="*.gzip") returned 6 [0069.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.jpg") returned 0 [0069.242] lstrlenA (lpString="*.jpg") returned 5 [0069.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.jpeg") returned 0 [0069.242] lstrlenA (lpString="*.jpeg") returned 6 [0069.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.psd") returned 0 [0069.242] lstrlenA (lpString="*.psd") returned 5 [0069.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.cdr") returned 0 [0069.242] lstrlenA (lpString="*.cdr") returned 5 [0069.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.dwg") returned 0 [0069.242] lstrlenA (lpString="*.dwg") returned 5 [0069.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.max") returned 0 [0069.242] lstrlenA (lpString="*.max") returned 5 [0069.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.bmp") returned 0 [0069.242] lstrlenA (lpString="*.bmp") returned 5 [0069.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.gif") returned 0 [0069.242] lstrlenA (lpString="*.gif") returned 5 [0069.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.png") returned 0 [0069.242] lstrlenA (lpString="*.png") returned 5 [0069.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.doc") returned 0 [0069.242] lstrlenA (lpString="*.doc") returned 5 [0069.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.docx") returned 0 [0069.242] lstrlenA (lpString="*.docx") returned 6 [0069.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.xls") returned 0 [0069.242] lstrlenA (lpString="*.xls") returned 5 [0069.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.xlsx") returned 0 [0069.243] lstrlenA (lpString="*.xlsx") returned 6 [0069.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.ppt") returned 0 [0069.243] lstrlenA (lpString="*.ppt") returned 5 [0069.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.pptx") returned 0 [0069.243] lstrlenA (lpString="*.pptx") returned 6 [0069.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.txt") returned 0 [0069.243] lstrlenA (lpString="*.txt") returned 5 [0069.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.pdf") returned 0 [0069.243] lstrlenA (lpString="*.pdf") returned 5 [0069.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.djvu") returned 0 [0069.243] lstrlenA (lpString="*.djvu") returned 6 [0069.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.htm") returned 0 [0069.243] lstrlenA (lpString="*.htm") returned 5 [0069.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.html") returned 0 [0069.243] lstrlenA (lpString="*.html") returned 6 [0069.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.mdb") returned 0 [0069.243] lstrlenA (lpString="*.mdb") returned 5 [0069.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.cer") returned 0 [0069.243] lstrlenA (lpString="*.cer") returned 5 [0069.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.p12") returned 0 [0069.243] lstrlenA (lpString="*.p12") returned 5 [0069.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.pfx") returned 0 [0069.243] lstrlenA (lpString="*.pfx") returned 5 [0069.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.kwm") returned 0 [0069.244] lstrlenA (lpString="*.kwm") returned 5 [0069.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.pwm") returned 0 [0069.244] lstrlenA (lpString="*.pwm") returned 5 [0069.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.1cd") returned 0 [0069.244] lstrlenA (lpString="*.1cd") returned 5 [0069.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.md") returned 0 [0069.244] lstrlenA (lpString="*.md") returned 4 [0069.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.mdf") returned 0 [0069.244] lstrlenA (lpString="*.mdf") returned 5 [0069.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.dbf") returned 0 [0069.244] lstrlenA (lpString="*.dbf") returned 5 [0069.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.odt") returned 0 [0069.244] lstrlenA (lpString="*.odt") returned 5 [0069.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.vob") returned 0 [0069.244] lstrlenA (lpString="*.vob") returned 5 [0069.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.ifo") returned 0 [0069.244] lstrlenA (lpString="*.ifo") returned 5 [0069.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.lnk") returned 0 [0069.244] lstrlenA (lpString="*.lnk") returned 5 [0069.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.torrent") returned 0 [0069.244] lstrlenA (lpString="*.torrent") returned 9 [0069.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.mov") returned 0 [0069.244] lstrlenA (lpString="*.mov") returned 5 [0069.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.m2v") returned 0 [0069.244] lstrlenA (lpString="*.m2v") returned 5 [0069.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.3gp") returned 0 [0069.244] lstrlenA (lpString="*.3gp") returned 5 [0069.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.mpeg") returned 0 [0069.244] lstrlenA (lpString="*.mpeg") returned 6 [0069.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.mpg") returned 0 [0069.244] lstrlenA (lpString="*.mpg") returned 5 [0069.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.flv") returned 0 [0069.244] lstrlenA (lpString="*.flv") returned 5 [0069.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.avi") returned 0 [0069.244] lstrlenA (lpString="*.avi") returned 5 [0069.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.mp4") returned 0 [0069.245] lstrlenA (lpString="*.mp4") returned 5 [0069.245] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.wmv") returned 0 [0069.245] lstrlenA (lpString="*.wmv") returned 5 [0069.245] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.divx") returned 0 [0069.245] lstrlenA (lpString="*.divx") returned 6 [0069.245] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.mkv") returned 0 [0069.245] lstrlenA (lpString="*.mkv") returned 5 [0069.245] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.mp3") returned 0 [0069.245] lstrlenA (lpString="*.mp3") returned 5 [0069.245] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.wav") returned 0 [0069.245] lstrlenA (lpString="*.wav") returned 5 [0069.245] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.flac") returned 0 [0069.245] lstrlenA (lpString="*.flac") returned 6 [0069.245] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.ape") returned 0 [0069.245] lstrlenA (lpString="*.ape") returned 5 [0069.245] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.wma") returned 0 [0069.245] lstrlenA (lpString="*.wma") returned 5 [0069.245] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.ac3") returned 0 [0069.245] lstrlenA (lpString="*.ac3") returned 5 [0069.245] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2d1ddf, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x918c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0228959.WMF", cAlternateFileName="")) returned 1 [0069.245] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.245] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0228959.WMF") returned -1 [0069.245] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0228959.WMF") returned -1 [0069.245] lstrcmpiA (lpString1="", lpString2="J0228959.WMF") returned -1 [0069.245] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF") returned="J0228823.WMF" [0069.245] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.245] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.245] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.245] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.245] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0228959.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" [0069.246] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.zip") returned 0 [0069.246] lstrlenA (lpString="*.zip") returned 5 [0069.246] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.rar") returned 0 [0069.246] lstrlenA (lpString="*.rar") returned 5 [0069.246] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.7z") returned 0 [0069.246] lstrlenA (lpString="*.7z") returned 4 [0069.246] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.tar") returned 0 [0069.246] lstrlenA (lpString="*.tar") returned 5 [0069.246] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.gzip") returned 0 [0069.246] lstrlenA (lpString="*.gzip") returned 6 [0069.246] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.jpg") returned 0 [0069.246] lstrlenA (lpString="*.jpg") returned 5 [0069.246] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.jpeg") returned 0 [0069.246] lstrlenA (lpString="*.jpeg") returned 6 [0069.246] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.psd") returned 0 [0069.246] lstrlenA (lpString="*.psd") returned 5 [0069.246] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.cdr") returned 0 [0069.246] lstrlenA (lpString="*.cdr") returned 5 [0069.246] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.dwg") returned 0 [0069.246] lstrlenA (lpString="*.dwg") returned 5 [0069.246] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.max") returned 0 [0069.246] lstrlenA (lpString="*.max") returned 5 [0069.246] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.bmp") returned 0 [0069.246] lstrlenA (lpString="*.bmp") returned 5 [0069.246] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.gif") returned 0 [0069.246] lstrlenA (lpString="*.gif") returned 5 [0069.246] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.png") returned 0 [0069.246] lstrlenA (lpString="*.png") returned 5 [0069.246] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.doc") returned 0 [0069.246] lstrlenA (lpString="*.doc") returned 5 [0069.246] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.docx") returned 0 [0069.246] lstrlenA (lpString="*.docx") returned 6 [0069.246] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.xls") returned 0 [0069.247] lstrlenA (lpString="*.xls") returned 5 [0069.247] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.xlsx") returned 0 [0069.247] lstrlenA (lpString="*.xlsx") returned 6 [0069.247] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.ppt") returned 0 [0069.247] lstrlenA (lpString="*.ppt") returned 5 [0069.247] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.pptx") returned 0 [0069.247] lstrlenA (lpString="*.pptx") returned 6 [0069.247] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.txt") returned 0 [0069.247] lstrlenA (lpString="*.txt") returned 5 [0069.247] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.pdf") returned 0 [0069.247] lstrlenA (lpString="*.pdf") returned 5 [0069.247] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.djvu") returned 0 [0069.247] lstrlenA (lpString="*.djvu") returned 6 [0069.247] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.htm") returned 0 [0069.247] lstrlenA (lpString="*.htm") returned 5 [0069.247] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.html") returned 0 [0069.247] lstrlenA (lpString="*.html") returned 6 [0069.247] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.mdb") returned 0 [0069.247] lstrlenA (lpString="*.mdb") returned 5 [0069.247] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.cer") returned 0 [0069.247] lstrlenA (lpString="*.cer") returned 5 [0069.247] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.p12") returned 0 [0069.247] lstrlenA (lpString="*.p12") returned 5 [0069.247] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.pfx") returned 0 [0069.247] lstrlenA (lpString="*.pfx") returned 5 [0069.247] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.kwm") returned 0 [0069.247] lstrlenA (lpString="*.kwm") returned 5 [0069.247] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.pwm") returned 0 [0069.247] lstrlenA (lpString="*.pwm") returned 5 [0069.247] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.1cd") returned 0 [0069.247] lstrlenA (lpString="*.1cd") returned 5 [0069.247] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.md") returned 0 [0069.247] lstrlenA (lpString="*.md") returned 4 [0069.247] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.mdf") returned 0 [0069.247] lstrlenA (lpString="*.mdf") returned 5 [0069.248] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.dbf") returned 0 [0069.248] lstrlenA (lpString="*.dbf") returned 5 [0069.248] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.odt") returned 0 [0069.248] lstrlenA (lpString="*.odt") returned 5 [0069.248] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.vob") returned 0 [0069.248] lstrlenA (lpString="*.vob") returned 5 [0069.248] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.ifo") returned 0 [0069.248] lstrlenA (lpString="*.ifo") returned 5 [0069.248] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.lnk") returned 0 [0069.248] lstrlenA (lpString="*.lnk") returned 5 [0069.248] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.torrent") returned 0 [0069.248] lstrlenA (lpString="*.torrent") returned 9 [0069.248] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.mov") returned 0 [0069.248] lstrlenA (lpString="*.mov") returned 5 [0069.248] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.m2v") returned 0 [0069.248] lstrlenA (lpString="*.m2v") returned 5 [0069.248] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.3gp") returned 0 [0069.248] lstrlenA (lpString="*.3gp") returned 5 [0069.248] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.mpeg") returned 0 [0069.248] lstrlenA (lpString="*.mpeg") returned 6 [0069.248] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.mpg") returned 0 [0069.248] lstrlenA (lpString="*.mpg") returned 5 [0069.248] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.flv") returned 0 [0069.248] lstrlenA (lpString="*.flv") returned 5 [0069.248] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.avi") returned 0 [0069.248] lstrlenA (lpString="*.avi") returned 5 [0069.248] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.mp4") returned 0 [0069.248] lstrlenA (lpString="*.mp4") returned 5 [0069.248] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.wmv") returned 0 [0069.248] lstrlenA (lpString="*.wmv") returned 5 [0069.248] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.divx") returned 0 [0069.248] lstrlenA (lpString="*.divx") returned 6 [0069.248] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.mkv") returned 0 [0069.248] lstrlenA (lpString="*.mkv") returned 5 [0069.248] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.mp3") returned 0 [0069.249] lstrlenA (lpString="*.mp3") returned 5 [0069.249] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.wav") returned 0 [0069.249] lstrlenA (lpString="*.wav") returned 5 [0069.249] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.flac") returned 0 [0069.249] lstrlenA (lpString="*.flac") returned 6 [0069.249] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.ape") returned 0 [0069.249] lstrlenA (lpString="*.ape") returned 5 [0069.249] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.wma") returned 0 [0069.249] lstrlenA (lpString="*.wma") returned 5 [0069.249] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.ac3") returned 0 [0069.249] lstrlenA (lpString="*.ac3") returned 5 [0069.249] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37715d7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1daa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0230553.WMF", cAlternateFileName="")) returned 1 [0069.249] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.249] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0230553.WMF") returned -1 [0069.249] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0230553.WMF") returned -1 [0069.249] lstrcmpiA (lpString1="", lpString2="J0230553.WMF") returned -1 [0069.249] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF") returned="J0228959.WMF" [0069.249] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.249] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.249] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.249] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.249] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0230553.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" [0069.249] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.zip") returned 0 [0069.249] lstrlenA (lpString="*.zip") returned 5 [0069.249] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.rar") returned 0 [0069.249] lstrlenA (lpString="*.rar") returned 5 [0069.249] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.7z") returned 0 [0069.249] lstrlenA (lpString="*.7z") returned 4 [0069.249] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.tar") returned 0 [0069.249] lstrlenA (lpString="*.tar") returned 5 [0069.250] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.gzip") returned 0 [0069.250] lstrlenA (lpString="*.gzip") returned 6 [0069.250] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.jpg") returned 0 [0069.250] lstrlenA (lpString="*.jpg") returned 5 [0069.250] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.jpeg") returned 0 [0069.250] lstrlenA (lpString="*.jpeg") returned 6 [0069.250] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.psd") returned 0 [0069.250] lstrlenA (lpString="*.psd") returned 5 [0069.250] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.cdr") returned 0 [0069.250] lstrlenA (lpString="*.cdr") returned 5 [0069.250] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.dwg") returned 0 [0069.250] lstrlenA (lpString="*.dwg") returned 5 [0069.250] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.max") returned 0 [0069.250] lstrlenA (lpString="*.max") returned 5 [0069.250] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.bmp") returned 0 [0069.250] lstrlenA (lpString="*.bmp") returned 5 [0069.250] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.gif") returned 0 [0069.250] lstrlenA (lpString="*.gif") returned 5 [0069.250] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.png") returned 0 [0069.250] lstrlenA (lpString="*.png") returned 5 [0069.250] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.doc") returned 0 [0069.250] lstrlenA (lpString="*.doc") returned 5 [0069.250] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.docx") returned 0 [0069.250] lstrlenA (lpString="*.docx") returned 6 [0069.250] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.xls") returned 0 [0069.250] lstrlenA (lpString="*.xls") returned 5 [0069.250] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.xlsx") returned 0 [0069.250] lstrlenA (lpString="*.xlsx") returned 6 [0069.250] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.ppt") returned 0 [0069.250] lstrlenA (lpString="*.ppt") returned 5 [0069.250] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.pptx") returned 0 [0069.250] lstrlenA (lpString="*.pptx") returned 6 [0069.250] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.txt") returned 0 [0069.250] lstrlenA (lpString="*.txt") returned 5 [0069.251] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.pdf") returned 0 [0069.251] lstrlenA (lpString="*.pdf") returned 5 [0069.251] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.djvu") returned 0 [0069.251] lstrlenA (lpString="*.djvu") returned 6 [0069.251] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.htm") returned 0 [0069.251] lstrlenA (lpString="*.htm") returned 5 [0069.251] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.html") returned 0 [0069.251] lstrlenA (lpString="*.html") returned 6 [0069.251] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.mdb") returned 0 [0069.251] lstrlenA (lpString="*.mdb") returned 5 [0069.251] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.cer") returned 0 [0069.251] lstrlenA (lpString="*.cer") returned 5 [0069.251] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.p12") returned 0 [0069.251] lstrlenA (lpString="*.p12") returned 5 [0069.251] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.pfx") returned 0 [0069.251] lstrlenA (lpString="*.pfx") returned 5 [0069.251] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.kwm") returned 0 [0069.251] lstrlenA (lpString="*.kwm") returned 5 [0069.251] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.pwm") returned 0 [0069.251] lstrlenA (lpString="*.pwm") returned 5 [0069.251] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.1cd") returned 0 [0069.251] lstrlenA (lpString="*.1cd") returned 5 [0069.251] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.md") returned 0 [0069.251] lstrlenA (lpString="*.md") returned 4 [0069.251] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.mdf") returned 0 [0069.251] lstrlenA (lpString="*.mdf") returned 5 [0069.251] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.dbf") returned 0 [0069.251] lstrlenA (lpString="*.dbf") returned 5 [0069.251] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.odt") returned 0 [0069.251] lstrlenA (lpString="*.odt") returned 5 [0069.251] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.vob") returned 0 [0069.251] lstrlenA (lpString="*.vob") returned 5 [0069.251] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.ifo") returned 0 [0069.251] lstrlenA (lpString="*.ifo") returned 5 [0069.252] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.lnk") returned 0 [0069.252] lstrlenA (lpString="*.lnk") returned 5 [0069.252] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.torrent") returned 0 [0069.252] lstrlenA (lpString="*.torrent") returned 9 [0069.252] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.mov") returned 0 [0069.252] lstrlenA (lpString="*.mov") returned 5 [0069.252] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.m2v") returned 0 [0069.252] lstrlenA (lpString="*.m2v") returned 5 [0069.252] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.3gp") returned 0 [0069.252] lstrlenA (lpString="*.3gp") returned 5 [0069.252] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.mpeg") returned 0 [0069.252] lstrlenA (lpString="*.mpeg") returned 6 [0069.252] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.mpg") returned 0 [0069.252] lstrlenA (lpString="*.mpg") returned 5 [0069.252] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.flv") returned 0 [0069.252] lstrlenA (lpString="*.flv") returned 5 [0069.252] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.avi") returned 0 [0069.252] lstrlenA (lpString="*.avi") returned 5 [0069.252] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.mp4") returned 0 [0069.252] lstrlenA (lpString="*.mp4") returned 5 [0069.252] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.wmv") returned 0 [0069.252] lstrlenA (lpString="*.wmv") returned 5 [0069.252] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.divx") returned 0 [0069.252] lstrlenA (lpString="*.divx") returned 6 [0069.252] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.mkv") returned 0 [0069.252] lstrlenA (lpString="*.mkv") returned 5 [0069.252] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.mp3") returned 0 [0069.252] lstrlenA (lpString="*.mp3") returned 5 [0069.252] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.wav") returned 0 [0069.252] lstrlenA (lpString="*.wav") returned 5 [0069.252] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.flac") returned 0 [0069.252] lstrlenA (lpString="*.flac") returned 6 [0069.252] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.ape") returned 0 [0069.252] lstrlenA (lpString="*.ape") returned 5 [0069.252] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.wma") returned 0 [0069.253] lstrlenA (lpString="*.wma") returned 5 [0069.253] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.ac3") returned 0 [0069.253] lstrlenA (lpString="*.ac3") returned 5 [0069.253] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2d6c18, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1066, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0230558.WMF", cAlternateFileName="")) returned 1 [0069.253] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.253] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0230558.WMF") returned -1 [0069.253] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0230558.WMF") returned -1 [0069.253] lstrcmpiA (lpString1="", lpString2="J0230558.WMF") returned -1 [0069.253] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF") returned="J0230553.WMF" [0069.253] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.253] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.253] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.253] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.253] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0230558.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" [0069.253] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.zip") returned 0 [0069.253] lstrlenA (lpString="*.zip") returned 5 [0069.253] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.rar") returned 0 [0069.253] lstrlenA (lpString="*.rar") returned 5 [0069.253] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.7z") returned 0 [0069.253] lstrlenA (lpString="*.7z") returned 4 [0069.253] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.tar") returned 0 [0069.253] lstrlenA (lpString="*.tar") returned 5 [0069.253] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.gzip") returned 0 [0069.253] lstrlenA (lpString="*.gzip") returned 6 [0069.253] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.jpg") returned 0 [0069.253] lstrlenA (lpString="*.jpg") returned 5 [0069.253] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.jpeg") returned 0 [0069.253] lstrlenA (lpString="*.jpeg") returned 6 [0069.253] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.psd") returned 0 [0069.253] lstrlenA (lpString="*.psd") returned 5 [0069.253] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.cdr") returned 0 [0069.254] lstrlenA (lpString="*.cdr") returned 5 [0069.254] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.dwg") returned 0 [0069.254] lstrlenA (lpString="*.dwg") returned 5 [0069.254] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.max") returned 0 [0069.254] lstrlenA (lpString="*.max") returned 5 [0069.254] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.bmp") returned 0 [0069.254] lstrlenA (lpString="*.bmp") returned 5 [0069.254] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.gif") returned 0 [0069.254] lstrlenA (lpString="*.gif") returned 5 [0069.254] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.png") returned 0 [0069.254] lstrlenA (lpString="*.png") returned 5 [0069.254] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.doc") returned 0 [0069.254] lstrlenA (lpString="*.doc") returned 5 [0069.254] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.docx") returned 0 [0069.254] lstrlenA (lpString="*.docx") returned 6 [0069.254] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.xls") returned 0 [0069.254] lstrlenA (lpString="*.xls") returned 5 [0069.254] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.xlsx") returned 0 [0069.254] lstrlenA (lpString="*.xlsx") returned 6 [0069.254] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.ppt") returned 0 [0069.254] lstrlenA (lpString="*.ppt") returned 5 [0069.254] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.pptx") returned 0 [0069.254] lstrlenA (lpString="*.pptx") returned 6 [0069.254] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.txt") returned 0 [0069.254] lstrlenA (lpString="*.txt") returned 5 [0069.254] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.pdf") returned 0 [0069.254] lstrlenA (lpString="*.pdf") returned 5 [0069.254] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.djvu") returned 0 [0069.254] lstrlenA (lpString="*.djvu") returned 6 [0069.254] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.htm") returned 0 [0069.254] lstrlenA (lpString="*.htm") returned 5 [0069.254] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.html") returned 0 [0069.254] lstrlenA (lpString="*.html") returned 6 [0069.254] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.mdb") returned 0 [0069.254] lstrlenA (lpString="*.mdb") returned 5 [0069.254] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.cer") returned 0 [0069.255] lstrlenA (lpString="*.cer") returned 5 [0069.255] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.p12") returned 0 [0069.255] lstrlenA (lpString="*.p12") returned 5 [0069.255] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.pfx") returned 0 [0069.255] lstrlenA (lpString="*.pfx") returned 5 [0069.255] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.kwm") returned 0 [0069.255] lstrlenA (lpString="*.kwm") returned 5 [0069.255] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.pwm") returned 0 [0069.255] lstrlenA (lpString="*.pwm") returned 5 [0069.255] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.1cd") returned 0 [0069.255] lstrlenA (lpString="*.1cd") returned 5 [0069.255] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.md") returned 0 [0069.255] lstrlenA (lpString="*.md") returned 4 [0069.255] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.mdf") returned 0 [0069.255] lstrlenA (lpString="*.mdf") returned 5 [0069.255] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.dbf") returned 0 [0069.255] lstrlenA (lpString="*.dbf") returned 5 [0069.255] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.odt") returned 0 [0069.255] lstrlenA (lpString="*.odt") returned 5 [0069.255] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.vob") returned 0 [0069.255] lstrlenA (lpString="*.vob") returned 5 [0069.255] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.ifo") returned 0 [0069.255] lstrlenA (lpString="*.ifo") returned 5 [0069.255] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.lnk") returned 0 [0069.255] lstrlenA (lpString="*.lnk") returned 5 [0069.255] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.torrent") returned 0 [0069.255] lstrlenA (lpString="*.torrent") returned 9 [0069.255] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.mov") returned 0 [0069.255] lstrlenA (lpString="*.mov") returned 5 [0069.255] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.m2v") returned 0 [0069.255] lstrlenA (lpString="*.m2v") returned 5 [0069.255] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.3gp") returned 0 [0069.255] lstrlenA (lpString="*.3gp") returned 5 [0069.255] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.mpeg") returned 0 [0069.255] lstrlenA (lpString="*.mpeg") returned 6 [0069.256] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.mpg") returned 0 [0069.256] lstrlenA (lpString="*.mpg") returned 5 [0069.256] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.flv") returned 0 [0069.256] lstrlenA (lpString="*.flv") returned 5 [0069.256] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.avi") returned 0 [0069.256] lstrlenA (lpString="*.avi") returned 5 [0069.256] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.mp4") returned 0 [0069.256] lstrlenA (lpString="*.mp4") returned 5 [0069.256] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.wmv") returned 0 [0069.256] lstrlenA (lpString="*.wmv") returned 5 [0069.256] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.divx") returned 0 [0069.256] lstrlenA (lpString="*.divx") returned 6 [0069.256] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.mkv") returned 0 [0069.256] lstrlenA (lpString="*.mkv") returned 5 [0069.256] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.mp3") returned 0 [0069.256] lstrlenA (lpString="*.mp3") returned 5 [0069.256] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.wav") returned 0 [0069.256] lstrlenA (lpString="*.wav") returned 5 [0069.256] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.flac") returned 0 [0069.256] lstrlenA (lpString="*.flac") returned 6 [0069.256] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.ape") returned 0 [0069.256] lstrlenA (lpString="*.ape") returned 5 [0069.256] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.wma") returned 0 [0069.256] lstrlenA (lpString="*.wma") returned 5 [0069.256] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.ac3") returned 0 [0069.256] lstrlenA (lpString="*.ac3") returned 5 [0069.256] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2dba35, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x332a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0232171.WMF", cAlternateFileName="")) returned 1 [0069.256] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.256] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0232171.WMF") returned -1 [0069.256] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0232171.WMF") returned -1 [0069.256] lstrcmpiA (lpString1="", lpString2="J0232171.WMF") returned -1 [0069.256] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF") returned="J0230558.WMF" [0069.257] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.257] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.257] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.257] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.257] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0232171.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" [0069.257] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF", pszSpec="*.zip") returned 0 [0069.257] lstrlenA (lpString="*.zip") returned 5 [0069.257] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF", pszSpec="*.rar") returned 0 [0069.257] lstrlenA (lpString="*.rar") returned 5 [0069.257] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF", pszSpec="*.7z") returned 0 [0069.257] lstrlenA (lpString="*.7z") returned 4 [0069.257] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF", pszSpec="*.tar") returned 0 [0069.258] lstrlenA (lpString="*.tar") returned 5 [0069.258] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF", pszSpec="*.gzip") returned 0 [0069.258] lstrlenA (lpString="*.gzip") returned 6 [0069.258] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF", pszSpec="*.jpg") returned 0 [0069.258] lstrlenA (lpString="*.jpg") returned 5 [0069.258] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF", pszSpec="*.jpeg") returned 0 [0069.258] lstrlenA (lpString="*.jpeg") returned 6 [0069.258] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF", pszSpec="*.psd") returned 0 [0069.258] lstrlenA (lpString="*.psd") returned 5 [0069.258] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF", pszSpec="*.cdr") returned 0 [0069.258] lstrlenA (lpString="*.cdr") returned 5 [0069.258] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF", pszSpec="*.dwg") returned 0 [0069.258] lstrlenA (lpString="*.dwg") returned 5 [0069.258] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF", pszSpec="*.max") returned 0 [0069.258] lstrlenA (lpString="*.max") returned 5 [0069.258] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF", pszSpec="*.bmp") returned 0 [0069.258] lstrlenA (lpString="*.bmp") returned 5 [0069.258] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF", pszSpec="*.gif") returned 0 [0069.258] lstrlenA (lpString="*.gif") returned 5 [0069.258] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF", pszSpec="*.png") returned 0 [0069.258] lstrlenA (lpString="*.png") returned 5 [0069.258] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF", pszSpec="*.doc") returned 0 [0069.258] lstrlenA (lpString="*.doc") returned 5 [0069.258] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF", pszSpec="*.docx") returned 0 [0069.258] lstrlenA (lpString="*.docx") returned 6 [0069.258] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF", pszSpec="*.xls") returned 0 [0069.258] lstrlenA (lpString="*.xls") returned 5 [0069.258] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF", pszSpec="*.xlsx") returned 0 [0069.258] lstrlenA (lpString="*.xlsx") returned 6 [0069.258] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF", pszSpec="*.ppt") returned 0 [0069.260] lstrlenA (lpString="*.ppt") returned 5 [0069.260] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF", pszSpec="*.pptx") returned 0 [0069.260] lstrlenA (lpString="*.pptx") returned 6 [0069.260] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF", pszSpec="*.txt") returned 0 [0069.260] lstrlenA (lpString="*.txt") returned 5 [0069.261] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2e2f52, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6bc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0232393.WMF", cAlternateFileName="")) returned 1 [0069.261] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.263] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0232393.WMF") returned -1 [0069.263] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0232393.WMF") returned -1 [0069.263] lstrcmpiA (lpString1="", lpString2="J0232393.WMF") returned -1 [0069.263] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF") returned="J0232171.WMF" [0069.263] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.263] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.263] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.263] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.263] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0232393.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" [0069.263] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37777e1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa086, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0232395.WMF", cAlternateFileName="")) returned 1 [0069.263] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.263] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0232395.WMF") returned -1 [0069.263] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0232395.WMF") returned -1 [0069.263] lstrcmpiA (lpString1="", lpString2="J0232395.WMF") returned -1 [0069.263] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF") returned="J0232393.WMF" [0069.263] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.263] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.263] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.263] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.263] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0232395.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" [0069.264] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2e7dcd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x380a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0232795.WMF", cAlternateFileName="")) returned 1 [0069.264] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.264] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0232795.WMF") returned -1 [0069.264] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0232795.WMF") returned -1 [0069.264] lstrcmpiA (lpString1="", lpString2="J0232795.WMF") returned -1 [0069.264] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF") returned="J0232395.WMF" [0069.264] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.264] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.264] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.264] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.265] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0232795.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" [0069.265] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2edfb3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x899c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0232797.WMF", cAlternateFileName="")) returned 1 [0069.265] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.265] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0232797.WMF") returned -1 [0069.265] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0232797.WMF") returned -1 [0069.265] lstrcmpiA (lpString1="", lpString2="J0232797.WMF") returned -1 [0069.265] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF") returned="J0232795.WMF" [0069.265] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.265] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.265] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.265] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.265] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0232797.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" [0069.265] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2f40c4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4de6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0232803.WMF", cAlternateFileName="")) returned 1 [0069.265] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.265] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0232803.WMF") returned -1 [0069.265] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0232803.WMF") returned -1 [0069.265] lstrcmpiA (lpString1="", lpString2="J0232803.WMF") returned -1 [0069.265] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF") returned="J0232797.WMF" [0069.265] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.265] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.265] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.265] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.266] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0232803.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" [0069.266] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc377d997, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x26e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233512.WMF", cAlternateFileName="")) returned 1 [0069.266] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.266] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0233512.WMF") returned -1 [0069.266] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0233512.WMF") returned -1 [0069.266] lstrcmpiA (lpString1="", lpString2="J0233512.WMF") returned -1 [0069.266] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF") returned="J0232803.WMF" [0069.266] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.266] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.266] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.266] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.266] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0233512.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" [0069.266] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3783afd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x312c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233665.WMF", cAlternateFileName="")) returned 1 [0069.266] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.266] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0233665.WMF") returned -1 [0069.266] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0233665.WMF") returned -1 [0069.266] lstrcmpiA (lpString1="", lpString2="J0233665.WMF") returned -1 [0069.266] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF") returned="J0233512.WMF" [0069.266] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.266] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.266] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.266] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.266] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0233665.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" [0069.267] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2fb657, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x975e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233992.WMF", cAlternateFileName="")) returned 1 [0069.267] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.267] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0233992.WMF") returned -1 [0069.267] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0233992.WMF") returned -1 [0069.267] lstrcmpiA (lpString1="", lpString2="J0233992.WMF") returned -1 [0069.267] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF") returned="J0233665.WMF" [0069.267] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.267] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.267] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.267] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.267] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0233992.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" [0069.267] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3789c9e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xcec6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234000.WMF", cAlternateFileName="")) returned 1 [0069.267] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.267] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0234000.WMF") returned -1 [0069.267] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0234000.WMF") returned -1 [0069.267] lstrcmpiA (lpString1="", lpString2="J0234000.WMF") returned -1 [0069.267] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF") returned="J0233992.WMF" [0069.267] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.267] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.267] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.267] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.267] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0234000.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" [0069.267] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc378ea98, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4b40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234001.WMF", cAlternateFileName="")) returned 1 [0069.267] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.267] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0234001.WMF") returned -1 [0069.268] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0234001.WMF") returned -1 [0069.268] lstrcmpiA (lpString1="", lpString2="J0234001.WMF") returned -1 [0069.268] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF") returned="J0234000.WMF" [0069.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.268] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.268] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.268] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.268] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0234001.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" [0069.268] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae302b30, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x80d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234376.WMF", cAlternateFileName="")) returned 1 [0069.268] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.268] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0234376.WMF") returned -1 [0069.268] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0234376.WMF") returned -1 [0069.268] lstrcmpiA (lpString1="", lpString2="J0234376.WMF") returned -1 [0069.268] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF") returned="J0234001.WMF" [0069.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.268] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.268] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.268] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.268] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0234376.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" [0069.268] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae308cd7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xcba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0237225.WMF", cAlternateFileName="")) returned 1 [0069.268] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.268] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0237225.WMF") returned -1 [0069.268] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0237225.WMF") returned -1 [0069.268] lstrcmpiA (lpString1="", lpString2="J0237225.WMF") returned -1 [0069.268] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF") returned="J0234376.WMF" [0069.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.269] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.269] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.269] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.269] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0237225.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" [0069.269] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3794cb8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5700, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0237228.WMF", cAlternateFileName="")) returned 1 [0069.269] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.269] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0237228.WMF") returned -1 [0069.269] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0237228.WMF") returned -1 [0069.269] lstrcmpiA (lpString1="", lpString2="J0237228.WMF") returned -1 [0069.269] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF") returned="J0237225.WMF" [0069.269] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.269] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.269] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.269] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.269] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0237228.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" [0069.269] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae30ee6f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x60c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0237336.WMF", cAlternateFileName="")) returned 1 [0069.269] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.269] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0237336.WMF") returned -1 [0069.269] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0237336.WMF") returned -1 [0069.269] lstrcmpiA (lpString1="", lpString2="J0237336.WMF") returned -1 [0069.269] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF") returned="J0237228.WMF" [0069.269] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.269] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.269] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.269] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.270] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0237336.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" [0069.270] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae315050, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x51be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0237759.WMF", cAlternateFileName="")) returned 1 [0069.270] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.270] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0237759.WMF") returned -1 [0069.270] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0237759.WMF") returned -1 [0069.270] lstrcmpiA (lpString1="", lpString2="J0237759.WMF") returned -1 [0069.270] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF") returned="J0237336.WMF" [0069.270] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.270] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.270] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.270] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.270] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0237759.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" [0069.270] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae31b203, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x59a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0238333.WMF", cAlternateFileName="")) returned 1 [0069.270] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.270] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0238333.WMF") returned -1 [0069.270] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0238333.WMF") returned -1 [0069.270] lstrcmpiA (lpString1="", lpString2="J0238333.WMF") returned -1 [0069.270] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF") returned="J0237759.WMF" [0069.270] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.270] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.270] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.270] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.270] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0238333.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" [0069.271] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae320004, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1334, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0238927.WMF", cAlternateFileName="")) returned 1 [0069.271] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.271] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0238927.WMF") returned -1 [0069.271] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0238927.WMF") returned -1 [0069.271] lstrcmpiA (lpString1="", lpString2="J0238927.WMF") returned -1 [0069.271] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF") returned="J0238333.WMF" [0069.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.271] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.271] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.271] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.271] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0238927.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" [0069.271] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3799af5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1d3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0238959.WMF", cAlternateFileName="")) returned 1 [0069.271] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.271] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0238959.WMF") returned -1 [0069.271] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0238959.WMF") returned -1 [0069.271] lstrcmpiA (lpString1="", lpString2="J0238959.WMF") returned -1 [0069.271] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF") returned="J0238927.WMF" [0069.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.271] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.271] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.271] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.271] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0238959.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" [0069.271] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae324df3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x13b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0238983.WMF", cAlternateFileName="")) returned 1 [0069.272] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.272] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0238983.WMF") returned -1 [0069.272] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0238983.WMF") returned -1 [0069.272] lstrcmpiA (lpString1="", lpString2="J0238983.WMF") returned -1 [0069.272] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF") returned="J0238959.WMF" [0069.272] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.272] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.272] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.272] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.272] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0238983.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" [0069.272] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc379e875, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1284, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239057.WMF", cAlternateFileName="")) returned 1 [0069.272] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.272] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0239057.WMF") returned -1 [0069.272] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0239057.WMF") returned -1 [0069.272] lstrcmpiA (lpString1="", lpString2="J0239057.WMF") returned -1 [0069.272] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF") returned="J0238983.WMF" [0069.272] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.272] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.272] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.272] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.272] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0239057.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" [0069.272] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae329c32, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239063.WMF", cAlternateFileName="")) returned 1 [0069.272] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.272] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0239063.WMF") returned -1 [0069.272] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0239063.WMF") returned -1 [0069.272] lstrcmpiA (lpString1="", lpString2="J0239063.WMF") returned -1 [0069.273] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF") returned="J0239057.WMF" [0069.273] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.273] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.273] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.273] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.273] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0239063.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" [0069.273] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae32fdfd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1294, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239079.WMF", cAlternateFileName="")) returned 1 [0069.273] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.273] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0239079.WMF") returned -1 [0069.273] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0239079.WMF") returned -1 [0069.273] lstrcmpiA (lpString1="", lpString2="J0239079.WMF") returned -1 [0069.273] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF") returned="J0239063.WMF" [0069.273] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.273] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.273] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.273] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.273] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0239079.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" [0069.273] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae334be9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1464, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239191.WMF", cAlternateFileName="")) returned 1 [0069.273] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.273] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0239191.WMF") returned -1 [0069.273] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0239191.WMF") returned -1 [0069.273] lstrcmpiA (lpString1="", lpString2="J0239191.WMF") returned -1 [0069.273] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF") returned="J0239079.WMF" [0069.273] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.273] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.274] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.274] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.274] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0239191.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" [0069.274] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37a4a51, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8424, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239611.WMF", cAlternateFileName="")) returned 1 [0069.274] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.274] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0239611.WMF") returned -1 [0069.274] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0239611.WMF") returned -1 [0069.274] lstrcmpiA (lpString1="", lpString2="J0239611.WMF") returned -1 [0069.274] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF") returned="J0239191.WMF" [0069.274] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.274] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.274] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.274] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.274] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0239611.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" [0069.274] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37a98af, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1314, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239935.WMF", cAlternateFileName="")) returned 1 [0069.274] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.274] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0239935.WMF") returned -1 [0069.275] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0239935.WMF") returned -1 [0069.275] lstrcmpiA (lpString1="", lpString2="J0239935.WMF") returned -1 [0069.275] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF") returned="J0239611.WMF" [0069.275] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.275] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.275] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.275] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.275] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0239935.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" [0069.275] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae339a4f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1418, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239941.WMF", cAlternateFileName="")) returned 1 [0069.275] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.275] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0239941.WMF") returned -1 [0069.275] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0239941.WMF") returned -1 [0069.275] lstrcmpiA (lpString1="", lpString2="J0239941.WMF") returned -1 [0069.275] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF") returned="J0239935.WMF" [0069.275] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.275] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.275] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.275] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.275] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0239941.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" [0069.275] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37ae6b5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1998, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239943.WMF", cAlternateFileName="")) returned 1 [0069.275] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.275] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0239943.WMF") returned -1 [0069.275] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0239943.WMF") returned -1 [0069.275] lstrcmpiA (lpString1="", lpString2="J0239943.WMF") returned -1 [0069.275] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF") returned="J0239941.WMF" [0069.276] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.276] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.276] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.276] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.276] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0239943.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" [0069.276] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae33e7fa, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239951.WMF", cAlternateFileName="")) returned 1 [0069.276] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.276] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0239951.WMF") returned -1 [0069.276] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0239951.WMF") returned -1 [0069.276] lstrcmpiA (lpString1="", lpString2="J0239951.WMF") returned -1 [0069.276] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF") returned="J0239943.WMF" [0069.276] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.276] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.276] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.276] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.276] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0239951.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" [0069.276] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37b482f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1bc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239953.WMF", cAlternateFileName="")) returned 1 [0069.276] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.276] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0239953.WMF") returned -1 [0069.276] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0239953.WMF") returned -1 [0069.276] lstrcmpiA (lpString1="", lpString2="J0239953.WMF") returned -1 [0069.276] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF") returned="J0239951.WMF" [0069.276] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.276] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.277] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.277] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.277] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0239953.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" [0069.277] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37b9663, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1348, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239955.WMF", cAlternateFileName="")) returned 1 [0069.277] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.277] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0239955.WMF") returned -1 [0069.277] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0239955.WMF") returned -1 [0069.277] lstrcmpiA (lpString1="", lpString2="J0239955.WMF") returned -1 [0069.277] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF") returned="J0239953.WMF" [0069.277] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.277] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.277] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.277] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.277] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0239955.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" [0069.277] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae344965, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1720, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239965.WMF", cAlternateFileName="")) returned 1 [0069.277] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.277] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0239965.WMF") returned -1 [0069.277] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0239965.WMF") returned -1 [0069.277] lstrcmpiA (lpString1="", lpString2="J0239965.WMF") returned -1 [0069.277] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF") returned="J0239955.WMF" [0069.277] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.277] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.277] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.277] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.278] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0239965.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" [0069.278] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3497c9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x154c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239967.WMF", cAlternateFileName="")) returned 1 [0069.278] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.278] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0239967.WMF") returned -1 [0069.278] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0239967.WMF") returned -1 [0069.278] lstrcmpiA (lpString1="", lpString2="J0239967.WMF") returned -1 [0069.278] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF") returned="J0239965.WMF" [0069.278] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.278] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.278] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.278] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.278] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0239967.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" [0069.278] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae34d286, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x13e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239973.WMF", cAlternateFileName="")) returned 1 [0069.278] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.278] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0239973.WMF") returned -1 [0069.278] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0239973.WMF") returned -1 [0069.278] lstrcmpiA (lpString1="", lpString2="J0239973.WMF") returned -1 [0069.278] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF") returned="J0239967.WMF" [0069.278] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.278] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.278] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.278] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.278] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0239973.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" [0069.279] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae35475a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239975.WMF", cAlternateFileName="")) returned 1 [0069.279] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.279] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0239975.WMF") returned -1 [0069.279] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0239975.WMF") returned -1 [0069.279] lstrcmpiA (lpString1="", lpString2="J0239975.WMF") returned -1 [0069.279] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF") returned="J0239973.WMF" [0069.279] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.279] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.279] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.279] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.279] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0239975.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" [0069.279] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3596ae, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xcd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239997.WMF", cAlternateFileName="")) returned 1 [0069.279] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.279] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0239997.WMF") returned -1 [0069.279] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0239997.WMF") returned -1 [0069.279] lstrcmpiA (lpString1="", lpString2="J0239997.WMF") returned -1 [0069.279] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF") returned="J0239975.WMF" [0069.279] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.279] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.279] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.279] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.280] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0239997.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" [0069.280] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae360a80, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240157.WMF", cAlternateFileName="")) returned 1 [0069.280] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.280] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0240157.WMF") returned -1 [0069.280] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0240157.WMF") returned -1 [0069.280] lstrcmpiA (lpString1="", lpString2="J0240157.WMF") returned -1 [0069.280] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF") returned="J0239997.WMF" [0069.280] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.280] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.280] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.280] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.280] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0240157.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" [0069.280] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae366ca9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa410, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240175.WMF", cAlternateFileName="")) returned 1 [0069.280] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.280] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0240175.WMF") returned -1 [0069.280] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0240175.WMF") returned -1 [0069.280] lstrcmpiA (lpString1="", lpString2="J0240175.WMF") returned -1 [0069.280] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF") returned="J0240157.WMF" [0069.280] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.280] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.281] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.281] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.281] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0240175.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" [0069.281] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae36baf4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240189.WMF", cAlternateFileName="")) returned 1 [0069.281] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.281] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0240189.WMF") returned -1 [0069.281] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0240189.WMF") returned -1 [0069.281] lstrcmpiA (lpString1="", lpString2="J0240189.WMF") returned -1 [0069.281] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF") returned="J0240175.WMF" [0069.281] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.281] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.281] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.281] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.281] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0240189.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" [0069.281] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37be55d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1476, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240291.WMF", cAlternateFileName="")) returned 1 [0069.281] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.281] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0240291.WMF") returned -1 [0069.281] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0240291.WMF") returned -1 [0069.281] lstrcmpiA (lpString1="", lpString2="J0240291.WMF") returned -1 [0069.281] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF") returned="J0240189.WMF" [0069.281] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.282] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.282] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.282] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.282] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0240291.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" [0069.282] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37c3260, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x92e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0241019.WMF", cAlternateFileName="")) returned 1 [0069.282] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.282] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0241019.WMF") returned -1 [0069.282] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0241019.WMF") returned -1 [0069.282] lstrcmpiA (lpString1="", lpString2="J0241019.WMF") returned -1 [0069.282] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF") returned="J0240291.WMF" [0069.282] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.282] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.282] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.282] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.282] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0241019.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" [0069.282] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37c6d3b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0241037.WMF", cAlternateFileName="")) returned 1 [0069.282] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.282] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0241037.WMF") returned -1 [0069.282] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0241037.WMF") returned -1 [0069.282] lstrcmpiA (lpString1="", lpString2="J0241037.WMF") returned -1 [0069.282] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF") returned="J0241019.WMF" [0069.282] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.282] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.282] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.282] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.283] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0241037.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" [0069.283] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae370c5e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x926, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0241041.WMF", cAlternateFileName="")) returned 1 [0069.283] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.283] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0241041.WMF") returned -1 [0069.283] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0241041.WMF") returned -1 [0069.283] lstrcmpiA (lpString1="", lpString2="J0241041.WMF") returned -1 [0069.283] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF") returned="J0241037.WMF" [0069.283] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.283] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.283] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.283] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.283] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0241041.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" [0069.283] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37cbb10, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xab2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0241043.WMF", cAlternateFileName="")) returned 1 [0069.283] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.283] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0241043.WMF") returned -1 [0069.283] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0241043.WMF") returned -1 [0069.283] lstrcmpiA (lpString1="", lpString2="J0241043.WMF") returned -1 [0069.283] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF") returned="J0241041.WMF" [0069.283] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.283] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.283] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.283] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.283] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0241043.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" [0069.283] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37d1d09, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x82a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0241077.WMF", cAlternateFileName="")) returned 1 [0069.284] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.284] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0241077.WMF") returned -1 [0069.284] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0241077.WMF") returned -1 [0069.284] lstrcmpiA (lpString1="", lpString2="J0241077.WMF") returned -1 [0069.284] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF") returned="J0241043.WMF" [0069.284] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.284] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.284] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.284] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.284] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0241077.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" [0069.284] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae37572e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xcbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0241773.WMF", cAlternateFileName="")) returned 1 [0069.284] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.284] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0241773.WMF") returned -1 [0069.284] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0241773.WMF") returned -1 [0069.284] lstrcmpiA (lpString1="", lpString2="J0241773.WMF") returned -1 [0069.284] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF") returned="J0241077.WMF" [0069.284] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.284] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.284] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.284] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.284] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0241773.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" [0069.284] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37d7e85, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0241781.WMF", cAlternateFileName="")) returned 1 [0069.284] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.284] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0241781.WMF") returned -1 [0069.284] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0241781.WMF") returned -1 [0069.284] lstrcmpiA (lpString1="", lpString2="J0241781.WMF") returned -1 [0069.284] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF") returned="J0241773.WMF" [0069.285] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.285] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.285] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.285] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.285] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0241781.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" [0069.285] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae37b8b0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7938, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0250504.WMF", cAlternateFileName="")) returned 1 [0069.285] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.285] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0250504.WMF") returned -1 [0069.285] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0250504.WMF") returned -1 [0069.285] lstrcmpiA (lpString1="", lpString2="J0250504.WMF") returned -1 [0069.285] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF") returned="J0241781.WMF" [0069.285] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.285] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.285] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.285] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.285] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0250504.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" [0069.285] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae381ae8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6958, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0250997.WMF", cAlternateFileName="")) returned 1 [0069.285] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.285] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0250997.WMF") returned -1 [0069.285] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0250997.WMF") returned -1 [0069.285] lstrcmpiA (lpString1="", lpString2="J0250997.WMF") returned -1 [0069.285] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF") returned="J0250504.WMF" [0069.285] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.285] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.285] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.286] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0250997.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" [0069.286] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae388fb8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1100c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0251007.WMF", cAlternateFileName="")) returned 1 [0069.286] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.286] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0251007.WMF") returned -1 [0069.286] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0251007.WMF") returned -1 [0069.286] lstrcmpiA (lpString1="", lpString2="J0251007.WMF") returned -1 [0069.286] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF") returned="J0250997.WMF" [0069.286] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.286] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.286] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.286] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0251007.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" [0069.286] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae38de29, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xae2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0252629.WMF", cAlternateFileName="")) returned 1 [0069.286] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.286] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0252629.WMF") returned -1 [0069.286] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0252629.WMF") returned -1 [0069.286] lstrcmpiA (lpString1="", lpString2="J0252629.WMF") returned -1 [0069.286] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF") returned="J0251007.WMF" [0069.286] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.286] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.286] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.286] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0252629.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" [0069.286] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37db9a0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xf56, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0252669.WMF", cAlternateFileName="")) returned 1 [0069.287] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.287] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0252669.WMF") returned -1 [0069.287] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0252669.WMF") returned -1 [0069.287] lstrcmpiA (lpString1="", lpString2="J0252669.WMF") returned -1 [0069.287] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF") returned="J0252629.WMF" [0069.287] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.287] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.287] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.287] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0252669.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" [0069.287] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37e07c6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xf6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0278702.WMF", cAlternateFileName="")) returned 1 [0069.287] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.287] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0278702.WMF") returned -1 [0069.287] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0278702.WMF") returned -1 [0069.287] lstrcmpiA (lpString1="", lpString2="J0278702.WMF") returned -1 [0069.287] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF") returned="J0252669.WMF" [0069.287] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.287] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.287] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.287] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0278702.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" [0069.287] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae393ff5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4330, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0279644.WMF", cAlternateFileName="")) returned 1 [0069.287] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.287] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0279644.WMF") returned -1 [0069.287] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0279644.WMF") returned -1 [0069.287] lstrcmpiA (lpString1="", lpString2="J0279644.WMF") returned -1 [0069.287] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF") returned="J0278702.WMF" [0069.287] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.288] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.288] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.288] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0279644.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" [0069.288] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37ea406, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x11dee, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0280468.WMF", cAlternateFileName="")) returned 1 [0069.288] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.288] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0280468.WMF") returned -1 [0069.288] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0280468.WMF") returned -1 [0069.288] lstrcmpiA (lpString1="", lpString2="J0280468.WMF") returned -1 [0069.288] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF") returned="J0279644.WMF" [0069.288] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.288] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.288] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.288] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0280468.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" [0069.288] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae39b541, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x94c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281008.WMF", cAlternateFileName="")) returned 1 [0069.288] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.288] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0281008.WMF") returned -1 [0069.288] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0281008.WMF") returned -1 [0069.288] lstrcmpiA (lpString1="", lpString2="J0281008.WMF") returned -1 [0069.288] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF") returned="J0280468.WMF" [0069.288] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.288] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.288] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.288] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0281008.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" [0069.288] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37f0533, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb5b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281243.WMF", cAlternateFileName="")) returned 1 [0069.289] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.289] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0281243.WMF") returned -1 [0069.289] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0281243.WMF") returned -1 [0069.289] lstrcmpiA (lpString1="", lpString2="J0281243.WMF") returned -1 [0069.289] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF") returned="J0281008.WMF" [0069.289] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.289] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.289] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.290] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0281243.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" [0069.290] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3a1607, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x31dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281630.WMF", cAlternateFileName="")) returned 1 [0069.290] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.290] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0281630.WMF") returned -1 [0069.290] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0281630.WMF") returned -1 [0069.290] lstrcmpiA (lpString1="", lpString2="J0281630.WMF") returned -1 [0069.290] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF") returned="J0281243.WMF" [0069.290] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.290] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.290] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.290] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0281630.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" [0069.290] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3a64c1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3854, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281632.WMF", cAlternateFileName="")) returned 1 [0069.290] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.290] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0281632.WMF") returned -1 [0069.290] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0281632.WMF") returned -1 [0069.291] lstrcmpiA (lpString1="", lpString2="J0281632.WMF") returned -1 [0069.291] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF") returned="J0281630.WMF" [0069.291] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.291] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.291] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.291] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0281632.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" [0069.291] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37f5341, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2e88, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281638.WMF", cAlternateFileName="")) returned 1 [0069.291] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.291] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0281638.WMF") returned -1 [0069.291] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0281638.WMF") returned -1 [0069.291] lstrcmpiA (lpString1="", lpString2="J0281638.WMF") returned -1 [0069.291] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF") returned="J0281632.WMF" [0069.291] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.291] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.291] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.291] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0281638.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" [0069.291] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37fa171, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x30f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281640.WMF", cAlternateFileName="")) returned 1 [0069.291] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.291] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0281640.WMF") returned -1 [0069.291] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0281640.WMF") returned -1 [0069.291] lstrcmpiA (lpString1="", lpString2="J0281640.WMF") returned -1 [0069.291] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF") returned="J0281638.WMF" [0069.291] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.291] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.292] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.292] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0281640.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" [0069.292] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3800601, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3c9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0282126.WMF", cAlternateFileName="")) returned 1 [0069.292] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.292] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0282126.WMF") returned -1 [0069.292] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0282126.WMF") returned -1 [0069.292] lstrcmpiA (lpString1="", lpString2="J0282126.WMF") returned -1 [0069.292] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF") returned="J0281640.WMF" [0069.292] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.292] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.292] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.292] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0282126.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" [0069.292] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38064d9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8166, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0282928.WMF", cAlternateFileName="")) returned 1 [0069.292] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.292] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0282928.WMF") returned -1 [0069.292] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0282928.WMF") returned -1 [0069.292] lstrcmpiA (lpString1="", lpString2="J0282928.WMF") returned -1 [0069.292] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF") returned="J0282126.WMF" [0069.292] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.292] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.292] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.292] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0282928.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" [0069.292] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc380b2e5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3700, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0282932.WMF", cAlternateFileName="")) returned 1 [0069.293] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.293] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0282932.WMF") returned -1 [0069.293] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0282932.WMF") returned -1 [0069.293] lstrcmpiA (lpString1="", lpString2="J0282932.WMF") returned -1 [0069.293] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF") returned="J0282928.WMF" [0069.293] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.293] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.293] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.293] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0282932.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" [0069.293] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc381016d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x388a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285462.WMF", cAlternateFileName="")) returned 1 [0069.293] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.293] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0285462.WMF") returned -1 [0069.293] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0285462.WMF") returned -1 [0069.293] lstrcmpiA (lpString1="", lpString2="J0285462.WMF") returned -1 [0069.293] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF") returned="J0282932.WMF" [0069.293] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.293] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.293] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.293] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0285462.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" [0069.293] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3816309, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2440, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285484.WMF", cAlternateFileName="")) returned 1 [0069.293] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.293] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0285484.WMF") returned -1 [0069.293] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0285484.WMF") returned -1 [0069.293] lstrcmpiA (lpString1="", lpString2="J0285484.WMF") returned -1 [0069.293] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF") returned="J0285462.WMF" [0069.294] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.294] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.294] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.294] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0285484.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" [0069.294] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc381c637, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x795c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285780.WMF", cAlternateFileName="")) returned 1 [0069.294] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.294] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0285780.WMF") returned -1 [0069.294] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0285780.WMF") returned -1 [0069.294] lstrcmpiA (lpString1="", lpString2="J0285780.WMF") returned -1 [0069.294] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF") returned="J0285484.WMF" [0069.294] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.294] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.294] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.294] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0285780.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" [0069.294] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3ab245, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x523e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285782.WMF", cAlternateFileName="")) returned 1 [0069.294] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.294] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0285782.WMF") returned -1 [0069.294] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0285782.WMF") returned -1 [0069.294] lstrcmpiA (lpString1="", lpString2="J0285782.WMF") returned -1 [0069.294] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF") returned="J0285780.WMF" [0069.294] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.294] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.294] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.294] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0285782.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" [0069.295] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc382127d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2eb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285792.WMF", cAlternateFileName="")) returned 1 [0069.295] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.295] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0285792.WMF") returned -1 [0069.295] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0285792.WMF") returned -1 [0069.295] lstrcmpiA (lpString1="", lpString2="J0285792.WMF") returned -1 [0069.295] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF") returned="J0285782.WMF" [0069.295] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.295] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.295] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.295] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0285792.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" [0069.295] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3b008c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3550, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285796.WMF", cAlternateFileName="")) returned 1 [0069.295] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.295] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0285796.WMF") returned -1 [0069.295] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0285796.WMF") returned -1 [0069.295] lstrcmpiA (lpString1="", lpString2="J0285796.WMF") returned -1 [0069.295] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF") returned="J0285792.WMF" [0069.295] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.295] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.295] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.295] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0285796.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" [0069.295] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc382607e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285808.WMF", cAlternateFileName="")) returned 1 [0069.295] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.295] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0285808.WMF") returned -1 [0069.295] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0285808.WMF") returned -1 [0069.295] lstrcmpiA (lpString1="", lpString2="J0285808.WMF") returned -1 [0069.295] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF") returned="J0285796.WMF" [0069.296] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.296] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.296] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.296] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0285808.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" [0069.296] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc382afc9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2210, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285820.WMF", cAlternateFileName="")) returned 1 [0069.298] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.298] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0285820.WMF") returned -1 [0069.298] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0285820.WMF") returned -1 [0069.298] lstrcmpiA (lpString1="", lpString2="J0285820.WMF") returned -1 [0069.298] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF") returned="J0285808.WMF" [0069.298] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.298] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.298] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.299] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0285820.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" [0069.299] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3b62b1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x21a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285822.WMF", cAlternateFileName="")) returned 1 [0069.299] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.299] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0285822.WMF") returned -1 [0069.299] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0285822.WMF") returned -1 [0069.299] lstrcmpiA (lpString1="", lpString2="J0285822.WMF") returned -1 [0069.299] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF") returned="J0285820.WMF" [0069.299] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.299] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.299] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.299] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0285822.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" [0069.299] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38323c6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7898, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287018.WMF", cAlternateFileName="")) returned 1 [0069.299] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.299] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0287018.WMF") returned -1 [0069.299] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0287018.WMF") returned -1 [0069.299] lstrcmpiA (lpString1="", lpString2="J0287018.WMF") returned -1 [0069.299] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF") returned="J0285822.WMF" [0069.299] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.299] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.299] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.299] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0287018.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" [0069.299] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3838588, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x931a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287019.WMF", cAlternateFileName="")) returned 1 [0069.300] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.300] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0287019.WMF") returned -1 [0069.300] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0287019.WMF") returned -1 [0069.300] lstrcmpiA (lpString1="", lpString2="J0287019.WMF") returned -1 [0069.300] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF") returned="J0287018.WMF" [0069.300] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.300] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.300] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.300] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0287019.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" [0069.300] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3bc3e8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x80d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287020.WMF", cAlternateFileName="")) returned 1 [0069.300] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.300] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0287020.WMF") returned -1 [0069.300] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0287020.WMF") returned -1 [0069.300] lstrcmpiA (lpString1="", lpString2="J0287020.WMF") returned -1 [0069.300] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF") returned="J0287019.WMF" [0069.300] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.300] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.300] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.300] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0287020.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" [0069.300] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc383e70a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xc6d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287024.WMF", cAlternateFileName="")) returned 1 [0069.300] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.300] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0287024.WMF") returned -1 [0069.300] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0287024.WMF") returned -1 [0069.300] lstrcmpiA (lpString1="", lpString2="J0287024.WMF") returned -1 [0069.300] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF") returned="J0287020.WMF" [0069.300] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.301] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.301] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.301] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0287024.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" [0069.301] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3c38f2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xcd10, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287408.WMF", cAlternateFileName="")) returned 1 [0069.301] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.301] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0287408.WMF") returned -1 [0069.301] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0287408.WMF") returned -1 [0069.301] lstrcmpiA (lpString1="", lpString2="J0287408.WMF") returned -1 [0069.301] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF") returned="J0287024.WMF" [0069.301] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.301] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.301] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.301] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0287408.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" [0069.301] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3846fbe, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa80c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287415.WMF", cAlternateFileName="")) returned 1 [0069.301] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.301] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0287415.WMF") returned -1 [0069.301] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0287415.WMF") returned -1 [0069.301] lstrcmpiA (lpString1="", lpString2="J0287415.WMF") returned -1 [0069.301] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF") returned="J0287408.WMF" [0069.301] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.301] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.301] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.302] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0287415.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" [0069.302] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc384ea4d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd6bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287417.WMF", cAlternateFileName="")) returned 1 [0069.302] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.302] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF") returned="J0287415.WMF" [0069.302] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.302] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.302] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.302] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0287417.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" [0069.302] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38546b6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x89a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287641.JPG", cAlternateFileName="")) returned 1 [0069.302] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.302] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF") returned="J0287417.WMF" [0069.302] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.302] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.302] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.302] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0287641.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" [0069.302] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG." [0069.302] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.BD" [0069.302] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.306] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x89a4 [0069.306] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc38546b6, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.306] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.306] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x8948, lpOverlapped=0x0) returned 1 [0069.309] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG") returned="J0287641.JPG" [0069.310] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.310] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x8948, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x8948, lpOverlapped=0x0) returned 1 [0069.310] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.311] CloseHandle (hObject=0x1cc) returned 1 [0069.312] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287641.jpg.bd")) returned 1 [0069.313] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3c8727, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x42d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287642.JPG", cAlternateFileName="")) returned 1 [0069.313] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.313] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG") returned="J0287641.JPG" [0069.313] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.313] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.313] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.313] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.313] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0287642.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" [0069.313] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG", pszSpec="*.zip") returned 0 [0069.313] lstrlenA (lpString="*.zip") returned 5 [0069.313] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG", pszSpec="*.rar") returned 0 [0069.314] lstrlenA (lpString="*.rar") returned 5 [0069.314] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG", pszSpec="*.7z") returned 0 [0069.314] lstrlenA (lpString="*.7z") returned 4 [0069.314] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG", pszSpec="*.tar") returned 0 [0069.314] lstrlenA (lpString="*.tar") returned 5 [0069.314] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG", pszSpec="*.gzip") returned 0 [0069.314] lstrlenA (lpString="*.gzip") returned 6 [0069.314] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG", pszSpec="*.jpg") returned 1 [0069.314] lstrlenA (lpString="*.jpg") returned 5 [0069.314] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" [0069.314] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" [0069.314] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG." [0069.314] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.BD" [0069.314] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.316] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42d1 [0069.316] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae3c8727, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.316] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.316] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x4275, lpOverlapped=0x0) returned 1 [0069.321] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG") returned="J0287642.JPG" [0069.322] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.322] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x4275, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x4275, lpOverlapped=0x0) returned 1 [0069.322] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.322] CloseHandle (hObject=0x1cc) returned 1 [0069.324] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287642.jpg.bd")) returned 1 [0069.324] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3cfc2c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3e91, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287643.JPG", cAlternateFileName="")) returned 1 [0069.324] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.324] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0287643.JPG") returned -1 [0069.325] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0287643.JPG") returned -1 [0069.325] lstrcmpiA (lpString1="", lpString2="J0287643.JPG") returned -1 [0069.325] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG") returned="J0287642.JPG" [0069.325] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.325] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.325] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.325] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.325] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0287643.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" [0069.325] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG", pszSpec="*.zip") returned 0 [0069.325] lstrlenA (lpString="*.zip") returned 5 [0069.325] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG", pszSpec="*.rar") returned 0 [0069.325] lstrlenA (lpString="*.rar") returned 5 [0069.325] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG", pszSpec="*.7z") returned 0 [0069.325] lstrlenA (lpString="*.7z") returned 4 [0069.325] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG", pszSpec="*.tar") returned 0 [0069.325] lstrlenA (lpString="*.tar") returned 5 [0069.325] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG", pszSpec="*.gzip") returned 0 [0069.325] lstrlenA (lpString="*.gzip") returned 6 [0069.325] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG", pszSpec="*.jpg") returned 1 [0069.325] lstrlenA (lpString="*.jpg") returned 5 [0069.325] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" [0069.325] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" [0069.325] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG." [0069.325] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.BD" [0069.325] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.326] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e91 [0069.326] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae3cfc2c, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.326] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.326] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x3e35, lpOverlapped=0x0) returned 1 [0069.328] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG") returned="J0287643.JPG" [0069.329] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.329] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x3e35, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x3e35, lpOverlapped=0x0) returned 1 [0069.329] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.329] CloseHandle (hObject=0x1cc) returned 1 [0069.331] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287643.jpg.bd")) returned 1 [0069.332] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3859517, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x43c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287644.JPG", cAlternateFileName="")) returned 1 [0069.332] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.332] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0287644.JPG") returned -1 [0069.332] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0287644.JPG") returned -1 [0069.332] lstrcmpiA (lpString1="", lpString2="J0287644.JPG") returned -1 [0069.332] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG") returned="J0287643.JPG" [0069.332] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.332] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.332] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.332] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.332] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0287644.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" [0069.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG", pszSpec="*.zip") returned 0 [0069.332] lstrlenA (lpString="*.zip") returned 5 [0069.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG", pszSpec="*.rar") returned 0 [0069.332] lstrlenA (lpString="*.rar") returned 5 [0069.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG", pszSpec="*.7z") returned 0 [0069.332] lstrlenA (lpString="*.7z") returned 4 [0069.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG", pszSpec="*.tar") returned 0 [0069.332] lstrlenA (lpString="*.tar") returned 5 [0069.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG", pszSpec="*.gzip") returned 0 [0069.333] lstrlenA (lpString="*.gzip") returned 6 [0069.333] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG", pszSpec="*.jpg") returned 1 [0069.333] lstrlenA (lpString="*.jpg") returned 5 [0069.333] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" [0069.333] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" [0069.333] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG." [0069.333] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.BD" [0069.333] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.333] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43c5 [0069.333] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc3859517, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.333] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.333] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x4369, lpOverlapped=0x0) returned 1 [0069.336] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG") returned="J0287644.JPG" [0069.337] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.337] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x4369, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x4369, lpOverlapped=0x0) returned 1 [0069.337] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.337] CloseHandle (hObject=0x1cc) returned 1 [0069.341] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287644.jpg.bd")) returned 1 [0069.342] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3d5de5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287645.JPG", cAlternateFileName="")) returned 1 [0069.342] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.342] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0287645.JPG") returned -1 [0069.342] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0287645.JPG") returned -1 [0069.342] lstrcmpiA (lpString1="", lpString2="J0287645.JPG") returned -1 [0069.342] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG") returned="J0287644.JPG" [0069.342] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.342] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.342] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.342] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.343] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0287645.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" [0069.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG", pszSpec="*.zip") returned 0 [0069.343] lstrlenA (lpString="*.zip") returned 5 [0069.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG", pszSpec="*.rar") returned 0 [0069.343] lstrlenA (lpString="*.rar") returned 5 [0069.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG", pszSpec="*.7z") returned 0 [0069.343] lstrlenA (lpString="*.7z") returned 4 [0069.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG", pszSpec="*.tar") returned 0 [0069.343] lstrlenA (lpString="*.tar") returned 5 [0069.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG", pszSpec="*.gzip") returned 0 [0069.343] lstrlenA (lpString="*.gzip") returned 6 [0069.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG", pszSpec="*.jpg") returned 1 [0069.343] lstrlenA (lpString="*.jpg") returned 5 [0069.343] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" [0069.343] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" [0069.343] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG." [0069.343] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.BD" [0069.343] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.343] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8d86 [0069.343] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae3d5de5, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.343] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.343] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x8d2a, lpOverlapped=0x0) returned 1 [0069.353] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG") returned="J0287645.JPG" [0069.354] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.354] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x8d2a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x8d2a, lpOverlapped=0x0) returned 1 [0069.354] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.354] CloseHandle (hObject=0x1cc) returned 1 [0069.356] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287645.jpg.bd")) returned 1 [0069.357] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3dac46, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2d21, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0289430.JPG", cAlternateFileName="")) returned 1 [0069.357] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.357] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0289430.JPG") returned -1 [0069.357] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0289430.JPG") returned -1 [0069.357] lstrcmpiA (lpString1="", lpString2="J0289430.JPG") returned -1 [0069.357] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG") returned="J0287645.JPG" [0069.357] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.357] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.357] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.357] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.357] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0289430.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" [0069.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG", pszSpec="*.zip") returned 0 [0069.357] lstrlenA (lpString="*.zip") returned 5 [0069.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG", pszSpec="*.rar") returned 0 [0069.357] lstrlenA (lpString="*.rar") returned 5 [0069.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG", pszSpec="*.7z") returned 0 [0069.357] lstrlenA (lpString="*.7z") returned 4 [0069.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG", pszSpec="*.tar") returned 0 [0069.357] lstrlenA (lpString="*.tar") returned 5 [0069.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG", pszSpec="*.gzip") returned 0 [0069.357] lstrlenA (lpString="*.gzip") returned 6 [0069.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG", pszSpec="*.jpg") returned 1 [0069.358] lstrlenA (lpString="*.jpg") returned 5 [0069.358] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" [0069.358] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" [0069.358] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG." [0069.358] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.BD" [0069.358] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.358] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d21 [0069.358] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae3dac46, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.358] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.358] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x2cc5, lpOverlapped=0x0) returned 1 [0069.360] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG") returned="J0289430.JPG" [0069.360] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.360] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x2cc5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x2cc5, lpOverlapped=0x0) returned 1 [0069.360] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.360] CloseHandle (hObject=0x1cc) returned 1 [0069.361] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0289430.jpg.bd")) returned 1 [0069.362] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3dfa49, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x9e8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0290548.WMF", cAlternateFileName="")) returned 1 [0069.362] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.362] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0290548.WMF") returned -1 [0069.362] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0290548.WMF") returned -1 [0069.362] lstrcmpiA (lpString1="", lpString2="J0290548.WMF") returned -1 [0069.362] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG") returned="J0289430.JPG" [0069.362] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.362] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.362] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.362] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.362] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0290548.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" [0069.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.zip") returned 0 [0069.362] lstrlenA (lpString="*.zip") returned 5 [0069.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.rar") returned 0 [0069.363] lstrlenA (lpString="*.rar") returned 5 [0069.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.7z") returned 0 [0069.363] lstrlenA (lpString="*.7z") returned 4 [0069.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.tar") returned 0 [0069.363] lstrlenA (lpString="*.tar") returned 5 [0069.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.gzip") returned 0 [0069.363] lstrlenA (lpString="*.gzip") returned 6 [0069.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.jpg") returned 0 [0069.363] lstrlenA (lpString="*.jpg") returned 5 [0069.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.jpeg") returned 0 [0069.363] lstrlenA (lpString="*.jpeg") returned 6 [0069.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.psd") returned 0 [0069.363] lstrlenA (lpString="*.psd") returned 5 [0069.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.cdr") returned 0 [0069.363] lstrlenA (lpString="*.cdr") returned 5 [0069.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.dwg") returned 0 [0069.363] lstrlenA (lpString="*.dwg") returned 5 [0069.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.max") returned 0 [0069.363] lstrlenA (lpString="*.max") returned 5 [0069.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.bmp") returned 0 [0069.363] lstrlenA (lpString="*.bmp") returned 5 [0069.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.gif") returned 0 [0069.363] lstrlenA (lpString="*.gif") returned 5 [0069.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.png") returned 0 [0069.363] lstrlenA (lpString="*.png") returned 5 [0069.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.doc") returned 0 [0069.363] lstrlenA (lpString="*.doc") returned 5 [0069.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.docx") returned 0 [0069.363] lstrlenA (lpString="*.docx") returned 6 [0069.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.xls") returned 0 [0069.363] lstrlenA (lpString="*.xls") returned 5 [0069.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.xlsx") returned 0 [0069.363] lstrlenA (lpString="*.xlsx") returned 6 [0069.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.ppt") returned 0 [0069.364] lstrlenA (lpString="*.ppt") returned 5 [0069.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.pptx") returned 0 [0069.364] lstrlenA (lpString="*.pptx") returned 6 [0069.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.txt") returned 0 [0069.364] lstrlenA (lpString="*.txt") returned 5 [0069.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.pdf") returned 0 [0069.364] lstrlenA (lpString="*.pdf") returned 5 [0069.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.djvu") returned 0 [0069.364] lstrlenA (lpString="*.djvu") returned 6 [0069.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.htm") returned 0 [0069.364] lstrlenA (lpString="*.htm") returned 5 [0069.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.html") returned 0 [0069.364] lstrlenA (lpString="*.html") returned 6 [0069.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.mdb") returned 0 [0069.364] lstrlenA (lpString="*.mdb") returned 5 [0069.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.cer") returned 0 [0069.364] lstrlenA (lpString="*.cer") returned 5 [0069.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.p12") returned 0 [0069.364] lstrlenA (lpString="*.p12") returned 5 [0069.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.pfx") returned 0 [0069.364] lstrlenA (lpString="*.pfx") returned 5 [0069.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.kwm") returned 0 [0069.364] lstrlenA (lpString="*.kwm") returned 5 [0069.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.pwm") returned 0 [0069.364] lstrlenA (lpString="*.pwm") returned 5 [0069.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.1cd") returned 0 [0069.364] lstrlenA (lpString="*.1cd") returned 5 [0069.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.md") returned 0 [0069.364] lstrlenA (lpString="*.md") returned 4 [0069.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.mdf") returned 0 [0069.364] lstrlenA (lpString="*.mdf") returned 5 [0069.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.dbf") returned 0 [0069.364] lstrlenA (lpString="*.dbf") returned 5 [0069.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.odt") returned 0 [0069.364] lstrlenA (lpString="*.odt") returned 5 [0069.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.vob") returned 0 [0069.365] lstrlenA (lpString="*.vob") returned 5 [0069.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.ifo") returned 0 [0069.365] lstrlenA (lpString="*.ifo") returned 5 [0069.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.lnk") returned 0 [0069.365] lstrlenA (lpString="*.lnk") returned 5 [0069.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.torrent") returned 0 [0069.365] lstrlenA (lpString="*.torrent") returned 9 [0069.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.mov") returned 0 [0069.365] lstrlenA (lpString="*.mov") returned 5 [0069.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.m2v") returned 0 [0069.365] lstrlenA (lpString="*.m2v") returned 5 [0069.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.3gp") returned 0 [0069.365] lstrlenA (lpString="*.3gp") returned 5 [0069.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.mpeg") returned 0 [0069.365] lstrlenA (lpString="*.mpeg") returned 6 [0069.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.mpg") returned 0 [0069.365] lstrlenA (lpString="*.mpg") returned 5 [0069.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.flv") returned 0 [0069.365] lstrlenA (lpString="*.flv") returned 5 [0069.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.avi") returned 0 [0069.365] lstrlenA (lpString="*.avi") returned 5 [0069.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.mp4") returned 0 [0069.365] lstrlenA (lpString="*.mp4") returned 5 [0069.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.wmv") returned 0 [0069.365] lstrlenA (lpString="*.wmv") returned 5 [0069.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.divx") returned 0 [0069.365] lstrlenA (lpString="*.divx") returned 6 [0069.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.mkv") returned 0 [0069.365] lstrlenA (lpString="*.mkv") returned 5 [0069.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.mp3") returned 0 [0069.365] lstrlenA (lpString="*.mp3") returned 5 [0069.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.wav") returned 0 [0069.365] lstrlenA (lpString="*.wav") returned 5 [0069.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.flac") returned 0 [0069.366] lstrlenA (lpString="*.flac") returned 6 [0069.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.ape") returned 0 [0069.366] lstrlenA (lpString="*.ape") returned 5 [0069.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.wma") returned 0 [0069.366] lstrlenA (lpString="*.wma") returned 5 [0069.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.ac3") returned 0 [0069.366] lstrlenA (lpString="*.ac3") returned 5 [0069.366] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3e6f8d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2590, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0291794.WMF", cAlternateFileName="")) returned 1 [0069.366] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.366] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0291794.WMF") returned -1 [0069.366] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0291794.WMF") returned -1 [0069.366] lstrcmpiA (lpString1="", lpString2="J0291794.WMF") returned -1 [0069.366] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF") returned="J0290548.WMF" [0069.366] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.366] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.366] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.366] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.366] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0291794.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" [0069.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.zip") returned 0 [0069.366] lstrlenA (lpString="*.zip") returned 5 [0069.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.rar") returned 0 [0069.366] lstrlenA (lpString="*.rar") returned 5 [0069.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.7z") returned 0 [0069.366] lstrlenA (lpString="*.7z") returned 4 [0069.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.tar") returned 0 [0069.366] lstrlenA (lpString="*.tar") returned 5 [0069.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.gzip") returned 0 [0069.366] lstrlenA (lpString="*.gzip") returned 6 [0069.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.jpg") returned 0 [0069.366] lstrlenA (lpString="*.jpg") returned 5 [0069.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.jpeg") returned 0 [0069.367] lstrlenA (lpString="*.jpeg") returned 6 [0069.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.psd") returned 0 [0069.367] lstrlenA (lpString="*.psd") returned 5 [0069.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.cdr") returned 0 [0069.367] lstrlenA (lpString="*.cdr") returned 5 [0069.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.dwg") returned 0 [0069.367] lstrlenA (lpString="*.dwg") returned 5 [0069.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.max") returned 0 [0069.367] lstrlenA (lpString="*.max") returned 5 [0069.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.bmp") returned 0 [0069.367] lstrlenA (lpString="*.bmp") returned 5 [0069.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.gif") returned 0 [0069.367] lstrlenA (lpString="*.gif") returned 5 [0069.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.png") returned 0 [0069.367] lstrlenA (lpString="*.png") returned 5 [0069.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.doc") returned 0 [0069.367] lstrlenA (lpString="*.doc") returned 5 [0069.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.docx") returned 0 [0069.367] lstrlenA (lpString="*.docx") returned 6 [0069.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.xls") returned 0 [0069.367] lstrlenA (lpString="*.xls") returned 5 [0069.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.xlsx") returned 0 [0069.367] lstrlenA (lpString="*.xlsx") returned 6 [0069.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.ppt") returned 0 [0069.367] lstrlenA (lpString="*.ppt") returned 5 [0069.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.pptx") returned 0 [0069.367] lstrlenA (lpString="*.pptx") returned 6 [0069.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.txt") returned 0 [0069.367] lstrlenA (lpString="*.txt") returned 5 [0069.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.pdf") returned 0 [0069.367] lstrlenA (lpString="*.pdf") returned 5 [0069.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.djvu") returned 0 [0069.367] lstrlenA (lpString="*.djvu") returned 6 [0069.368] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.htm") returned 0 [0069.368] lstrlenA (lpString="*.htm") returned 5 [0069.368] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.html") returned 0 [0069.368] lstrlenA (lpString="*.html") returned 6 [0069.368] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.mdb") returned 0 [0069.368] lstrlenA (lpString="*.mdb") returned 5 [0069.368] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.cer") returned 0 [0069.368] lstrlenA (lpString="*.cer") returned 5 [0069.368] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.p12") returned 0 [0069.368] lstrlenA (lpString="*.p12") returned 5 [0069.368] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.pfx") returned 0 [0069.368] lstrlenA (lpString="*.pfx") returned 5 [0069.368] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.kwm") returned 0 [0069.368] lstrlenA (lpString="*.kwm") returned 5 [0069.368] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.pwm") returned 0 [0069.368] lstrlenA (lpString="*.pwm") returned 5 [0069.368] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.1cd") returned 0 [0069.368] lstrlenA (lpString="*.1cd") returned 5 [0069.368] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.md") returned 0 [0069.368] lstrlenA (lpString="*.md") returned 4 [0069.368] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.mdf") returned 0 [0069.368] lstrlenA (lpString="*.mdf") returned 5 [0069.368] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.dbf") returned 0 [0069.369] lstrlenA (lpString="*.dbf") returned 5 [0069.369] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.odt") returned 0 [0069.369] lstrlenA (lpString="*.odt") returned 5 [0069.369] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.vob") returned 0 [0069.369] lstrlenA (lpString="*.vob") returned 5 [0069.369] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.ifo") returned 0 [0069.369] lstrlenA (lpString="*.ifo") returned 5 [0069.369] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.lnk") returned 0 [0069.369] lstrlenA (lpString="*.lnk") returned 5 [0069.369] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.torrent") returned 0 [0069.369] lstrlenA (lpString="*.torrent") returned 9 [0069.369] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.mov") returned 0 [0069.369] lstrlenA (lpString="*.mov") returned 5 [0069.369] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.m2v") returned 0 [0069.369] lstrlenA (lpString="*.m2v") returned 5 [0069.369] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.3gp") returned 0 [0069.369] lstrlenA (lpString="*.3gp") returned 5 [0069.369] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.mpeg") returned 0 [0069.369] lstrlenA (lpString="*.mpeg") returned 6 [0069.369] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.mpg") returned 0 [0069.369] lstrlenA (lpString="*.mpg") returned 5 [0069.369] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.flv") returned 0 [0069.369] lstrlenA (lpString="*.flv") returned 5 [0069.369] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.avi") returned 0 [0069.369] lstrlenA (lpString="*.avi") returned 5 [0069.369] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.mp4") returned 0 [0069.369] lstrlenA (lpString="*.mp4") returned 5 [0069.369] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.wmv") returned 0 [0069.369] lstrlenA (lpString="*.wmv") returned 5 [0069.369] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.divx") returned 0 [0069.369] lstrlenA (lpString="*.divx") returned 6 [0069.369] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.mkv") returned 0 [0069.369] lstrlenA (lpString="*.mkv") returned 5 [0069.369] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.mp3") returned 0 [0069.369] lstrlenA (lpString="*.mp3") returned 5 [0069.370] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.wav") returned 0 [0069.370] lstrlenA (lpString="*.wav") returned 5 [0069.370] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.flac") returned 0 [0069.370] lstrlenA (lpString="*.flac") returned 6 [0069.370] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.ape") returned 0 [0069.370] lstrlenA (lpString="*.ape") returned 5 [0069.370] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.wma") returned 0 [0069.370] lstrlenA (lpString="*.wma") returned 5 [0069.370] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.ac3") returned 0 [0069.370] lstrlenA (lpString="*.ac3") returned 5 [0069.370] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc385f6e4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x20e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292248.WMF", cAlternateFileName="")) returned 1 [0069.370] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.370] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0292248.WMF") returned -1 [0069.370] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0292248.WMF") returned -1 [0069.370] lstrcmpiA (lpString1="", lpString2="J0292248.WMF") returned -1 [0069.370] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF") returned="J0291794.WMF" [0069.370] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.370] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.370] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.370] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.370] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0292248.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" [0069.370] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.zip") returned 0 [0069.370] lstrlenA (lpString="*.zip") returned 5 [0069.370] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.rar") returned 0 [0069.370] lstrlenA (lpString="*.rar") returned 5 [0069.370] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.7z") returned 0 [0069.370] lstrlenA (lpString="*.7z") returned 4 [0069.370] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.tar") returned 0 [0069.370] lstrlenA (lpString="*.tar") returned 5 [0069.370] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.gzip") returned 0 [0069.371] lstrlenA (lpString="*.gzip") returned 6 [0069.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.jpg") returned 0 [0069.371] lstrlenA (lpString="*.jpg") returned 5 [0069.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.jpeg") returned 0 [0069.371] lstrlenA (lpString="*.jpeg") returned 6 [0069.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.psd") returned 0 [0069.371] lstrlenA (lpString="*.psd") returned 5 [0069.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.cdr") returned 0 [0069.371] lstrlenA (lpString="*.cdr") returned 5 [0069.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.dwg") returned 0 [0069.371] lstrlenA (lpString="*.dwg") returned 5 [0069.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.max") returned 0 [0069.371] lstrlenA (lpString="*.max") returned 5 [0069.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.bmp") returned 0 [0069.371] lstrlenA (lpString="*.bmp") returned 5 [0069.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.gif") returned 0 [0069.371] lstrlenA (lpString="*.gif") returned 5 [0069.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.png") returned 0 [0069.371] lstrlenA (lpString="*.png") returned 5 [0069.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.doc") returned 0 [0069.371] lstrlenA (lpString="*.doc") returned 5 [0069.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.docx") returned 0 [0069.371] lstrlenA (lpString="*.docx") returned 6 [0069.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.xls") returned 0 [0069.371] lstrlenA (lpString="*.xls") returned 5 [0069.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.xlsx") returned 0 [0069.371] lstrlenA (lpString="*.xlsx") returned 6 [0069.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.ppt") returned 0 [0069.371] lstrlenA (lpString="*.ppt") returned 5 [0069.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.pptx") returned 0 [0069.371] lstrlenA (lpString="*.pptx") returned 6 [0069.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.txt") returned 0 [0069.371] lstrlenA (lpString="*.txt") returned 5 [0069.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.pdf") returned 0 [0069.371] lstrlenA (lpString="*.pdf") returned 5 [0069.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.djvu") returned 0 [0069.372] lstrlenA (lpString="*.djvu") returned 6 [0069.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.htm") returned 0 [0069.372] lstrlenA (lpString="*.htm") returned 5 [0069.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.html") returned 0 [0069.372] lstrlenA (lpString="*.html") returned 6 [0069.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.mdb") returned 0 [0069.372] lstrlenA (lpString="*.mdb") returned 5 [0069.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.cer") returned 0 [0069.372] lstrlenA (lpString="*.cer") returned 5 [0069.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.p12") returned 0 [0069.372] lstrlenA (lpString="*.p12") returned 5 [0069.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.pfx") returned 0 [0069.372] lstrlenA (lpString="*.pfx") returned 5 [0069.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.kwm") returned 0 [0069.372] lstrlenA (lpString="*.kwm") returned 5 [0069.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.pwm") returned 0 [0069.372] lstrlenA (lpString="*.pwm") returned 5 [0069.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.1cd") returned 0 [0069.372] lstrlenA (lpString="*.1cd") returned 5 [0069.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.md") returned 0 [0069.372] lstrlenA (lpString="*.md") returned 4 [0069.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.mdf") returned 0 [0069.372] lstrlenA (lpString="*.mdf") returned 5 [0069.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.dbf") returned 0 [0069.372] lstrlenA (lpString="*.dbf") returned 5 [0069.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.odt") returned 0 [0069.372] lstrlenA (lpString="*.odt") returned 5 [0069.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.vob") returned 0 [0069.372] lstrlenA (lpString="*.vob") returned 5 [0069.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.ifo") returned 0 [0069.372] lstrlenA (lpString="*.ifo") returned 5 [0069.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.lnk") returned 0 [0069.373] lstrlenA (lpString="*.lnk") returned 5 [0069.373] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.torrent") returned 0 [0069.373] lstrlenA (lpString="*.torrent") returned 9 [0069.373] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.mov") returned 0 [0069.373] lstrlenA (lpString="*.mov") returned 5 [0069.373] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.m2v") returned 0 [0069.373] lstrlenA (lpString="*.m2v") returned 5 [0069.373] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.3gp") returned 0 [0069.373] lstrlenA (lpString="*.3gp") returned 5 [0069.373] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.mpeg") returned 0 [0069.373] lstrlenA (lpString="*.mpeg") returned 6 [0069.373] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.mpg") returned 0 [0069.373] lstrlenA (lpString="*.mpg") returned 5 [0069.373] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.flv") returned 0 [0069.373] lstrlenA (lpString="*.flv") returned 5 [0069.373] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.avi") returned 0 [0069.373] lstrlenA (lpString="*.avi") returned 5 [0069.373] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.mp4") returned 0 [0069.373] lstrlenA (lpString="*.mp4") returned 5 [0069.373] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.wmv") returned 0 [0069.373] lstrlenA (lpString="*.wmv") returned 5 [0069.373] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.divx") returned 0 [0069.373] lstrlenA (lpString="*.divx") returned 6 [0069.373] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.mkv") returned 0 [0069.373] lstrlenA (lpString="*.mkv") returned 5 [0069.373] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.mp3") returned 0 [0069.373] lstrlenA (lpString="*.mp3") returned 5 [0069.373] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.wav") returned 0 [0069.373] lstrlenA (lpString="*.wav") returned 5 [0069.373] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.flac") returned 0 [0069.373] lstrlenA (lpString="*.flac") returned 6 [0069.373] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.ape") returned 0 [0069.373] lstrlenA (lpString="*.ape") returned 5 [0069.374] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.wma") returned 0 [0069.374] lstrlenA (lpString="*.wma") returned 5 [0069.374] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.ac3") returned 0 [0069.374] lstrlenA (lpString="*.ac3") returned 5 [0069.374] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3ebe3b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7aa6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292270.WMF", cAlternateFileName="")) returned 1 [0069.374] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.374] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0292270.WMF") returned -1 [0069.374] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0292270.WMF") returned -1 [0069.374] lstrcmpiA (lpString1="", lpString2="J0292270.WMF") returned -1 [0069.374] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF") returned="J0292248.WMF" [0069.374] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.374] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.374] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.374] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.374] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0292270.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" [0069.374] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.zip") returned 0 [0069.374] lstrlenA (lpString="*.zip") returned 5 [0069.374] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.rar") returned 0 [0069.374] lstrlenA (lpString="*.rar") returned 5 [0069.374] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.7z") returned 0 [0069.374] lstrlenA (lpString="*.7z") returned 4 [0069.374] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.tar") returned 0 [0069.374] lstrlenA (lpString="*.tar") returned 5 [0069.374] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.gzip") returned 0 [0069.374] lstrlenA (lpString="*.gzip") returned 6 [0069.374] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.jpg") returned 0 [0069.374] lstrlenA (lpString="*.jpg") returned 5 [0069.374] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.jpeg") returned 0 [0069.374] lstrlenA (lpString="*.jpeg") returned 6 [0069.374] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.psd") returned 0 [0069.375] lstrlenA (lpString="*.psd") returned 5 [0069.375] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.cdr") returned 0 [0069.375] lstrlenA (lpString="*.cdr") returned 5 [0069.375] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.dwg") returned 0 [0069.375] lstrlenA (lpString="*.dwg") returned 5 [0069.375] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.max") returned 0 [0069.375] lstrlenA (lpString="*.max") returned 5 [0069.375] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.bmp") returned 0 [0069.375] lstrlenA (lpString="*.bmp") returned 5 [0069.375] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.gif") returned 0 [0069.375] lstrlenA (lpString="*.gif") returned 5 [0069.375] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.png") returned 0 [0069.375] lstrlenA (lpString="*.png") returned 5 [0069.375] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.doc") returned 0 [0069.375] lstrlenA (lpString="*.doc") returned 5 [0069.375] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.docx") returned 0 [0069.375] lstrlenA (lpString="*.docx") returned 6 [0069.375] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.xls") returned 0 [0069.375] lstrlenA (lpString="*.xls") returned 5 [0069.375] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.xlsx") returned 0 [0069.375] lstrlenA (lpString="*.xlsx") returned 6 [0069.375] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.ppt") returned 0 [0069.375] lstrlenA (lpString="*.ppt") returned 5 [0069.375] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.pptx") returned 0 [0069.375] lstrlenA (lpString="*.pptx") returned 6 [0069.375] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.txt") returned 0 [0069.375] lstrlenA (lpString="*.txt") returned 5 [0069.375] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.pdf") returned 0 [0069.375] lstrlenA (lpString="*.pdf") returned 5 [0069.375] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.djvu") returned 0 [0069.375] lstrlenA (lpString="*.djvu") returned 6 [0069.375] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.htm") returned 0 [0069.375] lstrlenA (lpString="*.htm") returned 5 [0069.375] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.html") returned 0 [0069.376] lstrlenA (lpString="*.html") returned 6 [0069.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.mdb") returned 0 [0069.376] lstrlenA (lpString="*.mdb") returned 5 [0069.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.cer") returned 0 [0069.376] lstrlenA (lpString="*.cer") returned 5 [0069.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.p12") returned 0 [0069.376] lstrlenA (lpString="*.p12") returned 5 [0069.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.pfx") returned 0 [0069.376] lstrlenA (lpString="*.pfx") returned 5 [0069.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.kwm") returned 0 [0069.376] lstrlenA (lpString="*.kwm") returned 5 [0069.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.pwm") returned 0 [0069.376] lstrlenA (lpString="*.pwm") returned 5 [0069.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.1cd") returned 0 [0069.376] lstrlenA (lpString="*.1cd") returned 5 [0069.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.md") returned 0 [0069.376] lstrlenA (lpString="*.md") returned 4 [0069.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.mdf") returned 0 [0069.376] lstrlenA (lpString="*.mdf") returned 5 [0069.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.dbf") returned 0 [0069.376] lstrlenA (lpString="*.dbf") returned 5 [0069.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.odt") returned 0 [0069.376] lstrlenA (lpString="*.odt") returned 5 [0069.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.vob") returned 0 [0069.376] lstrlenA (lpString="*.vob") returned 5 [0069.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.ifo") returned 0 [0069.376] lstrlenA (lpString="*.ifo") returned 5 [0069.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.lnk") returned 0 [0069.376] lstrlenA (lpString="*.lnk") returned 5 [0069.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.torrent") returned 0 [0069.376] lstrlenA (lpString="*.torrent") returned 9 [0069.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.mov") returned 0 [0069.376] lstrlenA (lpString="*.mov") returned 5 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.m2v") returned 0 [0069.377] lstrlenA (lpString="*.m2v") returned 5 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.3gp") returned 0 [0069.377] lstrlenA (lpString="*.3gp") returned 5 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.mpeg") returned 0 [0069.377] lstrlenA (lpString="*.mpeg") returned 6 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.mpg") returned 0 [0069.377] lstrlenA (lpString="*.mpg") returned 5 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.flv") returned 0 [0069.377] lstrlenA (lpString="*.flv") returned 5 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.avi") returned 0 [0069.377] lstrlenA (lpString="*.avi") returned 5 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.mp4") returned 0 [0069.377] lstrlenA (lpString="*.mp4") returned 5 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.wmv") returned 0 [0069.377] lstrlenA (lpString="*.wmv") returned 5 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.divx") returned 0 [0069.377] lstrlenA (lpString="*.divx") returned 6 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.mkv") returned 0 [0069.377] lstrlenA (lpString="*.mkv") returned 5 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.mp3") returned 0 [0069.377] lstrlenA (lpString="*.mp3") returned 5 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.wav") returned 0 [0069.377] lstrlenA (lpString="*.wav") returned 5 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.flac") returned 0 [0069.377] lstrlenA (lpString="*.flac") returned 6 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.ape") returned 0 [0069.377] lstrlenA (lpString="*.ape") returned 5 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.wma") returned 0 [0069.377] lstrlenA (lpString="*.wma") returned 5 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.ac3") returned 0 [0069.377] lstrlenA (lpString="*.ac3") returned 5 [0069.378] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3f0bbc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1b64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292272.WMF", cAlternateFileName="")) returned 1 [0069.378] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.378] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0292272.WMF") returned -1 [0069.378] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0292272.WMF") returned -1 [0069.378] lstrcmpiA (lpString1="", lpString2="J0292272.WMF") returned -1 [0069.378] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF") returned="J0292270.WMF" [0069.378] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.378] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.378] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.378] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.378] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0292272.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" [0069.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF", pszSpec="*.zip") returned 0 [0069.378] lstrlenA (lpString="*.zip") returned 5 [0069.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF", pszSpec="*.rar") returned 0 [0069.378] lstrlenA (lpString="*.rar") returned 5 [0069.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF", pszSpec="*.7z") returned 0 [0069.378] lstrlenA (lpString="*.7z") returned 4 [0069.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF", pszSpec="*.tar") returned 0 [0069.378] lstrlenA (lpString="*.tar") returned 5 [0069.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF", pszSpec="*.gzip") returned 0 [0069.378] lstrlenA (lpString="*.gzip") returned 6 [0069.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF", pszSpec="*.jpg") returned 0 [0069.378] lstrlenA (lpString="*.jpg") returned 5 [0069.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF", pszSpec="*.jpeg") returned 0 [0069.378] lstrlenA (lpString="*.jpeg") returned 6 [0069.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF", pszSpec="*.psd") returned 0 [0069.378] lstrlenA (lpString="*.psd") returned 5 [0069.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF", pszSpec="*.cdr") returned 0 [0069.378] lstrlenA (lpString="*.cdr") returned 5 [0069.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF", pszSpec="*.dwg") returned 0 [0069.379] lstrlenA (lpString="*.dwg") returned 5 [0069.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF", pszSpec="*.max") returned 0 [0069.379] lstrlenA (lpString="*.max") returned 5 [0069.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF", pszSpec="*.bmp") returned 0 [0069.379] lstrlenA (lpString="*.bmp") returned 5 [0069.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF", pszSpec="*.gif") returned 0 [0069.379] lstrlenA (lpString="*.gif") returned 5 [0069.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF", pszSpec="*.png") returned 0 [0069.379] lstrlenA (lpString="*.png") returned 5 [0069.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF", pszSpec="*.doc") returned 0 [0069.379] lstrlenA (lpString="*.doc") returned 5 [0069.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF", pszSpec="*.docx") returned 0 [0069.379] lstrlenA (lpString="*.docx") returned 6 [0069.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF", pszSpec="*.xls") returned 0 [0069.379] lstrlenA (lpString="*.xls") returned 5 [0069.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF", pszSpec="*.xlsx") returned 0 [0069.379] lstrlenA (lpString="*.xlsx") returned 6 [0069.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF", pszSpec="*.ppt") returned 0 [0069.379] lstrlenA (lpString="*.ppt") returned 5 [0069.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF", pszSpec="*.pptx") returned 0 [0069.379] lstrlenA (lpString="*.pptx") returned 6 [0069.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF", pszSpec="*.txt") returned 0 [0069.379] lstrlenA (lpString="*.txt") returned 5 [0069.379] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3f5a59, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3658, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292278.WMF", cAlternateFileName="")) returned 1 [0069.380] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.380] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0292278.WMF") returned -1 [0069.380] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0292278.WMF") returned -1 [0069.380] lstrcmpiA (lpString1="", lpString2="J0292278.WMF") returned -1 [0069.380] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF") returned="J0292272.WMF" [0069.380] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.380] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.380] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.380] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.380] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0292278.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" [0069.380] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3fbbd1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4b56, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292286.WMF", cAlternateFileName="")) returned 1 [0069.380] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.380] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0292286.WMF") returned -1 [0069.380] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0292286.WMF") returned -1 [0069.380] lstrcmpiA (lpString1="", lpString2="J0292286.WMF") returned -1 [0069.380] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF") returned="J0292278.WMF" [0069.380] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.380] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.380] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.380] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.380] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0292286.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" [0069.380] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae40f5eb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x12a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293800.WMF", cAlternateFileName="")) returned 1 [0069.380] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.380] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0293800.WMF") returned -1 [0069.381] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0293800.WMF") returned -1 [0069.381] lstrcmpiA (lpString1="", lpString2="J0293800.WMF") returned -1 [0069.381] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF") returned="J0292286.WMF" [0069.381] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.381] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.381] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.381] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.381] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0293800.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" [0069.381] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3864484, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x17be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293832.WMF", cAlternateFileName="")) returned 1 [0069.381] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.381] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0293832.WMF") returned -1 [0069.381] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0293832.WMF") returned -1 [0069.381] lstrcmpiA (lpString1="", lpString2="J0293832.WMF") returned -1 [0069.381] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF") returned="J0293800.WMF" [0069.381] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.381] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.381] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.381] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.381] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0293832.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" [0069.381] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae417d05, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x37de, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0294989.WMF", cAlternateFileName="")) returned 1 [0069.381] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.381] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0294989.WMF") returned -1 [0069.381] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0294989.WMF") returned -1 [0069.381] lstrcmpiA (lpString1="", lpString2="J0294989.WMF") returned -1 [0069.381] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF") returned="J0293832.WMF" [0069.382] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.382] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.382] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.382] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.382] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0294989.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" [0069.382] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc386a652, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6180, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0294991.WMF", cAlternateFileName="")) returned 1 [0069.382] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.382] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0294991.WMF") returned -1 [0069.382] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0294991.WMF") returned -1 [0069.382] lstrcmpiA (lpString1="", lpString2="J0294991.WMF") returned -1 [0069.382] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF") returned="J0294989.WMF" [0069.382] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.382] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.382] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.382] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.382] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0294991.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" [0069.382] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae420569, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x21b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0295069.WMF", cAlternateFileName="")) returned 1 [0069.382] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.382] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0295069.WMF") returned -1 [0069.382] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0295069.WMF") returned -1 [0069.382] lstrcmpiA (lpString1="", lpString2="J0295069.WMF") returned -1 [0069.382] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF") returned="J0294991.WMF" [0069.382] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.382] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.383] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.383] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.383] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0295069.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" [0069.383] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae427aab, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe42c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0296277.WMF", cAlternateFileName="")) returned 1 [0069.383] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.383] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0296277.WMF") returned -1 [0069.383] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0296277.WMF") returned -1 [0069.383] lstrcmpiA (lpString1="", lpString2="J0296277.WMF") returned -1 [0069.383] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF") returned="J0295069.WMF" [0069.383] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.383] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.383] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.383] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.383] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0296277.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" [0069.383] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4303c5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1088e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0296279.WMF", cAlternateFileName="")) returned 1 [0069.383] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.383] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0296279.WMF") returned -1 [0069.383] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0296279.WMF") returned -1 [0069.383] lstrcmpiA (lpString1="", lpString2="J0296279.WMF") returned -1 [0069.383] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF") returned="J0296277.WMF" [0069.383] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.383] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.384] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.384] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.384] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0296279.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" [0069.384] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38707d8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x107ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0296288.WMF", cAlternateFileName="")) returned 1 [0069.384] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.384] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0296288.WMF") returned -1 [0069.384] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0296288.WMF") returned -1 [0069.384] lstrcmpiA (lpString1="", lpString2="J0296288.WMF") returned -1 [0069.384] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF") returned="J0296279.WMF" [0069.384] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.384] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.384] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.384] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.384] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0296288.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" [0069.384] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae435130, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x59ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297229.WMF", cAlternateFileName="")) returned 1 [0069.384] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.401] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0297229.WMF") returned -1 [0069.401] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0297229.WMF") returned -1 [0069.401] lstrcmpiA (lpString1="", lpString2="J0297229.WMF") returned -1 [0069.401] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF") returned="J0296288.WMF" [0069.401] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.401] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.401] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.401] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.401] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0297229.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" [0069.401] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae43b38e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3d24, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297269.WMF", cAlternateFileName="")) returned 1 [0069.401] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.401] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0297269.WMF") returned -1 [0069.401] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0297269.WMF") returned -1 [0069.401] lstrcmpiA (lpString1="", lpString2="J0297269.WMF") returned -1 [0069.401] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF") returned="J0297229.WMF" [0069.401] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.402] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.402] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.402] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.402] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0297269.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" [0069.402] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc387696a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4236, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297725.WMF", cAlternateFileName="")) returned 1 [0069.402] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.402] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0297725.WMF") returned -1 [0069.402] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0297725.WMF") returned -1 [0069.402] lstrcmpiA (lpString1="", lpString2="J0297725.WMF") returned -1 [0069.402] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF") returned="J0297269.WMF" [0069.402] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.402] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.402] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.402] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.402] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0297725.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" [0069.402] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4401da, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3c9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297727.WMF", cAlternateFileName="")) returned 1 [0069.402] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.402] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0297727.WMF") returned -1 [0069.402] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0297727.WMF") returned -1 [0069.402] lstrcmpiA (lpString1="", lpString2="J0297727.WMF") returned -1 [0069.402] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF") returned="J0297725.WMF" [0069.402] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.402] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.402] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.403] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.403] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0297727.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" [0069.403] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc387cb71, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x493e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297757.WMF", cAlternateFileName="")) returned 1 [0069.403] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.403] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0297757.WMF") returned -1 [0069.403] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0297757.WMF") returned -1 [0069.404] lstrcmpiA (lpString1="", lpString2="J0297757.WMF") returned -1 [0069.404] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF") returned="J0297727.WMF" [0069.404] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.404] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.404] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.404] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.404] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0297757.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" [0069.404] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4476ab, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4960, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297759.WMF", cAlternateFileName="")) returned 1 [0069.404] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.404] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0297759.WMF") returned -1 [0069.404] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0297759.WMF") returned -1 [0069.404] lstrcmpiA (lpString1="", lpString2="J0297759.WMF") returned -1 [0069.404] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF") returned="J0297757.WMF" [0069.404] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.404] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.404] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.404] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.404] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0297759.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" [0069.404] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae44c467, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4584, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300862.WMF", cAlternateFileName="")) returned 1 [0069.404] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.404] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0300862.WMF") returned -1 [0069.404] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0300862.WMF") returned -1 [0069.404] lstrcmpiA (lpString1="", lpString2="J0300862.WMF") returned -1 [0069.404] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF") returned="J0297759.WMF" [0069.405] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.405] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.405] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.405] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.405] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0300862.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" [0069.405] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae452638, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2b0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301044.WMF", cAlternateFileName="")) returned 1 [0069.405] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.405] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0301044.WMF") returned -1 [0069.405] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0301044.WMF") returned -1 [0069.405] lstrcmpiA (lpString1="", lpString2="J0301044.WMF") returned -1 [0069.405] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF") returned="J0300862.WMF" [0069.405] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.405] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.405] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.405] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.405] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0301044.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" [0069.405] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38819f0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2ae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301052.WMF", cAlternateFileName="")) returned 1 [0069.405] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.405] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0301052.WMF") returned -1 [0069.405] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0301052.WMF") returned -1 [0069.405] lstrcmpiA (lpString1="", lpString2="J0301052.WMF") returned -1 [0069.405] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF") returned="J0301044.WMF" [0069.405] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.405] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.406] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.406] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.406] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0301052.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" [0069.406] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae458805, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4a5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301418.WMF", cAlternateFileName="")) returned 1 [0069.406] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.406] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0301418.WMF") returned -1 [0069.406] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0301418.WMF") returned -1 [0069.406] lstrcmpiA (lpString1="", lpString2="J0301418.WMF") returned -1 [0069.406] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF") returned="J0301052.WMF" [0069.406] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.406] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.406] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.406] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.406] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0301418.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" [0069.406] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3887b13, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4dfa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301432.WMF", cAlternateFileName="")) returned 1 [0069.406] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.406] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0301432.WMF") returned -1 [0069.406] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0301432.WMF") returned -1 [0069.406] lstrcmpiA (lpString1="", lpString2="J0301432.WMF") returned -1 [0069.406] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF") returned="J0301418.WMF" [0069.406] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.406] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.406] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.406] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.407] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0301432.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" [0069.407] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc388ca98, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0304371.WMF", cAlternateFileName="")) returned 1 [0069.407] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.407] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0304371.WMF") returned -1 [0069.407] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0304371.WMF") returned -1 [0069.407] lstrcmpiA (lpString1="", lpString2="J0304371.WMF") returned -1 [0069.407] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF") returned="J0301432.WMF" [0069.407] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.407] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.407] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.407] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.407] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0304371.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" [0069.407] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae45c23f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x103e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0304405.WMF", cAlternateFileName="")) returned 1 [0069.407] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.407] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0304405.WMF") returned -1 [0069.407] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0304405.WMF") returned -1 [0069.407] lstrcmpiA (lpString1="", lpString2="J0304405.WMF") returned -1 [0069.407] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF") returned="J0304371.WMF" [0069.407] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.407] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.407] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.407] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.407] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0304405.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" [0069.408] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3892aea, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4a0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0304853.WMF", cAlternateFileName="")) returned 1 [0069.408] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.408] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0304853.WMF") returned -1 [0069.408] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0304853.WMF") returned -1 [0069.408] lstrcmpiA (lpString1="", lpString2="J0304853.WMF") returned -1 [0069.408] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF") returned="J0304405.WMF" [0069.408] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.408] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.408] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.408] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.408] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0304853.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" [0069.408] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3897923, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2cf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0304861.WMF", cAlternateFileName="")) returned 1 [0069.408] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.408] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0304861.WMF") returned -1 [0069.408] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0304861.WMF") returned -1 [0069.408] lstrcmpiA (lpString1="", lpString2="J0304861.WMF") returned -1 [0069.408] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF") returned="J0304853.WMF" [0069.408] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.408] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.408] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.408] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.408] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0304861.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" [0069.408] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae46378b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4f8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0304875.WMF", cAlternateFileName="")) returned 1 [0069.409] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.409] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0304875.WMF") returned -1 [0069.409] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0304875.WMF") returned -1 [0069.409] lstrcmpiA (lpString1="", lpString2="J0304875.WMF") returned -1 [0069.409] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF") returned="J0304861.WMF" [0069.409] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.409] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.409] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.409] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.409] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0304875.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" [0069.409] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc389c6ef, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x29c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309480.JPG", cAlternateFileName="")) returned 1 [0069.409] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.409] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0309480.JPG") returned -1 [0069.409] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0309480.JPG") returned -1 [0069.409] lstrcmpiA (lpString1="", lpString2="J0309480.JPG") returned -1 [0069.409] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF") returned="J0304875.WMF" [0069.409] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.409] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.409] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.409] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.409] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0309480.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" [0069.409] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" [0069.409] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" [0069.409] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG." [0069.409] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.BD" [0069.409] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.411] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29c4 [0069.411] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc389c6ef, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.411] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.411] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x2968, lpOverlapped=0x0) returned 1 [0069.414] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG") returned="J0309480.JPG" [0069.414] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.415] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x2968, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x2968, lpOverlapped=0x0) returned 1 [0069.415] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.415] CloseHandle (hObject=0x1cc) returned 1 [0069.417] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309480.jpg.bd")) returned 1 [0069.417] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4685d7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x544c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309567.JPG", cAlternateFileName="")) returned 1 [0069.417] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.417] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0309567.JPG") returned -1 [0069.417] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0309567.JPG") returned -1 [0069.417] lstrcmpiA (lpString1="", lpString2="J0309567.JPG") returned -1 [0069.418] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG") returned="J0309480.JPG" [0069.418] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.418] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.418] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.418] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.418] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0309567.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" [0069.418] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG", pszSpec="*.zip") returned 0 [0069.418] lstrlenA (lpString="*.zip") returned 5 [0069.418] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG", pszSpec="*.rar") returned 0 [0069.418] lstrlenA (lpString="*.rar") returned 5 [0069.418] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG", pszSpec="*.7z") returned 0 [0069.418] lstrlenA (lpString="*.7z") returned 4 [0069.418] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG", pszSpec="*.tar") returned 0 [0069.418] lstrlenA (lpString="*.tar") returned 5 [0069.418] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG", pszSpec="*.gzip") returned 0 [0069.418] lstrlenA (lpString="*.gzip") returned 6 [0069.418] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG", pszSpec="*.jpg") returned 1 [0069.418] lstrlenA (lpString="*.jpg") returned 5 [0069.418] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" [0069.418] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" [0069.418] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG." [0069.418] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.BD" [0069.418] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.420] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x544c [0069.420] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae4685d7, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.420] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.420] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x53f0, lpOverlapped=0x0) returned 1 [0069.424] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG") returned="J0309567.JPG" [0069.425] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.425] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x53f0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x53f0, lpOverlapped=0x0) returned 1 [0069.425] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.425] CloseHandle (hObject=0x1cc) returned 1 [0069.427] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309567.jpg.bd")) returned 1 [0069.428] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38a28af, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x9a8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309585.JPG", cAlternateFileName="")) returned 1 [0069.428] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.428] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0309585.JPG") returned -1 [0069.428] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0309585.JPG") returned -1 [0069.428] lstrcmpiA (lpString1="", lpString2="J0309585.JPG") returned -1 [0069.428] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG") returned="J0309567.JPG" [0069.428] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.428] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.428] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.428] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.428] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0309585.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" [0069.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG", pszSpec="*.zip") returned 0 [0069.428] lstrlenA (lpString="*.zip") returned 5 [0069.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG", pszSpec="*.rar") returned 0 [0069.428] lstrlenA (lpString="*.rar") returned 5 [0069.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG", pszSpec="*.7z") returned 0 [0069.428] lstrlenA (lpString="*.7z") returned 4 [0069.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG", pszSpec="*.tar") returned 0 [0069.428] lstrlenA (lpString="*.tar") returned 5 [0069.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG", pszSpec="*.gzip") returned 0 [0069.428] lstrlenA (lpString="*.gzip") returned 6 [0069.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG", pszSpec="*.jpg") returned 1 [0069.428] lstrlenA (lpString="*.jpg") returned 5 [0069.428] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" [0069.429] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" [0069.429] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG." [0069.429] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.BD" [0069.429] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.435] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9a8b [0069.435] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc38a28af, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.435] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.435] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x9a2f, lpOverlapped=0x0) returned 1 [0069.438] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG") returned="J0309585.JPG" [0069.439] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.439] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x9a2f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x9a2f, lpOverlapped=0x0) returned 1 [0069.439] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.439] CloseHandle (hObject=0x1cc) returned 1 [0069.441] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309585.jpg.bd")) returned 1 [0069.441] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae46fafd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x81f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309598.JPG", cAlternateFileName="")) returned 1 [0069.441] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.441] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0309598.JPG") returned -1 [0069.441] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0309598.JPG") returned -1 [0069.442] lstrcmpiA (lpString1="", lpString2="J0309598.JPG") returned -1 [0069.442] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG") returned="J0309585.JPG" [0069.442] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.442] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.442] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.442] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.442] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0309598.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" [0069.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG", pszSpec="*.zip") returned 0 [0069.442] lstrlenA (lpString="*.zip") returned 5 [0069.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG", pszSpec="*.rar") returned 0 [0069.442] lstrlenA (lpString="*.rar") returned 5 [0069.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG", pszSpec="*.7z") returned 0 [0069.442] lstrlenA (lpString="*.7z") returned 4 [0069.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG", pszSpec="*.tar") returned 0 [0069.442] lstrlenA (lpString="*.tar") returned 5 [0069.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG", pszSpec="*.gzip") returned 0 [0069.442] lstrlenA (lpString="*.gzip") returned 6 [0069.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG", pszSpec="*.jpg") returned 1 [0069.442] lstrlenA (lpString="*.jpg") returned 5 [0069.442] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" [0069.442] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" [0069.442] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG." [0069.442] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.BD" [0069.442] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.443] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x81f0 [0069.443] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae46fafd, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.443] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.444] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x8194, lpOverlapped=0x0) returned 1 [0069.448] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG") returned="J0309598.JPG" [0069.449] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.449] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x8194, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x8194, lpOverlapped=0x0) returned 1 [0069.449] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.449] CloseHandle (hObject=0x1cc) returned 1 [0069.451] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309598.jpg.bd")) returned 1 [0069.452] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38ab1a7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xaabb, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309664.JPG", cAlternateFileName="")) returned 1 [0069.452] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.452] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0309664.JPG") returned -1 [0069.452] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0309664.JPG") returned -1 [0069.452] lstrcmpiA (lpString1="", lpString2="J0309664.JPG") returned -1 [0069.452] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG") returned="J0309598.JPG" [0069.452] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.452] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.452] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.452] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.452] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0309664.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" [0069.452] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG", pszSpec="*.zip") returned 0 [0069.452] lstrlenA (lpString="*.zip") returned 5 [0069.452] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG", pszSpec="*.rar") returned 0 [0069.452] lstrlenA (lpString="*.rar") returned 5 [0069.452] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG", pszSpec="*.7z") returned 0 [0069.452] lstrlenA (lpString="*.7z") returned 4 [0069.452] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG", pszSpec="*.tar") returned 0 [0069.452] lstrlenA (lpString="*.tar") returned 5 [0069.452] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG", pszSpec="*.gzip") returned 0 [0069.452] lstrlenA (lpString="*.gzip") returned 6 [0069.452] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG", pszSpec="*.jpg") returned 1 [0069.452] lstrlenA (lpString="*.jpg") returned 5 [0069.452] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" [0069.453] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" [0069.453] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG." [0069.453] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.BD" [0069.453] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.453] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaabb [0069.453] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc38ab1a7, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.453] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.453] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xaa5f, lpOverlapped=0x0) returned 1 [0069.458] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG") returned="J0309664.JPG" [0069.459] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.459] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xaa5f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xaa5f, lpOverlapped=0x0) returned 1 [0069.459] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.459] CloseHandle (hObject=0x1cc) returned 1 [0069.461] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309664.jpg.bd")) returned 1 [0069.462] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae47aad1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4ada, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309705.JPG", cAlternateFileName="")) returned 1 [0069.462] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.462] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0309705.JPG") returned -1 [0069.462] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0309705.JPG") returned -1 [0069.462] lstrcmpiA (lpString1="", lpString2="J0309705.JPG") returned -1 [0069.462] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG") returned="J0309664.JPG" [0069.462] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.462] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.463] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.463] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.463] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0309705.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" [0069.463] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG", pszSpec="*.zip") returned 0 [0069.463] lstrlenA (lpString="*.zip") returned 5 [0069.463] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG", pszSpec="*.rar") returned 0 [0069.463] lstrlenA (lpString="*.rar") returned 5 [0069.463] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG", pszSpec="*.7z") returned 0 [0069.463] lstrlenA (lpString="*.7z") returned 4 [0069.463] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG", pszSpec="*.tar") returned 0 [0069.463] lstrlenA (lpString="*.tar") returned 5 [0069.463] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG", pszSpec="*.gzip") returned 0 [0069.463] lstrlenA (lpString="*.gzip") returned 6 [0069.463] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG", pszSpec="*.jpg") returned 1 [0069.463] lstrlenA (lpString="*.jpg") returned 5 [0069.463] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" [0069.463] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" [0069.463] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG." [0069.463] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.BD" [0069.463] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.464] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ada [0069.464] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae47aad1, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.464] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.464] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x4a7e, lpOverlapped=0x0) returned 1 [0069.466] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG") returned="J0309705.JPG" [0069.467] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.467] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x4a7e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x4a7e, lpOverlapped=0x0) returned 1 [0069.467] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.467] CloseHandle (hObject=0x1cc) returned 1 [0069.469] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309705.jpg.bd")) returned 1 [0069.469] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae47f8b1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309902.WMF", cAlternateFileName="")) returned 1 [0069.469] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.469] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0309902.WMF") returned -1 [0069.469] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0309902.WMF") returned -1 [0069.469] lstrcmpiA (lpString1="", lpString2="J0309902.WMF") returned -1 [0069.469] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG") returned="J0309705.JPG" [0069.470] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.470] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.470] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.470] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.470] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0309902.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" [0069.470] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.zip") returned 0 [0069.470] lstrlenA (lpString="*.zip") returned 5 [0069.470] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.rar") returned 0 [0069.470] lstrlenA (lpString="*.rar") returned 5 [0069.470] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.7z") returned 0 [0069.470] lstrlenA (lpString="*.7z") returned 4 [0069.470] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.tar") returned 0 [0069.470] lstrlenA (lpString="*.tar") returned 5 [0069.470] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.gzip") returned 0 [0069.470] lstrlenA (lpString="*.gzip") returned 6 [0069.470] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.jpg") returned 0 [0069.470] lstrlenA (lpString="*.jpg") returned 5 [0069.470] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.jpeg") returned 0 [0069.470] lstrlenA (lpString="*.jpeg") returned 6 [0069.470] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.psd") returned 0 [0069.470] lstrlenA (lpString="*.psd") returned 5 [0069.470] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.cdr") returned 0 [0069.470] lstrlenA (lpString="*.cdr") returned 5 [0069.470] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.dwg") returned 0 [0069.470] lstrlenA (lpString="*.dwg") returned 5 [0069.470] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.max") returned 0 [0069.470] lstrlenA (lpString="*.max") returned 5 [0069.470] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.bmp") returned 0 [0069.470] lstrlenA (lpString="*.bmp") returned 5 [0069.470] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.gif") returned 0 [0069.470] lstrlenA (lpString="*.gif") returned 5 [0069.471] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.png") returned 0 [0069.471] lstrlenA (lpString="*.png") returned 5 [0069.471] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.doc") returned 0 [0069.471] lstrlenA (lpString="*.doc") returned 5 [0069.471] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.docx") returned 0 [0069.471] lstrlenA (lpString="*.docx") returned 6 [0069.471] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.xls") returned 0 [0069.471] lstrlenA (lpString="*.xls") returned 5 [0069.471] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.xlsx") returned 0 [0069.471] lstrlenA (lpString="*.xlsx") returned 6 [0069.471] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.ppt") returned 0 [0069.471] lstrlenA (lpString="*.ppt") returned 5 [0069.471] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.pptx") returned 0 [0069.471] lstrlenA (lpString="*.pptx") returned 6 [0069.471] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.txt") returned 0 [0069.471] lstrlenA (lpString="*.txt") returned 5 [0069.471] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.pdf") returned 0 [0069.471] lstrlenA (lpString="*.pdf") returned 5 [0069.471] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.djvu") returned 0 [0069.471] lstrlenA (lpString="*.djvu") returned 6 [0069.471] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.htm") returned 0 [0069.471] lstrlenA (lpString="*.htm") returned 5 [0069.471] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.html") returned 0 [0069.471] lstrlenA (lpString="*.html") returned 6 [0069.471] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.mdb") returned 0 [0069.471] lstrlenA (lpString="*.mdb") returned 5 [0069.471] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.cer") returned 0 [0069.471] lstrlenA (lpString="*.cer") returned 5 [0069.471] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.p12") returned 0 [0069.471] lstrlenA (lpString="*.p12") returned 5 [0069.471] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.pfx") returned 0 [0069.471] lstrlenA (lpString="*.pfx") returned 5 [0069.471] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.kwm") returned 0 [0069.471] lstrlenA (lpString="*.kwm") returned 5 [0069.471] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.pwm") returned 0 [0069.472] lstrlenA (lpString="*.pwm") returned 5 [0069.472] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.1cd") returned 0 [0069.472] lstrlenA (lpString="*.1cd") returned 5 [0069.472] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.md") returned 0 [0069.472] lstrlenA (lpString="*.md") returned 4 [0069.472] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.mdf") returned 0 [0069.472] lstrlenA (lpString="*.mdf") returned 5 [0069.472] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.dbf") returned 0 [0069.472] lstrlenA (lpString="*.dbf") returned 5 [0069.472] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.odt") returned 0 [0069.472] lstrlenA (lpString="*.odt") returned 5 [0069.472] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.vob") returned 0 [0069.472] lstrlenA (lpString="*.vob") returned 5 [0069.472] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.ifo") returned 0 [0069.472] lstrlenA (lpString="*.ifo") returned 5 [0069.472] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.lnk") returned 0 [0069.472] lstrlenA (lpString="*.lnk") returned 5 [0069.472] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.torrent") returned 0 [0069.472] lstrlenA (lpString="*.torrent") returned 9 [0069.472] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.mov") returned 0 [0069.472] lstrlenA (lpString="*.mov") returned 5 [0069.472] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.m2v") returned 0 [0069.472] lstrlenA (lpString="*.m2v") returned 5 [0069.472] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.3gp") returned 0 [0069.472] lstrlenA (lpString="*.3gp") returned 5 [0069.472] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.mpeg") returned 0 [0069.472] lstrlenA (lpString="*.mpeg") returned 6 [0069.472] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.mpg") returned 0 [0069.472] lstrlenA (lpString="*.mpg") returned 5 [0069.472] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.flv") returned 0 [0069.472] lstrlenA (lpString="*.flv") returned 5 [0069.472] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.avi") returned 0 [0069.472] lstrlenA (lpString="*.avi") returned 5 [0069.472] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.mp4") returned 0 [0069.472] lstrlenA (lpString="*.mp4") returned 5 [0069.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.wmv") returned 0 [0069.473] lstrlenA (lpString="*.wmv") returned 5 [0069.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.divx") returned 0 [0069.473] lstrlenA (lpString="*.divx") returned 6 [0069.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.mkv") returned 0 [0069.473] lstrlenA (lpString="*.mkv") returned 5 [0069.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.mp3") returned 0 [0069.473] lstrlenA (lpString="*.mp3") returned 5 [0069.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.wav") returned 0 [0069.473] lstrlenA (lpString="*.wav") returned 5 [0069.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.flac") returned 0 [0069.473] lstrlenA (lpString="*.flac") returned 6 [0069.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.ape") returned 0 [0069.473] lstrlenA (lpString="*.ape") returned 5 [0069.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.wma") returned 0 [0069.473] lstrlenA (lpString="*.wma") returned 5 [0069.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.ac3") returned 0 [0069.473] lstrlenA (lpString="*.ac3") returned 5 [0069.473] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38affe7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x20e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309904.WMF", cAlternateFileName="")) returned 1 [0069.473] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.473] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0309904.WMF") returned -1 [0069.473] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0309904.WMF") returned -1 [0069.473] lstrcmpiA (lpString1="", lpString2="J0309904.WMF") returned -1 [0069.473] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF") returned="J0309902.WMF" [0069.473] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.473] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.473] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.473] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.474] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0309904.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" [0069.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.zip") returned 0 [0069.474] lstrlenA (lpString="*.zip") returned 5 [0069.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.rar") returned 0 [0069.474] lstrlenA (lpString="*.rar") returned 5 [0069.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.7z") returned 0 [0069.474] lstrlenA (lpString="*.7z") returned 4 [0069.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.tar") returned 0 [0069.474] lstrlenA (lpString="*.tar") returned 5 [0069.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.gzip") returned 0 [0069.474] lstrlenA (lpString="*.gzip") returned 6 [0069.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.jpg") returned 0 [0069.474] lstrlenA (lpString="*.jpg") returned 5 [0069.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.jpeg") returned 0 [0069.474] lstrlenA (lpString="*.jpeg") returned 6 [0069.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.psd") returned 0 [0069.474] lstrlenA (lpString="*.psd") returned 5 [0069.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.cdr") returned 0 [0069.474] lstrlenA (lpString="*.cdr") returned 5 [0069.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.dwg") returned 0 [0069.474] lstrlenA (lpString="*.dwg") returned 5 [0069.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.max") returned 0 [0069.474] lstrlenA (lpString="*.max") returned 5 [0069.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.bmp") returned 0 [0069.474] lstrlenA (lpString="*.bmp") returned 5 [0069.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.gif") returned 0 [0069.474] lstrlenA (lpString="*.gif") returned 5 [0069.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.png") returned 0 [0069.474] lstrlenA (lpString="*.png") returned 5 [0069.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.doc") returned 0 [0069.474] lstrlenA (lpString="*.doc") returned 5 [0069.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.docx") returned 0 [0069.474] lstrlenA (lpString="*.docx") returned 6 [0069.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.xls") returned 0 [0069.475] lstrlenA (lpString="*.xls") returned 5 [0069.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.xlsx") returned 0 [0069.475] lstrlenA (lpString="*.xlsx") returned 6 [0069.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.ppt") returned 0 [0069.475] lstrlenA (lpString="*.ppt") returned 5 [0069.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.pptx") returned 0 [0069.475] lstrlenA (lpString="*.pptx") returned 6 [0069.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.txt") returned 0 [0069.475] lstrlenA (lpString="*.txt") returned 5 [0069.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.pdf") returned 0 [0069.475] lstrlenA (lpString="*.pdf") returned 5 [0069.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.djvu") returned 0 [0069.475] lstrlenA (lpString="*.djvu") returned 6 [0069.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.htm") returned 0 [0069.475] lstrlenA (lpString="*.htm") returned 5 [0069.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.html") returned 0 [0069.475] lstrlenA (lpString="*.html") returned 6 [0069.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.mdb") returned 0 [0069.475] lstrlenA (lpString="*.mdb") returned 5 [0069.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.cer") returned 0 [0069.475] lstrlenA (lpString="*.cer") returned 5 [0069.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.p12") returned 0 [0069.475] lstrlenA (lpString="*.p12") returned 5 [0069.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.pfx") returned 0 [0069.475] lstrlenA (lpString="*.pfx") returned 5 [0069.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.kwm") returned 0 [0069.475] lstrlenA (lpString="*.kwm") returned 5 [0069.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.pwm") returned 0 [0069.475] lstrlenA (lpString="*.pwm") returned 5 [0069.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.1cd") returned 0 [0069.475] lstrlenA (lpString="*.1cd") returned 5 [0069.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.md") returned 0 [0069.475] lstrlenA (lpString="*.md") returned 4 [0069.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.mdf") returned 0 [0069.476] lstrlenA (lpString="*.mdf") returned 5 [0069.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.dbf") returned 0 [0069.476] lstrlenA (lpString="*.dbf") returned 5 [0069.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.odt") returned 0 [0069.476] lstrlenA (lpString="*.odt") returned 5 [0069.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.vob") returned 0 [0069.476] lstrlenA (lpString="*.vob") returned 5 [0069.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.ifo") returned 0 [0069.476] lstrlenA (lpString="*.ifo") returned 5 [0069.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.lnk") returned 0 [0069.476] lstrlenA (lpString="*.lnk") returned 5 [0069.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.torrent") returned 0 [0069.476] lstrlenA (lpString="*.torrent") returned 9 [0069.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.mov") returned 0 [0069.476] lstrlenA (lpString="*.mov") returned 5 [0069.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.m2v") returned 0 [0069.476] lstrlenA (lpString="*.m2v") returned 5 [0069.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.3gp") returned 0 [0069.476] lstrlenA (lpString="*.3gp") returned 5 [0069.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.mpeg") returned 0 [0069.476] lstrlenA (lpString="*.mpeg") returned 6 [0069.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.mpg") returned 0 [0069.476] lstrlenA (lpString="*.mpg") returned 5 [0069.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.flv") returned 0 [0069.476] lstrlenA (lpString="*.flv") returned 5 [0069.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.avi") returned 0 [0069.476] lstrlenA (lpString="*.avi") returned 5 [0069.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.mp4") returned 0 [0069.476] lstrlenA (lpString="*.mp4") returned 5 [0069.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.wmv") returned 0 [0069.476] lstrlenA (lpString="*.wmv") returned 5 [0069.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.divx") returned 0 [0069.476] lstrlenA (lpString="*.divx") returned 6 [0069.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.mkv") returned 0 [0069.477] lstrlenA (lpString="*.mkv") returned 5 [0069.477] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.mp3") returned 0 [0069.477] lstrlenA (lpString="*.mp3") returned 5 [0069.477] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.wav") returned 0 [0069.477] lstrlenA (lpString="*.wav") returned 5 [0069.477] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.flac") returned 0 [0069.477] lstrlenA (lpString="*.flac") returned 6 [0069.477] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.ape") returned 0 [0069.477] lstrlenA (lpString="*.ape") returned 5 [0069.477] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.wma") returned 0 [0069.477] lstrlenA (lpString="*.wma") returned 5 [0069.477] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.ac3") returned 0 [0069.477] lstrlenA (lpString="*.ac3") returned 5 [0069.477] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae485ad4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2b38, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309920.WMF", cAlternateFileName="")) returned 1 [0069.477] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.477] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0309920.WMF") returned -1 [0069.477] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0309920.WMF") returned -1 [0069.477] lstrcmpiA (lpString1="", lpString2="J0309920.WMF") returned -1 [0069.477] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF") returned="J0309904.WMF" [0069.477] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.477] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.482] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.482] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.483] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0309920.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" [0069.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.zip") returned 0 [0069.483] lstrlenA (lpString="*.zip") returned 5 [0069.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.rar") returned 0 [0069.483] lstrlenA (lpString="*.rar") returned 5 [0069.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.7z") returned 0 [0069.483] lstrlenA (lpString="*.7z") returned 4 [0069.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.tar") returned 0 [0069.483] lstrlenA (lpString="*.tar") returned 5 [0069.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.gzip") returned 0 [0069.483] lstrlenA (lpString="*.gzip") returned 6 [0069.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.jpg") returned 0 [0069.483] lstrlenA (lpString="*.jpg") returned 5 [0069.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.jpeg") returned 0 [0069.483] lstrlenA (lpString="*.jpeg") returned 6 [0069.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.psd") returned 0 [0069.483] lstrlenA (lpString="*.psd") returned 5 [0069.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.cdr") returned 0 [0069.483] lstrlenA (lpString="*.cdr") returned 5 [0069.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.dwg") returned 0 [0069.483] lstrlenA (lpString="*.dwg") returned 5 [0069.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.max") returned 0 [0069.483] lstrlenA (lpString="*.max") returned 5 [0069.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.bmp") returned 0 [0069.483] lstrlenA (lpString="*.bmp") returned 5 [0069.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.gif") returned 0 [0069.483] lstrlenA (lpString="*.gif") returned 5 [0069.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.png") returned 0 [0069.483] lstrlenA (lpString="*.png") returned 5 [0069.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.doc") returned 0 [0069.484] lstrlenA (lpString="*.doc") returned 5 [0069.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.docx") returned 0 [0069.484] lstrlenA (lpString="*.docx") returned 6 [0069.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.xls") returned 0 [0069.484] lstrlenA (lpString="*.xls") returned 5 [0069.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.xlsx") returned 0 [0069.484] lstrlenA (lpString="*.xlsx") returned 6 [0069.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.ppt") returned 0 [0069.484] lstrlenA (lpString="*.ppt") returned 5 [0069.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.pptx") returned 0 [0069.484] lstrlenA (lpString="*.pptx") returned 6 [0069.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.txt") returned 0 [0069.484] lstrlenA (lpString="*.txt") returned 5 [0069.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.pdf") returned 0 [0069.484] lstrlenA (lpString="*.pdf") returned 5 [0069.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.djvu") returned 0 [0069.484] lstrlenA (lpString="*.djvu") returned 6 [0069.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.htm") returned 0 [0069.484] lstrlenA (lpString="*.htm") returned 5 [0069.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.html") returned 0 [0069.484] lstrlenA (lpString="*.html") returned 6 [0069.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.mdb") returned 0 [0069.484] lstrlenA (lpString="*.mdb") returned 5 [0069.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.cer") returned 0 [0069.484] lstrlenA (lpString="*.cer") returned 5 [0069.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.p12") returned 0 [0069.484] lstrlenA (lpString="*.p12") returned 5 [0069.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.pfx") returned 0 [0069.484] lstrlenA (lpString="*.pfx") returned 5 [0069.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.kwm") returned 0 [0069.484] lstrlenA (lpString="*.kwm") returned 5 [0069.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.pwm") returned 0 [0069.485] lstrlenA (lpString="*.pwm") returned 5 [0069.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.1cd") returned 0 [0069.485] lstrlenA (lpString="*.1cd") returned 5 [0069.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.md") returned 0 [0069.485] lstrlenA (lpString="*.md") returned 4 [0069.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.mdf") returned 0 [0069.485] lstrlenA (lpString="*.mdf") returned 5 [0069.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.dbf") returned 0 [0069.485] lstrlenA (lpString="*.dbf") returned 5 [0069.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.odt") returned 0 [0069.485] lstrlenA (lpString="*.odt") returned 5 [0069.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.vob") returned 0 [0069.485] lstrlenA (lpString="*.vob") returned 5 [0069.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.ifo") returned 0 [0069.485] lstrlenA (lpString="*.ifo") returned 5 [0069.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.lnk") returned 0 [0069.485] lstrlenA (lpString="*.lnk") returned 5 [0069.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.torrent") returned 0 [0069.485] lstrlenA (lpString="*.torrent") returned 9 [0069.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.mov") returned 0 [0069.485] lstrlenA (lpString="*.mov") returned 5 [0069.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.m2v") returned 0 [0069.485] lstrlenA (lpString="*.m2v") returned 5 [0069.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.3gp") returned 0 [0069.485] lstrlenA (lpString="*.3gp") returned 5 [0069.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.mpeg") returned 0 [0069.485] lstrlenA (lpString="*.mpeg") returned 6 [0069.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.mpg") returned 0 [0069.485] lstrlenA (lpString="*.mpg") returned 5 [0069.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.flv") returned 0 [0069.485] lstrlenA (lpString="*.flv") returned 5 [0069.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.avi") returned 0 [0069.485] lstrlenA (lpString="*.avi") returned 5 [0069.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.mp4") returned 0 [0069.485] lstrlenA (lpString="*.mp4") returned 5 [0069.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.wmv") returned 0 [0069.486] lstrlenA (lpString="*.wmv") returned 5 [0069.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.divx") returned 0 [0069.486] lstrlenA (lpString="*.divx") returned 6 [0069.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.mkv") returned 0 [0069.486] lstrlenA (lpString="*.mkv") returned 5 [0069.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.mp3") returned 0 [0069.486] lstrlenA (lpString="*.mp3") returned 5 [0069.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.wav") returned 0 [0069.486] lstrlenA (lpString="*.wav") returned 5 [0069.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.flac") returned 0 [0069.486] lstrlenA (lpString="*.flac") returned 6 [0069.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.ape") returned 0 [0069.486] lstrlenA (lpString="*.ape") returned 5 [0069.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.wma") returned 0 [0069.486] lstrlenA (lpString="*.wma") returned 5 [0069.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.ac3") returned 0 [0069.486] lstrlenA (lpString="*.ac3") returned 5 [0069.486] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38b74fe, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x911a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0313896.JPG", cAlternateFileName="")) returned 1 [0069.486] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.486] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0313896.JPG") returned -1 [0069.486] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0313896.JPG") returned -1 [0069.486] lstrcmpiA (lpString1="", lpString2="J0313896.JPG") returned -1 [0069.486] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF") returned="J0309920.WMF" [0069.486] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.486] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.486] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.486] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.486] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0313896.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" [0069.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG", pszSpec="*.zip") returned 0 [0069.487] lstrlenA (lpString="*.zip") returned 5 [0069.487] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG", pszSpec="*.rar") returned 0 [0069.487] lstrlenA (lpString="*.rar") returned 5 [0069.487] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG", pszSpec="*.7z") returned 0 [0069.487] lstrlenA (lpString="*.7z") returned 4 [0069.487] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG", pszSpec="*.tar") returned 0 [0069.487] lstrlenA (lpString="*.tar") returned 5 [0069.487] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG", pszSpec="*.gzip") returned 0 [0069.487] lstrlenA (lpString="*.gzip") returned 6 [0069.487] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG", pszSpec="*.jpg") returned 1 [0069.487] lstrlenA (lpString="*.jpg") returned 5 [0069.487] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" [0069.487] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" [0069.487] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG." [0069.487] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.BD" [0069.487] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.487] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x911a [0069.488] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc38b74fe, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.488] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.488] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x90be, lpOverlapped=0x0) returned 1 [0069.492] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG") returned="J0313896.JPG" [0069.493] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.493] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x90be, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x90be, lpOverlapped=0x0) returned 1 [0069.493] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.493] CloseHandle (hObject=0x1cc) returned 1 [0069.495] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0313896.jpg.bd")) returned 1 [0069.496] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae48d03d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa75a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0313965.JPG", cAlternateFileName="")) returned 1 [0069.496] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.496] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0313965.JPG") returned -1 [0069.496] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0313965.JPG") returned -1 [0069.496] lstrcmpiA (lpString1="", lpString2="J0313965.JPG") returned -1 [0069.496] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG") returned="J0313896.JPG" [0069.496] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.496] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.496] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.496] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.496] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0313965.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" [0069.496] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG", pszSpec="*.zip") returned 0 [0069.496] lstrlenA (lpString="*.zip") returned 5 [0069.496] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG", pszSpec="*.rar") returned 0 [0069.496] lstrlenA (lpString="*.rar") returned 5 [0069.496] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG", pszSpec="*.7z") returned 0 [0069.496] lstrlenA (lpString="*.7z") returned 4 [0069.496] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG", pszSpec="*.tar") returned 0 [0069.496] lstrlenA (lpString="*.tar") returned 5 [0069.496] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG", pszSpec="*.gzip") returned 0 [0069.496] lstrlenA (lpString="*.gzip") returned 6 [0069.496] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG", pszSpec="*.jpg") returned 1 [0069.497] lstrlenA (lpString="*.jpg") returned 5 [0069.497] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" [0069.497] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" [0069.497] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG." [0069.497] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.BD" [0069.497] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.498] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa75a [0069.498] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae48d03d, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.498] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.499] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xa6fe, lpOverlapped=0x0) returned 1 [0069.512] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG") returned="J0313965.JPG" [0069.513] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.513] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xa6fe, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xa6fe, lpOverlapped=0x0) returned 1 [0069.521] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.521] CloseHandle (hObject=0x1cc) returned 1 [0069.523] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0313965.jpg.bd")) returned 1 [0069.524] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38bea4f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x81ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0313970.JPG", cAlternateFileName="")) returned 1 [0069.524] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.524] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0313970.JPG") returned -1 [0069.524] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0313970.JPG") returned -1 [0069.524] lstrcmpiA (lpString1="", lpString2="J0313970.JPG") returned -1 [0069.524] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG") returned="J0313965.JPG" [0069.524] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.524] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.524] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.524] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.525] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0313970.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" [0069.525] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG", pszSpec="*.zip") returned 0 [0069.525] lstrlenA (lpString="*.zip") returned 5 [0069.525] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG", pszSpec="*.rar") returned 0 [0069.525] lstrlenA (lpString="*.rar") returned 5 [0069.525] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG", pszSpec="*.7z") returned 0 [0069.525] lstrlenA (lpString="*.7z") returned 4 [0069.525] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG", pszSpec="*.tar") returned 0 [0069.525] lstrlenA (lpString="*.tar") returned 5 [0069.525] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG", pszSpec="*.gzip") returned 0 [0069.525] lstrlenA (lpString="*.gzip") returned 6 [0069.525] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG", pszSpec="*.jpg") returned 1 [0069.525] lstrlenA (lpString="*.jpg") returned 5 [0069.525] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" [0069.525] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" [0069.525] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG." [0069.525] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.BD" [0069.525] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.528] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x81ab [0069.528] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc38bea4f, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.528] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.528] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x814f, lpOverlapped=0x0) returned 1 [0069.536] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG") returned="J0313970.JPG" [0069.537] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.537] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x814f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x814f, lpOverlapped=0x0) returned 1 [0069.537] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.537] CloseHandle (hObject=0x1cc) returned 1 [0069.539] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0313970.jpg.bd")) returned 1 [0069.548] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4944dd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb9d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0313974.JPG", cAlternateFileName="")) returned 1 [0069.548] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.548] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0313974.JPG") returned -1 [0069.548] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0313974.JPG") returned -1 [0069.548] lstrcmpiA (lpString1="", lpString2="J0313974.JPG") returned -1 [0069.548] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG") returned="J0313970.JPG" [0069.548] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.548] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.548] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.548] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.549] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0313974.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" [0069.549] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG", pszSpec="*.zip") returned 0 [0069.549] lstrlenA (lpString="*.zip") returned 5 [0069.549] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG", pszSpec="*.rar") returned 0 [0069.549] lstrlenA (lpString="*.rar") returned 5 [0069.549] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG", pszSpec="*.7z") returned 0 [0069.549] lstrlenA (lpString="*.7z") returned 4 [0069.549] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG", pszSpec="*.tar") returned 0 [0069.549] lstrlenA (lpString="*.tar") returned 5 [0069.549] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG", pszSpec="*.gzip") returned 0 [0069.549] lstrlenA (lpString="*.gzip") returned 6 [0069.549] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG", pszSpec="*.jpg") returned 1 [0069.549] lstrlenA (lpString="*.jpg") returned 5 [0069.549] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" [0069.549] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" [0069.549] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG." [0069.549] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.BD" [0069.549] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.550] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9d1 [0069.550] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae4944dd, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.550] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.550] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xb975, lpOverlapped=0x0) returned 1 [0069.551] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG") returned="J0313974.JPG" [0069.553] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.553] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xb975, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xb975, lpOverlapped=0x0) returned 1 [0069.553] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.553] CloseHandle (hObject=0x1cc) returned 1 [0069.555] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0313974.jpg.bd")) returned 1 [0069.556] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38c4be3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x40f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0314068.JPG", cAlternateFileName="")) returned 1 [0069.556] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.556] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0314068.JPG") returned -1 [0069.556] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0314068.JPG") returned -1 [0069.556] lstrcmpiA (lpString1="", lpString2="J0314068.JPG") returned -1 [0069.556] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG") returned="J0313974.JPG" [0069.556] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.556] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.556] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.557] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.557] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0314068.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" [0069.557] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG", pszSpec="*.zip") returned 0 [0069.557] lstrlenA (lpString="*.zip") returned 5 [0069.557] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG", pszSpec="*.rar") returned 0 [0069.557] lstrlenA (lpString="*.rar") returned 5 [0069.557] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG", pszSpec="*.7z") returned 0 [0069.557] lstrlenA (lpString="*.7z") returned 4 [0069.557] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG", pszSpec="*.tar") returned 0 [0069.557] lstrlenA (lpString="*.tar") returned 5 [0069.557] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG", pszSpec="*.gzip") returned 0 [0069.557] lstrlenA (lpString="*.gzip") returned 6 [0069.557] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG", pszSpec="*.jpg") returned 1 [0069.557] lstrlenA (lpString="*.jpg") returned 5 [0069.557] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" [0069.557] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" [0069.557] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG." [0069.557] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.BD" [0069.557] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.557] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40f2 [0069.558] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc38c4be3, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.558] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.558] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x4096, lpOverlapped=0x0) returned 1 [0069.561] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG") returned="J0314068.JPG" [0069.561] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.561] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x4096, lpOverlapped=0x0) returned 1 [0069.561] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.561] CloseHandle (hObject=0x1cc) returned 1 [0069.563] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0314068.jpg.bd")) returned 1 [0069.563] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38c860c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4b02, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0315580.JPG", cAlternateFileName="")) returned 1 [0069.563] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.563] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0315580.JPG") returned -1 [0069.564] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0315580.JPG") returned -1 [0069.564] lstrcmpiA (lpString1="", lpString2="J0315580.JPG") returned -1 [0069.564] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG") returned="J0314068.JPG" [0069.564] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.564] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.564] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.564] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.564] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0315580.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" [0069.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG", pszSpec="*.zip") returned 0 [0069.564] lstrlenA (lpString="*.zip") returned 5 [0069.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG", pszSpec="*.rar") returned 0 [0069.564] lstrlenA (lpString="*.rar") returned 5 [0069.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG", pszSpec="*.7z") returned 0 [0069.564] lstrlenA (lpString="*.7z") returned 4 [0069.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG", pszSpec="*.tar") returned 0 [0069.564] lstrlenA (lpString="*.tar") returned 5 [0069.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG", pszSpec="*.gzip") returned 0 [0069.564] lstrlenA (lpString="*.gzip") returned 6 [0069.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG", pszSpec="*.jpg") returned 1 [0069.564] lstrlenA (lpString="*.jpg") returned 5 [0069.564] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" [0069.564] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" [0069.564] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG." [0069.564] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.BD" [0069.564] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.565] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4b02 [0069.565] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc38c860c, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.565] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.565] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x4aa6, lpOverlapped=0x0) returned 1 [0069.603] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG") returned="J0315580.JPG" [0069.603] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.604] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x4aa6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x4aa6, lpOverlapped=0x0) returned 1 [0069.604] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.604] CloseHandle (hObject=0x1cc) returned 1 [0069.606] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0315580.jpg.bd")) returned 1 [0069.607] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae49934e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x423a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0315612.JPG", cAlternateFileName="")) returned 1 [0069.607] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.607] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0315612.JPG") returned -1 [0069.607] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0315612.JPG") returned -1 [0069.607] lstrcmpiA (lpString1="", lpString2="J0315612.JPG") returned -1 [0069.607] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG") returned="J0315580.JPG" [0069.607] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.607] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.607] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.607] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.607] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0315612.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" [0069.607] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG", pszSpec="*.zip") returned 0 [0069.608] lstrlenA (lpString="*.zip") returned 5 [0069.608] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG", pszSpec="*.rar") returned 0 [0069.608] lstrlenA (lpString="*.rar") returned 5 [0069.608] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG", pszSpec="*.7z") returned 0 [0069.608] lstrlenA (lpString="*.7z") returned 4 [0069.608] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG", pszSpec="*.tar") returned 0 [0069.608] lstrlenA (lpString="*.tar") returned 5 [0069.608] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG", pszSpec="*.gzip") returned 0 [0069.608] lstrlenA (lpString="*.gzip") returned 6 [0069.608] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG", pszSpec="*.jpg") returned 1 [0069.608] lstrlenA (lpString="*.jpg") returned 5 [0069.608] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" [0069.608] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" [0069.608] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG." [0069.608] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.BD" [0069.608] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.608] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x423a [0069.608] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae49934e, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.609] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.609] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x41de, lpOverlapped=0x0) returned 1 [0069.650] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG") returned="J0315612.JPG" [0069.650] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.651] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x41de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x41de, lpOverlapped=0x0) returned 1 [0069.651] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.651] CloseHandle (hObject=0x1cc) returned 1 [0069.653] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0315612.jpg.bd")) returned 1 [0069.654] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38ce7f7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4180, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0318448.WMF", cAlternateFileName="")) returned 1 [0069.654] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.654] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0318448.WMF") returned -1 [0069.654] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0318448.WMF") returned -1 [0069.654] lstrcmpiA (lpString1="", lpString2="J0318448.WMF") returned -1 [0069.654] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG") returned="J0315612.JPG" [0069.654] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.654] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.654] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.654] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.654] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0318448.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" [0069.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.zip") returned 0 [0069.654] lstrlenA (lpString="*.zip") returned 5 [0069.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.rar") returned 0 [0069.654] lstrlenA (lpString="*.rar") returned 5 [0069.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.7z") returned 0 [0069.654] lstrlenA (lpString="*.7z") returned 4 [0069.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.tar") returned 0 [0069.654] lstrlenA (lpString="*.tar") returned 5 [0069.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.gzip") returned 0 [0069.654] lstrlenA (lpString="*.gzip") returned 6 [0069.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.jpg") returned 0 [0069.655] lstrlenA (lpString="*.jpg") returned 5 [0069.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.jpeg") returned 0 [0069.655] lstrlenA (lpString="*.jpeg") returned 6 [0069.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.psd") returned 0 [0069.655] lstrlenA (lpString="*.psd") returned 5 [0069.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.cdr") returned 0 [0069.655] lstrlenA (lpString="*.cdr") returned 5 [0069.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.dwg") returned 0 [0069.655] lstrlenA (lpString="*.dwg") returned 5 [0069.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.max") returned 0 [0069.655] lstrlenA (lpString="*.max") returned 5 [0069.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.bmp") returned 0 [0069.655] lstrlenA (lpString="*.bmp") returned 5 [0069.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.gif") returned 0 [0069.655] lstrlenA (lpString="*.gif") returned 5 [0069.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.png") returned 0 [0069.655] lstrlenA (lpString="*.png") returned 5 [0069.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.doc") returned 0 [0069.655] lstrlenA (lpString="*.doc") returned 5 [0069.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.docx") returned 0 [0069.655] lstrlenA (lpString="*.docx") returned 6 [0069.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.xls") returned 0 [0069.655] lstrlenA (lpString="*.xls") returned 5 [0069.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.xlsx") returned 0 [0069.655] lstrlenA (lpString="*.xlsx") returned 6 [0069.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.ppt") returned 0 [0069.655] lstrlenA (lpString="*.ppt") returned 5 [0069.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.pptx") returned 0 [0069.656] lstrlenA (lpString="*.pptx") returned 6 [0069.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.txt") returned 0 [0069.656] lstrlenA (lpString="*.txt") returned 5 [0069.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.pdf") returned 0 [0069.656] lstrlenA (lpString="*.pdf") returned 5 [0069.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.djvu") returned 0 [0069.656] lstrlenA (lpString="*.djvu") returned 6 [0069.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.htm") returned 0 [0069.656] lstrlenA (lpString="*.htm") returned 5 [0069.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.html") returned 0 [0069.656] lstrlenA (lpString="*.html") returned 6 [0069.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.mdb") returned 0 [0069.656] lstrlenA (lpString="*.mdb") returned 5 [0069.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.cer") returned 0 [0069.656] lstrlenA (lpString="*.cer") returned 5 [0069.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.p12") returned 0 [0069.656] lstrlenA (lpString="*.p12") returned 5 [0069.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.pfx") returned 0 [0069.656] lstrlenA (lpString="*.pfx") returned 5 [0069.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.kwm") returned 0 [0069.656] lstrlenA (lpString="*.kwm") returned 5 [0069.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.pwm") returned 0 [0069.656] lstrlenA (lpString="*.pwm") returned 5 [0069.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.1cd") returned 0 [0069.656] lstrlenA (lpString="*.1cd") returned 5 [0069.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.md") returned 0 [0069.657] lstrlenA (lpString="*.md") returned 4 [0069.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.mdf") returned 0 [0069.657] lstrlenA (lpString="*.mdf") returned 5 [0069.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.dbf") returned 0 [0069.657] lstrlenA (lpString="*.dbf") returned 5 [0069.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.odt") returned 0 [0069.657] lstrlenA (lpString="*.odt") returned 5 [0069.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.vob") returned 0 [0069.657] lstrlenA (lpString="*.vob") returned 5 [0069.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.ifo") returned 0 [0069.657] lstrlenA (lpString="*.ifo") returned 5 [0069.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.lnk") returned 0 [0069.657] lstrlenA (lpString="*.lnk") returned 5 [0069.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.torrent") returned 0 [0069.657] lstrlenA (lpString="*.torrent") returned 9 [0069.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.mov") returned 0 [0069.657] lstrlenA (lpString="*.mov") returned 5 [0069.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.m2v") returned 0 [0069.657] lstrlenA (lpString="*.m2v") returned 5 [0069.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.3gp") returned 0 [0069.657] lstrlenA (lpString="*.3gp") returned 5 [0069.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.mpeg") returned 0 [0069.657] lstrlenA (lpString="*.mpeg") returned 6 [0069.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.mpg") returned 0 [0069.657] lstrlenA (lpString="*.mpg") returned 5 [0069.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.flv") returned 0 [0069.657] lstrlenA (lpString="*.flv") returned 5 [0069.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.avi") returned 0 [0069.658] lstrlenA (lpString="*.avi") returned 5 [0069.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.mp4") returned 0 [0069.658] lstrlenA (lpString="*.mp4") returned 5 [0069.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.wmv") returned 0 [0069.658] lstrlenA (lpString="*.wmv") returned 5 [0069.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.divx") returned 0 [0069.658] lstrlenA (lpString="*.divx") returned 6 [0069.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.mkv") returned 0 [0069.658] lstrlenA (lpString="*.mkv") returned 5 [0069.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.mp3") returned 0 [0069.658] lstrlenA (lpString="*.mp3") returned 5 [0069.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.wav") returned 0 [0069.658] lstrlenA (lpString="*.wav") returned 5 [0069.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.flac") returned 0 [0069.658] lstrlenA (lpString="*.flac") returned 6 [0069.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.ape") returned 0 [0069.658] lstrlenA (lpString="*.ape") returned 5 [0069.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.wma") returned 0 [0069.658] lstrlenA (lpString="*.wma") returned 5 [0069.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.ac3") returned 0 [0069.658] lstrlenA (lpString="*.ac3") returned 5 [0069.658] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae49cd9b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0318804.WMF", cAlternateFileName="")) returned 1 [0069.658] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.658] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0318804.WMF") returned -1 [0069.658] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0318804.WMF") returned -1 [0069.658] lstrcmpiA (lpString1="", lpString2="J0318804.WMF") returned -1 [0069.658] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF") returned="J0318448.WMF" [0069.659] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.659] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.659] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.659] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.659] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0318804.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" [0069.659] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.zip") returned 0 [0069.659] lstrlenA (lpString="*.zip") returned 5 [0069.659] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.rar") returned 0 [0069.659] lstrlenA (lpString="*.rar") returned 5 [0069.659] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.7z") returned 0 [0069.659] lstrlenA (lpString="*.7z") returned 4 [0069.659] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.tar") returned 0 [0069.659] lstrlenA (lpString="*.tar") returned 5 [0069.659] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.gzip") returned 0 [0069.659] lstrlenA (lpString="*.gzip") returned 6 [0069.659] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.jpg") returned 0 [0069.659] lstrlenA (lpString="*.jpg") returned 5 [0069.659] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.jpeg") returned 0 [0069.659] lstrlenA (lpString="*.jpeg") returned 6 [0069.659] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.psd") returned 0 [0069.659] lstrlenA (lpString="*.psd") returned 5 [0069.659] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.cdr") returned 0 [0069.659] lstrlenA (lpString="*.cdr") returned 5 [0069.659] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.dwg") returned 0 [0069.660] lstrlenA (lpString="*.dwg") returned 5 [0069.660] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.max") returned 0 [0069.660] lstrlenA (lpString="*.max") returned 5 [0069.660] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.bmp") returned 0 [0069.660] lstrlenA (lpString="*.bmp") returned 5 [0069.660] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.gif") returned 0 [0069.660] lstrlenA (lpString="*.gif") returned 5 [0069.660] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.png") returned 0 [0069.660] lstrlenA (lpString="*.png") returned 5 [0069.660] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.doc") returned 0 [0069.660] lstrlenA (lpString="*.doc") returned 5 [0069.660] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.docx") returned 0 [0069.660] lstrlenA (lpString="*.docx") returned 6 [0069.660] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.xls") returned 0 [0069.660] lstrlenA (lpString="*.xls") returned 5 [0069.660] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.xlsx") returned 0 [0069.660] lstrlenA (lpString="*.xlsx") returned 6 [0069.660] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.ppt") returned 0 [0069.660] lstrlenA (lpString="*.ppt") returned 5 [0069.660] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.pptx") returned 0 [0069.660] lstrlenA (lpString="*.pptx") returned 6 [0069.660] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.txt") returned 0 [0069.660] lstrlenA (lpString="*.txt") returned 5 [0069.660] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.pdf") returned 0 [0069.660] lstrlenA (lpString="*.pdf") returned 5 [0069.660] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.djvu") returned 0 [0069.660] lstrlenA (lpString="*.djvu") returned 6 [0069.660] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.htm") returned 0 [0069.661] lstrlenA (lpString="*.htm") returned 5 [0069.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.html") returned 0 [0069.661] lstrlenA (lpString="*.html") returned 6 [0069.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.mdb") returned 0 [0069.661] lstrlenA (lpString="*.mdb") returned 5 [0069.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.cer") returned 0 [0069.661] lstrlenA (lpString="*.cer") returned 5 [0069.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.p12") returned 0 [0069.661] lstrlenA (lpString="*.p12") returned 5 [0069.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.pfx") returned 0 [0069.661] lstrlenA (lpString="*.pfx") returned 5 [0069.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.kwm") returned 0 [0069.661] lstrlenA (lpString="*.kwm") returned 5 [0069.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.pwm") returned 0 [0069.661] lstrlenA (lpString="*.pwm") returned 5 [0069.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.1cd") returned 0 [0069.661] lstrlenA (lpString="*.1cd") returned 5 [0069.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.md") returned 0 [0069.661] lstrlenA (lpString="*.md") returned 4 [0069.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.mdf") returned 0 [0069.661] lstrlenA (lpString="*.mdf") returned 5 [0069.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.dbf") returned 0 [0069.661] lstrlenA (lpString="*.dbf") returned 5 [0069.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.odt") returned 0 [0069.661] lstrlenA (lpString="*.odt") returned 5 [0069.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.vob") returned 0 [0069.662] lstrlenA (lpString="*.vob") returned 5 [0069.662] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.ifo") returned 0 [0069.662] lstrlenA (lpString="*.ifo") returned 5 [0069.662] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.lnk") returned 0 [0069.662] lstrlenA (lpString="*.lnk") returned 5 [0069.662] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.torrent") returned 0 [0069.662] lstrlenA (lpString="*.torrent") returned 9 [0069.662] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.mov") returned 0 [0069.662] lstrlenA (lpString="*.mov") returned 5 [0069.662] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.m2v") returned 0 [0069.662] lstrlenA (lpString="*.m2v") returned 5 [0069.662] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.3gp") returned 0 [0069.662] lstrlenA (lpString="*.3gp") returned 5 [0069.662] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.mpeg") returned 0 [0069.662] lstrlenA (lpString="*.mpeg") returned 6 [0069.662] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.mpg") returned 0 [0069.662] lstrlenA (lpString="*.mpg") returned 5 [0069.662] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.flv") returned 0 [0069.662] lstrlenA (lpString="*.flv") returned 5 [0069.662] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.avi") returned 0 [0069.662] lstrlenA (lpString="*.avi") returned 5 [0069.662] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.mp4") returned 0 [0069.662] lstrlenA (lpString="*.mp4") returned 5 [0069.662] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.wmv") returned 0 [0069.662] lstrlenA (lpString="*.wmv") returned 5 [0069.662] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.divx") returned 0 [0069.662] lstrlenA (lpString="*.divx") returned 6 [0069.663] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.mkv") returned 0 [0069.663] lstrlenA (lpString="*.mkv") returned 5 [0069.663] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.mp3") returned 0 [0069.663] lstrlenA (lpString="*.mp3") returned 5 [0069.663] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.wav") returned 0 [0069.663] lstrlenA (lpString="*.wav") returned 5 [0069.663] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.flac") returned 0 [0069.663] lstrlenA (lpString="*.flac") returned 6 [0069.663] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.ape") returned 0 [0069.663] lstrlenA (lpString="*.ape") returned 5 [0069.663] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.wma") returned 0 [0069.663] lstrlenA (lpString="*.wma") returned 5 [0069.663] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.ac3") returned 0 [0069.663] lstrlenA (lpString="*.ac3") returned 5 [0069.663] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38d361e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x28be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0318810.WMF", cAlternateFileName="")) returned 1 [0069.663] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.663] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0318810.WMF") returned -1 [0069.663] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0318810.WMF") returned -1 [0069.663] lstrcmpiA (lpString1="", lpString2="J0318810.WMF") returned -1 [0069.663] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF") returned="J0318804.WMF" [0069.663] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.663] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.663] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.663] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.664] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0318810.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" [0069.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.zip") returned 0 [0069.664] lstrlenA (lpString="*.zip") returned 5 [0069.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.rar") returned 0 [0069.664] lstrlenA (lpString="*.rar") returned 5 [0069.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.7z") returned 0 [0069.664] lstrlenA (lpString="*.7z") returned 4 [0069.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.tar") returned 0 [0069.664] lstrlenA (lpString="*.tar") returned 5 [0069.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.gzip") returned 0 [0069.664] lstrlenA (lpString="*.gzip") returned 6 [0069.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.jpg") returned 0 [0069.664] lstrlenA (lpString="*.jpg") returned 5 [0069.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.jpeg") returned 0 [0069.664] lstrlenA (lpString="*.jpeg") returned 6 [0069.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.psd") returned 0 [0069.664] lstrlenA (lpString="*.psd") returned 5 [0069.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.cdr") returned 0 [0069.664] lstrlenA (lpString="*.cdr") returned 5 [0069.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.dwg") returned 0 [0069.664] lstrlenA (lpString="*.dwg") returned 5 [0069.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.max") returned 0 [0069.664] lstrlenA (lpString="*.max") returned 5 [0069.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.bmp") returned 0 [0069.664] lstrlenA (lpString="*.bmp") returned 5 [0069.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.gif") returned 0 [0069.665] lstrlenA (lpString="*.gif") returned 5 [0069.665] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.png") returned 0 [0069.665] lstrlenA (lpString="*.png") returned 5 [0069.666] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.doc") returned 0 [0069.666] lstrlenA (lpString="*.doc") returned 5 [0069.666] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.docx") returned 0 [0069.666] lstrlenA (lpString="*.docx") returned 6 [0069.666] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.xls") returned 0 [0069.666] lstrlenA (lpString="*.xls") returned 5 [0069.666] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.xlsx") returned 0 [0069.666] lstrlenA (lpString="*.xlsx") returned 6 [0069.666] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.ppt") returned 0 [0069.666] lstrlenA (lpString="*.ppt") returned 5 [0069.666] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.pptx") returned 0 [0069.666] lstrlenA (lpString="*.pptx") returned 6 [0069.666] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.txt") returned 0 [0069.666] lstrlenA (lpString="*.txt") returned 5 [0069.666] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.pdf") returned 0 [0069.666] lstrlenA (lpString="*.pdf") returned 5 [0069.666] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.djvu") returned 0 [0069.666] lstrlenA (lpString="*.djvu") returned 6 [0069.666] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.htm") returned 0 [0069.666] lstrlenA (lpString="*.htm") returned 5 [0069.666] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.html") returned 0 [0069.666] lstrlenA (lpString="*.html") returned 6 [0069.666] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.mdb") returned 0 [0069.666] lstrlenA (lpString="*.mdb") returned 5 [0069.666] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.cer") returned 0 [0069.667] lstrlenA (lpString="*.cer") returned 5 [0069.667] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.p12") returned 0 [0069.667] lstrlenA (lpString="*.p12") returned 5 [0069.667] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.pfx") returned 0 [0069.667] lstrlenA (lpString="*.pfx") returned 5 [0069.667] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.kwm") returned 0 [0069.667] lstrlenA (lpString="*.kwm") returned 5 [0069.667] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.pwm") returned 0 [0069.667] lstrlenA (lpString="*.pwm") returned 5 [0069.667] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.1cd") returned 0 [0069.667] lstrlenA (lpString="*.1cd") returned 5 [0069.667] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.md") returned 0 [0069.667] lstrlenA (lpString="*.md") returned 4 [0069.667] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.mdf") returned 0 [0069.667] lstrlenA (lpString="*.mdf") returned 5 [0069.667] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.dbf") returned 0 [0069.667] lstrlenA (lpString="*.dbf") returned 5 [0069.667] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.odt") returned 0 [0069.667] lstrlenA (lpString="*.odt") returned 5 [0069.667] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.vob") returned 0 [0069.667] lstrlenA (lpString="*.vob") returned 5 [0069.667] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.ifo") returned 0 [0069.667] lstrlenA (lpString="*.ifo") returned 5 [0069.667] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.lnk") returned 0 [0069.667] lstrlenA (lpString="*.lnk") returned 5 [0069.667] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.torrent") returned 0 [0069.668] lstrlenA (lpString="*.torrent") returned 9 [0069.668] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.mov") returned 0 [0069.668] lstrlenA (lpString="*.mov") returned 5 [0069.668] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.m2v") returned 0 [0069.668] lstrlenA (lpString="*.m2v") returned 5 [0069.668] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.3gp") returned 0 [0069.668] lstrlenA (lpString="*.3gp") returned 5 [0069.668] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.mpeg") returned 0 [0069.668] lstrlenA (lpString="*.mpeg") returned 6 [0069.668] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.mpg") returned 0 [0069.668] lstrlenA (lpString="*.mpg") returned 5 [0069.668] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.flv") returned 0 [0069.668] lstrlenA (lpString="*.flv") returned 5 [0069.668] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.avi") returned 0 [0069.668] lstrlenA (lpString="*.avi") returned 5 [0069.668] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.mp4") returned 0 [0069.668] lstrlenA (lpString="*.mp4") returned 5 [0069.668] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.wmv") returned 0 [0069.668] lstrlenA (lpString="*.wmv") returned 5 [0069.668] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.divx") returned 0 [0069.668] lstrlenA (lpString="*.divx") returned 6 [0069.668] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.mkv") returned 0 [0069.668] lstrlenA (lpString="*.mkv") returned 5 [0069.668] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.mp3") returned 0 [0069.668] lstrlenA (lpString="*.mp3") returned 5 [0069.668] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.wav") returned 0 [0069.668] lstrlenA (lpString="*.wav") returned 5 [0069.669] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.flac") returned 0 [0069.669] lstrlenA (lpString="*.flac") returned 6 [0069.669] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.ape") returned 0 [0069.669] lstrlenA (lpString="*.ape") returned 5 [0069.669] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.wma") returned 0 [0069.669] lstrlenA (lpString="*.wma") returned 5 [0069.669] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.ac3") returned 0 [0069.669] lstrlenA (lpString="*.ac3") returned 5 [0069.669] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4a42c3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x24d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0321179.JPG", cAlternateFileName="")) returned 1 [0069.669] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.669] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0321179.JPG") returned -1 [0069.669] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0321179.JPG") returned -1 [0069.669] lstrcmpiA (lpString1="", lpString2="J0321179.JPG") returned -1 [0069.669] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF") returned="J0318810.WMF" [0069.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.669] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.669] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.669] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.669] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0321179.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" [0069.669] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG", pszSpec="*.zip") returned 0 [0069.669] lstrlenA (lpString="*.zip") returned 5 [0069.669] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG", pszSpec="*.rar") returned 0 [0069.669] lstrlenA (lpString="*.rar") returned 5 [0069.670] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG", pszSpec="*.7z") returned 0 [0069.670] lstrlenA (lpString="*.7z") returned 4 [0069.670] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG", pszSpec="*.tar") returned 0 [0069.670] lstrlenA (lpString="*.tar") returned 5 [0069.670] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG", pszSpec="*.gzip") returned 0 [0069.670] lstrlenA (lpString="*.gzip") returned 6 [0069.670] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG", pszSpec="*.jpg") returned 1 [0069.670] lstrlenA (lpString="*.jpg") returned 5 [0069.670] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" [0069.670] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" [0069.670] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG." [0069.670] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.BD" [0069.670] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.671] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24d7 [0069.671] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae4a42c3, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.671] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.671] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x247b, lpOverlapped=0x0) returned 1 [0069.673] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG") returned="J0321179.JPG" [0069.673] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.673] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x247b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x247b, lpOverlapped=0x0) returned 1 [0069.674] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.674] CloseHandle (hObject=0x1cc) returned 1 [0069.675] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0321179.jpg.bd")) returned 1 [0069.675] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38dab98, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2ff8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0324694.WMF", cAlternateFileName="")) returned 1 [0069.675] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.676] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0324694.WMF") returned -1 [0069.676] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0324694.WMF") returned -1 [0069.676] lstrcmpiA (lpString1="", lpString2="J0324694.WMF") returned -1 [0069.676] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG") returned="J0321179.JPG" [0069.676] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.676] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.676] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.676] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.676] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0324694.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" [0069.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.zip") returned 0 [0069.676] lstrlenA (lpString="*.zip") returned 5 [0069.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.rar") returned 0 [0069.676] lstrlenA (lpString="*.rar") returned 5 [0069.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.7z") returned 0 [0069.676] lstrlenA (lpString="*.7z") returned 4 [0069.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.tar") returned 0 [0069.676] lstrlenA (lpString="*.tar") returned 5 [0069.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.gzip") returned 0 [0069.676] lstrlenA (lpString="*.gzip") returned 6 [0069.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.jpg") returned 0 [0069.676] lstrlenA (lpString="*.jpg") returned 5 [0069.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.jpeg") returned 0 [0069.676] lstrlenA (lpString="*.jpeg") returned 6 [0069.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.psd") returned 0 [0069.676] lstrlenA (lpString="*.psd") returned 5 [0069.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.cdr") returned 0 [0069.676] lstrlenA (lpString="*.cdr") returned 5 [0069.677] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.dwg") returned 0 [0069.677] lstrlenA (lpString="*.dwg") returned 5 [0069.677] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.max") returned 0 [0069.677] lstrlenA (lpString="*.max") returned 5 [0069.677] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.bmp") returned 0 [0069.677] lstrlenA (lpString="*.bmp") returned 5 [0069.677] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.gif") returned 0 [0069.677] lstrlenA (lpString="*.gif") returned 5 [0069.677] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.png") returned 0 [0069.677] lstrlenA (lpString="*.png") returned 5 [0069.677] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.doc") returned 0 [0069.677] lstrlenA (lpString="*.doc") returned 5 [0069.677] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.docx") returned 0 [0069.677] lstrlenA (lpString="*.docx") returned 6 [0069.677] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.xls") returned 0 [0069.677] lstrlenA (lpString="*.xls") returned 5 [0069.677] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.xlsx") returned 0 [0069.677] lstrlenA (lpString="*.xlsx") returned 6 [0069.677] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.ppt") returned 0 [0069.677] lstrlenA (lpString="*.ppt") returned 5 [0069.677] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.pptx") returned 0 [0069.677] lstrlenA (lpString="*.pptx") returned 6 [0069.677] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.txt") returned 0 [0069.677] lstrlenA (lpString="*.txt") returned 5 [0069.677] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.pdf") returned 0 [0069.677] lstrlenA (lpString="*.pdf") returned 5 [0069.677] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.djvu") returned 0 [0069.677] lstrlenA (lpString="*.djvu") returned 6 [0069.677] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.htm") returned 0 [0069.677] lstrlenA (lpString="*.htm") returned 5 [0069.677] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.html") returned 0 [0069.677] lstrlenA (lpString="*.html") returned 6 [0069.677] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.mdb") returned 0 [0069.678] lstrlenA (lpString="*.mdb") returned 5 [0069.678] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.cer") returned 0 [0069.678] lstrlenA (lpString="*.cer") returned 5 [0069.678] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.p12") returned 0 [0069.678] lstrlenA (lpString="*.p12") returned 5 [0069.678] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.pfx") returned 0 [0069.678] lstrlenA (lpString="*.pfx") returned 5 [0069.678] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.kwm") returned 0 [0069.678] lstrlenA (lpString="*.kwm") returned 5 [0069.678] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.pwm") returned 0 [0069.678] lstrlenA (lpString="*.pwm") returned 5 [0069.678] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.1cd") returned 0 [0069.678] lstrlenA (lpString="*.1cd") returned 5 [0069.678] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.md") returned 0 [0069.678] lstrlenA (lpString="*.md") returned 4 [0069.678] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.mdf") returned 0 [0069.678] lstrlenA (lpString="*.mdf") returned 5 [0069.678] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.dbf") returned 0 [0069.678] lstrlenA (lpString="*.dbf") returned 5 [0069.678] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.odt") returned 0 [0069.678] lstrlenA (lpString="*.odt") returned 5 [0069.678] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.vob") returned 0 [0069.678] lstrlenA (lpString="*.vob") returned 5 [0069.678] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.ifo") returned 0 [0069.678] lstrlenA (lpString="*.ifo") returned 5 [0069.678] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.lnk") returned 0 [0069.678] lstrlenA (lpString="*.lnk") returned 5 [0069.678] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.torrent") returned 0 [0069.678] lstrlenA (lpString="*.torrent") returned 9 [0069.678] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.mov") returned 0 [0069.678] lstrlenA (lpString="*.mov") returned 5 [0069.678] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.m2v") returned 0 [0069.678] lstrlenA (lpString="*.m2v") returned 5 [0069.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.3gp") returned 0 [0069.679] lstrlenA (lpString="*.3gp") returned 5 [0069.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.mpeg") returned 0 [0069.679] lstrlenA (lpString="*.mpeg") returned 6 [0069.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.mpg") returned 0 [0069.679] lstrlenA (lpString="*.mpg") returned 5 [0069.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.flv") returned 0 [0069.679] lstrlenA (lpString="*.flv") returned 5 [0069.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.avi") returned 0 [0069.679] lstrlenA (lpString="*.avi") returned 5 [0069.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.mp4") returned 0 [0069.679] lstrlenA (lpString="*.mp4") returned 5 [0069.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.wmv") returned 0 [0069.679] lstrlenA (lpString="*.wmv") returned 5 [0069.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.divx") returned 0 [0069.679] lstrlenA (lpString="*.divx") returned 6 [0069.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.mkv") returned 0 [0069.679] lstrlenA (lpString="*.mkv") returned 5 [0069.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.mp3") returned 0 [0069.679] lstrlenA (lpString="*.mp3") returned 5 [0069.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.wav") returned 0 [0069.679] lstrlenA (lpString="*.wav") returned 5 [0069.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.flac") returned 0 [0069.679] lstrlenA (lpString="*.flac") returned 6 [0069.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.ape") returned 0 [0069.679] lstrlenA (lpString="*.ape") returned 5 [0069.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.wma") returned 0 [0069.679] lstrlenA (lpString="*.wma") returned 5 [0069.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.ac3") returned 0 [0069.679] lstrlenA (lpString="*.ac3") returned 5 [0069.679] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38df936, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2e7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0324704.WMF", cAlternateFileName="")) returned 1 [0069.679] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.679] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0324704.WMF") returned -1 [0069.680] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0324704.WMF") returned -1 [0069.680] lstrcmpiA (lpString1="", lpString2="J0324704.WMF") returned -1 [0069.680] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF") returned="J0324694.WMF" [0069.680] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.680] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.680] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.680] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.680] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0324704.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" [0069.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.zip") returned 0 [0069.680] lstrlenA (lpString="*.zip") returned 5 [0069.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.rar") returned 0 [0069.680] lstrlenA (lpString="*.rar") returned 5 [0069.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.7z") returned 0 [0069.680] lstrlenA (lpString="*.7z") returned 4 [0069.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.tar") returned 0 [0069.680] lstrlenA (lpString="*.tar") returned 5 [0069.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.gzip") returned 0 [0069.680] lstrlenA (lpString="*.gzip") returned 6 [0069.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.jpg") returned 0 [0069.680] lstrlenA (lpString="*.jpg") returned 5 [0069.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.jpeg") returned 0 [0069.680] lstrlenA (lpString="*.jpeg") returned 6 [0069.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.psd") returned 0 [0069.681] lstrlenA (lpString="*.psd") returned 5 [0069.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.cdr") returned 0 [0069.681] lstrlenA (lpString="*.cdr") returned 5 [0069.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.dwg") returned 0 [0069.681] lstrlenA (lpString="*.dwg") returned 5 [0069.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.max") returned 0 [0069.681] lstrlenA (lpString="*.max") returned 5 [0069.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.bmp") returned 0 [0069.681] lstrlenA (lpString="*.bmp") returned 5 [0069.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.gif") returned 0 [0069.681] lstrlenA (lpString="*.gif") returned 5 [0069.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.png") returned 0 [0069.681] lstrlenA (lpString="*.png") returned 5 [0069.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.doc") returned 0 [0069.681] lstrlenA (lpString="*.doc") returned 5 [0069.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.docx") returned 0 [0069.681] lstrlenA (lpString="*.docx") returned 6 [0069.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.xls") returned 0 [0069.681] lstrlenA (lpString="*.xls") returned 5 [0069.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.xlsx") returned 0 [0069.681] lstrlenA (lpString="*.xlsx") returned 6 [0069.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.ppt") returned 0 [0069.681] lstrlenA (lpString="*.ppt") returned 5 [0069.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.pptx") returned 0 [0069.681] lstrlenA (lpString="*.pptx") returned 6 [0069.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.txt") returned 0 [0069.681] lstrlenA (lpString="*.txt") returned 5 [0069.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.pdf") returned 0 [0069.682] lstrlenA (lpString="*.pdf") returned 5 [0069.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.djvu") returned 0 [0069.682] lstrlenA (lpString="*.djvu") returned 6 [0069.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.htm") returned 0 [0069.682] lstrlenA (lpString="*.htm") returned 5 [0069.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.html") returned 0 [0069.682] lstrlenA (lpString="*.html") returned 6 [0069.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.mdb") returned 0 [0069.682] lstrlenA (lpString="*.mdb") returned 5 [0069.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.cer") returned 0 [0069.682] lstrlenA (lpString="*.cer") returned 5 [0069.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.p12") returned 0 [0069.682] lstrlenA (lpString="*.p12") returned 5 [0069.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.pfx") returned 0 [0069.682] lstrlenA (lpString="*.pfx") returned 5 [0069.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.kwm") returned 0 [0069.682] lstrlenA (lpString="*.kwm") returned 5 [0069.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.pwm") returned 0 [0069.682] lstrlenA (lpString="*.pwm") returned 5 [0069.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.1cd") returned 0 [0069.682] lstrlenA (lpString="*.1cd") returned 5 [0069.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.md") returned 0 [0069.682] lstrlenA (lpString="*.md") returned 4 [0069.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.mdf") returned 0 [0069.682] lstrlenA (lpString="*.mdf") returned 5 [0069.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.dbf") returned 0 [0069.682] lstrlenA (lpString="*.dbf") returned 5 [0069.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.odt") returned 0 [0069.682] lstrlenA (lpString="*.odt") returned 5 [0069.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.vob") returned 0 [0069.683] lstrlenA (lpString="*.vob") returned 5 [0069.683] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.ifo") returned 0 [0069.683] lstrlenA (lpString="*.ifo") returned 5 [0069.683] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.lnk") returned 0 [0069.683] lstrlenA (lpString="*.lnk") returned 5 [0069.683] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.torrent") returned 0 [0069.683] lstrlenA (lpString="*.torrent") returned 9 [0069.683] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.mov") returned 0 [0069.683] lstrlenA (lpString="*.mov") returned 5 [0069.683] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.m2v") returned 0 [0069.683] lstrlenA (lpString="*.m2v") returned 5 [0069.683] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.3gp") returned 0 [0069.683] lstrlenA (lpString="*.3gp") returned 5 [0069.683] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.mpeg") returned 0 [0069.683] lstrlenA (lpString="*.mpeg") returned 6 [0069.683] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.mpg") returned 0 [0069.683] lstrlenA (lpString="*.mpg") returned 5 [0069.683] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.flv") returned 0 [0069.683] lstrlenA (lpString="*.flv") returned 5 [0069.683] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.avi") returned 0 [0069.683] lstrlenA (lpString="*.avi") returned 5 [0069.683] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.mp4") returned 0 [0069.683] lstrlenA (lpString="*.mp4") returned 5 [0069.683] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.wmv") returned 0 [0069.683] lstrlenA (lpString="*.wmv") returned 5 [0069.683] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.divx") returned 0 [0069.683] lstrlenA (lpString="*.divx") returned 6 [0069.683] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.mkv") returned 0 [0069.684] lstrlenA (lpString="*.mkv") returned 5 [0069.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.mp3") returned 0 [0069.684] lstrlenA (lpString="*.mp3") returned 5 [0069.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.wav") returned 0 [0069.684] lstrlenA (lpString="*.wav") returned 5 [0069.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.flac") returned 0 [0069.684] lstrlenA (lpString="*.flac") returned 6 [0069.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.ape") returned 0 [0069.684] lstrlenA (lpString="*.ape") returned 5 [0069.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.wma") returned 0 [0069.684] lstrlenA (lpString="*.wma") returned 5 [0069.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.ac3") returned 0 [0069.684] lstrlenA (lpString="*.ac3") returned 5 [0069.684] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38e477c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3260, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0337280.JPG", cAlternateFileName="")) returned 1 [0069.729] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.729] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0337280.JPG") returned -1 [0069.729] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0337280.JPG") returned -1 [0069.729] lstrcmpiA (lpString1="", lpString2="J0337280.JPG") returned -1 [0069.730] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF") returned="J0324704.WMF" [0069.730] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.730] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.730] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.730] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.730] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0337280.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" [0069.730] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG", pszSpec="*.zip") returned 0 [0069.730] lstrlenA (lpString="*.zip") returned 5 [0069.730] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG", pszSpec="*.rar") returned 0 [0069.730] lstrlenA (lpString="*.rar") returned 5 [0069.730] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG", pszSpec="*.7z") returned 0 [0069.730] lstrlenA (lpString="*.7z") returned 4 [0069.730] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG", pszSpec="*.tar") returned 0 [0069.730] lstrlenA (lpString="*.tar") returned 5 [0069.730] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG", pszSpec="*.gzip") returned 0 [0069.730] lstrlenA (lpString="*.gzip") returned 6 [0069.730] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG", pszSpec="*.jpg") returned 1 [0069.730] lstrlenA (lpString="*.jpg") returned 5 [0069.730] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" [0069.730] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" [0069.730] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG." [0069.730] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.BD" [0069.730] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.731] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3260 [0069.731] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc38e477c, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.731] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.731] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x3204, lpOverlapped=0x0) returned 1 [0069.733] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG") returned="J0337280.JPG" [0069.733] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.733] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x3204, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x3204, lpOverlapped=0x0) returned 1 [0069.734] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.734] CloseHandle (hObject=0x1cc) returned 1 [0069.735] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0337280.jpg.bd")) returned 1 [0069.735] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38ea90e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x27d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341328.JPG", cAlternateFileName="")) returned 1 [0069.736] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.736] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0341328.JPG") returned -1 [0069.736] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0341328.JPG") returned -1 [0069.736] lstrcmpiA (lpString1="", lpString2="J0341328.JPG") returned -1 [0069.736] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG") returned="J0337280.JPG" [0069.736] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.736] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.736] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.736] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.736] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0341328.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" [0069.736] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG", pszSpec="*.zip") returned 0 [0069.736] lstrlenA (lpString="*.zip") returned 5 [0069.736] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG", pszSpec="*.rar") returned 0 [0069.736] lstrlenA (lpString="*.rar") returned 5 [0069.736] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG", pszSpec="*.7z") returned 0 [0069.736] lstrlenA (lpString="*.7z") returned 4 [0069.736] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG", pszSpec="*.tar") returned 0 [0069.736] lstrlenA (lpString="*.tar") returned 5 [0069.736] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG", pszSpec="*.gzip") returned 0 [0069.736] lstrlenA (lpString="*.gzip") returned 6 [0069.736] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG", pszSpec="*.jpg") returned 1 [0069.736] lstrlenA (lpString="*.jpg") returned 5 [0069.736] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" [0069.736] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" [0069.736] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG." [0069.736] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.BD" [0069.736] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.738] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x27d4 [0069.738] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc38ea90e, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.738] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.738] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x2778, lpOverlapped=0x0) returned 1 [0069.743] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG") returned="J0341328.JPG" [0069.744] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.744] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x2778, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x2778, lpOverlapped=0x0) returned 1 [0069.744] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.744] CloseHandle (hObject=0x1cc) returned 1 [0069.745] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341328.jpg.bd")) returned 1 [0069.746] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38ef8cc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2cdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341344.JPG", cAlternateFileName="")) returned 1 [0069.746] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.746] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0341344.JPG") returned -1 [0069.746] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0341344.JPG") returned -1 [0069.746] lstrcmpiA (lpString1="", lpString2="J0341344.JPG") returned -1 [0069.746] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG") returned="J0341328.JPG" [0069.746] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.746] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.746] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.746] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.746] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0341344.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" [0069.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG", pszSpec="*.zip") returned 0 [0069.746] lstrlenA (lpString="*.zip") returned 5 [0069.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG", pszSpec="*.rar") returned 0 [0069.746] lstrlenA (lpString="*.rar") returned 5 [0069.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG", pszSpec="*.7z") returned 0 [0069.746] lstrlenA (lpString="*.7z") returned 4 [0069.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG", pszSpec="*.tar") returned 0 [0069.746] lstrlenA (lpString="*.tar") returned 5 [0069.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG", pszSpec="*.gzip") returned 0 [0069.746] lstrlenA (lpString="*.gzip") returned 6 [0069.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG", pszSpec="*.jpg") returned 1 [0069.746] lstrlenA (lpString="*.jpg") returned 5 [0069.746] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" [0069.746] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" [0069.746] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG." [0069.747] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.BD" [0069.747] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.747] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2cdd [0069.747] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc38ef8cc, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.747] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.747] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x2c81, lpOverlapped=0x0) returned 1 [0069.748] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG") returned="J0341344.JPG" [0069.749] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.749] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x2c81, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x2c81, lpOverlapped=0x0) returned 1 [0069.749] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.749] CloseHandle (hObject=0x1cc) returned 1 [0069.750] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341344.jpg.bd")) returned 1 [0069.750] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4a9130, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4c6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341439.JPG", cAlternateFileName="")) returned 1 [0069.751] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.751] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0341439.JPG") returned -1 [0069.751] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0341439.JPG") returned -1 [0069.751] lstrcmpiA (lpString1="", lpString2="J0341439.JPG") returned -1 [0069.751] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG") returned="J0341344.JPG" [0069.751] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.751] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.751] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.751] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.751] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0341439.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" [0069.751] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG", pszSpec="*.zip") returned 0 [0069.751] lstrlenA (lpString="*.zip") returned 5 [0069.751] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG", pszSpec="*.rar") returned 0 [0069.751] lstrlenA (lpString="*.rar") returned 5 [0069.751] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG", pszSpec="*.7z") returned 0 [0069.751] lstrlenA (lpString="*.7z") returned 4 [0069.751] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG", pszSpec="*.tar") returned 0 [0069.751] lstrlenA (lpString="*.tar") returned 5 [0069.751] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG", pszSpec="*.gzip") returned 0 [0069.751] lstrlenA (lpString="*.gzip") returned 6 [0069.751] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG", pszSpec="*.jpg") returned 1 [0069.751] lstrlenA (lpString="*.jpg") returned 5 [0069.751] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" [0069.751] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" [0069.751] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG." [0069.751] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.BD" [0069.751] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.752] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4c6d [0069.752] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae4a9130, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.752] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.752] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x4c11, lpOverlapped=0x0) returned 1 [0069.753] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG") returned="J0341439.JPG" [0069.754] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.754] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x4c11, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x4c11, lpOverlapped=0x0) returned 1 [0069.754] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.754] CloseHandle (hObject=0x1cc) returned 1 [0069.755] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341439.jpg.bd")) returned 1 [0069.756] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4b060a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341447.JPG", cAlternateFileName="")) returned 1 [0069.756] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.756] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0341447.JPG") returned -1 [0069.756] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0341447.JPG") returned -1 [0069.756] lstrcmpiA (lpString1="", lpString2="J0341447.JPG") returned -1 [0069.756] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG") returned="J0341439.JPG" [0069.756] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.756] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.756] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.756] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.756] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0341447.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" [0069.756] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG", pszSpec="*.zip") returned 0 [0069.756] lstrlenA (lpString="*.zip") returned 5 [0069.756] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG", pszSpec="*.rar") returned 0 [0069.756] lstrlenA (lpString="*.rar") returned 5 [0069.756] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG", pszSpec="*.7z") returned 0 [0069.756] lstrlenA (lpString="*.7z") returned 4 [0069.756] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG", pszSpec="*.tar") returned 0 [0069.756] lstrlenA (lpString="*.tar") returned 5 [0069.756] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG", pszSpec="*.gzip") returned 0 [0069.756] lstrlenA (lpString="*.gzip") returned 6 [0069.756] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG", pszSpec="*.jpg") returned 1 [0069.756] lstrlenA (lpString="*.jpg") returned 5 [0069.756] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" [0069.757] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" [0069.757] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG." [0069.757] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.BD" [0069.757] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.757] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ad8 [0069.757] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae4b060a, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.757] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.757] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x4a7c, lpOverlapped=0x0) returned 1 [0069.759] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG") returned="J0341447.JPG" [0069.759] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.759] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x4a7c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x4a7c, lpOverlapped=0x0) returned 1 [0069.759] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.760] CloseHandle (hObject=0x1cc) returned 1 [0069.761] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341447.jpg.bd")) returned 1 [0069.761] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38f58f9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x52c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341448.JPG", cAlternateFileName="")) returned 1 [0069.761] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.761] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0341448.JPG") returned -1 [0069.762] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0341448.JPG") returned -1 [0069.762] lstrcmpiA (lpString1="", lpString2="J0341448.JPG") returned -1 [0069.762] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG") returned="J0341447.JPG" [0069.762] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.762] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.762] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.762] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.762] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0341448.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" [0069.762] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG", pszSpec="*.zip") returned 0 [0069.762] lstrlenA (lpString="*.zip") returned 5 [0069.762] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG", pszSpec="*.rar") returned 0 [0069.762] lstrlenA (lpString="*.rar") returned 5 [0069.762] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG", pszSpec="*.7z") returned 0 [0069.762] lstrlenA (lpString="*.7z") returned 4 [0069.762] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG", pszSpec="*.tar") returned 0 [0069.762] lstrlenA (lpString="*.tar") returned 5 [0069.762] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG", pszSpec="*.gzip") returned 0 [0069.762] lstrlenA (lpString="*.gzip") returned 6 [0069.762] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG", pszSpec="*.jpg") returned 1 [0069.762] lstrlenA (lpString="*.jpg") returned 5 [0069.762] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" [0069.762] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" [0069.762] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG." [0069.762] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.BD" [0069.762] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.763] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x52c3 [0069.763] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc38f58f9, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.763] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.763] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x5267, lpOverlapped=0x0) returned 1 [0069.765] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG") returned="J0341448.JPG" [0069.766] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.766] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x5267, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x5267, lpOverlapped=0x0) returned 1 [0069.766] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.766] CloseHandle (hObject=0x1cc) returned 1 [0069.768] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341448.jpg.bd")) returned 1 [0069.768] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38fa6fd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7457, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341455.JPG", cAlternateFileName="")) returned 1 [0069.768] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.768] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0341455.JPG") returned -1 [0069.768] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0341455.JPG") returned -1 [0069.768] lstrcmpiA (lpString1="", lpString2="J0341455.JPG") returned -1 [0069.768] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG") returned="J0341448.JPG" [0069.768] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.768] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.768] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.769] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.769] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0341455.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" [0069.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG", pszSpec="*.zip") returned 0 [0069.769] lstrlenA (lpString="*.zip") returned 5 [0069.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG", pszSpec="*.rar") returned 0 [0069.769] lstrlenA (lpString="*.rar") returned 5 [0069.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG", pszSpec="*.7z") returned 0 [0069.769] lstrlenA (lpString="*.7z") returned 4 [0069.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG", pszSpec="*.tar") returned 0 [0069.769] lstrlenA (lpString="*.tar") returned 5 [0069.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG", pszSpec="*.gzip") returned 0 [0069.769] lstrlenA (lpString="*.gzip") returned 6 [0069.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG", pszSpec="*.jpg") returned 1 [0069.769] lstrlenA (lpString="*.jpg") returned 5 [0069.769] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" [0069.769] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" [0069.769] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG." [0069.769] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.BD" [0069.769] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.769] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7457 [0069.769] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc38fa6fd, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.769] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.770] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x73fb, lpOverlapped=0x0) returned 1 [0069.771] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG") returned="J0341455.JPG" [0069.772] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.772] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x73fb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x73fb, lpOverlapped=0x0) returned 1 [0069.772] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.772] CloseHandle (hObject=0x1cc) returned 1 [0069.774] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341455.jpg.bd")) returned 1 [0069.775] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc390301a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa9e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341475.JPG", cAlternateFileName="")) returned 1 [0069.775] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.775] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0341475.JPG") returned -1 [0069.775] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0341475.JPG") returned -1 [0069.775] lstrcmpiA (lpString1="", lpString2="J0341475.JPG") returned -1 [0069.775] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG") returned="J0341455.JPG" [0069.775] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.775] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.775] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.775] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.775] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0341475.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" [0069.775] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG", pszSpec="*.zip") returned 0 [0069.775] lstrlenA (lpString="*.zip") returned 5 [0069.775] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG", pszSpec="*.rar") returned 0 [0069.775] lstrlenA (lpString="*.rar") returned 5 [0069.775] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG", pszSpec="*.7z") returned 0 [0069.775] lstrlenA (lpString="*.7z") returned 4 [0069.775] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG", pszSpec="*.tar") returned 0 [0069.775] lstrlenA (lpString="*.tar") returned 5 [0069.775] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG", pszSpec="*.gzip") returned 0 [0069.775] lstrlenA (lpString="*.gzip") returned 6 [0069.775] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG", pszSpec="*.jpg") returned 1 [0069.775] lstrlenA (lpString="*.jpg") returned 5 [0069.775] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" [0069.775] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" [0069.776] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG." [0069.776] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.BD" [0069.776] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.776] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa9e2 [0069.777] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc390301a, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.777] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.777] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xa986, lpOverlapped=0x0) returned 1 [0069.778] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG") returned="J0341475.JPG" [0069.779] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.780] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xa986, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xa986, lpOverlapped=0x0) returned 1 [0069.780] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.780] CloseHandle (hObject=0x1cc) returned 1 [0069.782] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341475.jpg.bd")) returned 1 [0069.783] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4b40a6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3ee3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341499.JPG", cAlternateFileName="")) returned 1 [0069.783] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.783] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0341499.JPG") returned -1 [0069.783] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0341499.JPG") returned -1 [0069.783] lstrcmpiA (lpString1="", lpString2="J0341499.JPG") returned -1 [0069.783] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG") returned="J0341475.JPG" [0069.783] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.783] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.783] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.783] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.783] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0341499.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" [0069.783] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG", pszSpec="*.zip") returned 0 [0069.783] lstrlenA (lpString="*.zip") returned 5 [0069.783] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG", pszSpec="*.rar") returned 0 [0069.783] lstrlenA (lpString="*.rar") returned 5 [0069.783] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG", pszSpec="*.7z") returned 0 [0069.783] lstrlenA (lpString="*.7z") returned 4 [0069.783] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG", pszSpec="*.tar") returned 0 [0069.783] lstrlenA (lpString="*.tar") returned 5 [0069.783] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG", pszSpec="*.gzip") returned 0 [0069.783] lstrlenA (lpString="*.gzip") returned 6 [0069.783] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG", pszSpec="*.jpg") returned 1 [0069.783] lstrlenA (lpString="*.jpg") returned 5 [0069.783] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" [0069.783] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" [0069.783] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG." [0069.783] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.BD" [0069.783] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.784] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ee3 [0069.784] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae4b40a6, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.784] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.784] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x3e87, lpOverlapped=0x0) returned 1 [0069.785] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG") returned="J0341499.JPG" [0069.786] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.786] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x3e87, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x3e87, lpOverlapped=0x0) returned 1 [0069.786] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.786] CloseHandle (hObject=0x1cc) returned 1 [0069.787] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341499.jpg.bd")) returned 1 [0069.788] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3907e2c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1f8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341534.JPG", cAlternateFileName="")) returned 1 [0069.788] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.788] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0341534.JPG") returned -1 [0069.788] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0341534.JPG") returned -1 [0069.788] lstrcmpiA (lpString1="", lpString2="J0341534.JPG") returned -1 [0069.788] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG") returned="J0341499.JPG" [0069.788] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.788] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.788] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.788] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.788] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0341534.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" [0069.788] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG", pszSpec="*.zip") returned 0 [0069.788] lstrlenA (lpString="*.zip") returned 5 [0069.788] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG", pszSpec="*.rar") returned 0 [0069.788] lstrlenA (lpString="*.rar") returned 5 [0069.788] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG", pszSpec="*.7z") returned 0 [0069.788] lstrlenA (lpString="*.7z") returned 4 [0069.788] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG", pszSpec="*.tar") returned 0 [0069.788] lstrlenA (lpString="*.tar") returned 5 [0069.788] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG", pszSpec="*.gzip") returned 0 [0069.788] lstrlenA (lpString="*.gzip") returned 6 [0069.788] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG", pszSpec="*.jpg") returned 1 [0069.788] lstrlenA (lpString="*.jpg") returned 5 [0069.788] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" [0069.788] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" [0069.788] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG." [0069.788] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.BD" [0069.789] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.789] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f8a [0069.789] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc3907e2c, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.789] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.789] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1f2e, lpOverlapped=0x0) returned 1 [0069.797] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG") returned="J0341534.JPG" [0069.797] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.797] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1f2e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1f2e, lpOverlapped=0x0) returned 1 [0069.798] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.798] CloseHandle (hObject=0x1cc) returned 1 [0069.799] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341534.jpg.bd")) returned 1 [0069.800] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc390df61, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5a56, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341551.JPG", cAlternateFileName="")) returned 1 [0069.800] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.800] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0341551.JPG") returned -1 [0069.800] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0341551.JPG") returned -1 [0069.800] lstrcmpiA (lpString1="", lpString2="J0341551.JPG") returned -1 [0069.800] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG") returned="J0341534.JPG" [0069.800] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.800] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.800] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.800] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.800] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0341551.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" [0069.800] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG", pszSpec="*.zip") returned 0 [0069.800] lstrlenA (lpString="*.zip") returned 5 [0069.800] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG", pszSpec="*.rar") returned 0 [0069.800] lstrlenA (lpString="*.rar") returned 5 [0069.800] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG", pszSpec="*.7z") returned 0 [0069.800] lstrlenA (lpString="*.7z") returned 4 [0069.800] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG", pszSpec="*.tar") returned 0 [0069.800] lstrlenA (lpString="*.tar") returned 5 [0069.800] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG", pszSpec="*.gzip") returned 0 [0069.800] lstrlenA (lpString="*.gzip") returned 6 [0069.800] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG", pszSpec="*.jpg") returned 1 [0069.800] lstrlenA (lpString="*.jpg") returned 5 [0069.800] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" [0069.800] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" [0069.800] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG." [0069.800] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.BD" [0069.800] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.801] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a56 [0069.801] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc390df61, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.801] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.801] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x59fa, lpOverlapped=0x0) returned 1 [0069.802] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG") returned="J0341551.JPG" [0069.803] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.803] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x59fa, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x59fa, lpOverlapped=0x0) returned 1 [0069.803] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.803] CloseHandle (hObject=0x1cc) returned 1 [0069.805] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341551.jpg.bd")) returned 1 [0069.805] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4bb589, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6f43, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341554.JPG", cAlternateFileName="")) returned 1 [0069.806] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.806] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0341554.JPG") returned -1 [0069.806] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0341554.JPG") returned -1 [0069.806] lstrcmpiA (lpString1="", lpString2="J0341554.JPG") returned -1 [0069.806] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG") returned="J0341551.JPG" [0069.806] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.806] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.806] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.806] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.806] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0341554.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" [0069.806] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG", pszSpec="*.zip") returned 0 [0069.806] lstrlenA (lpString="*.zip") returned 5 [0069.806] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG", pszSpec="*.rar") returned 0 [0069.806] lstrlenA (lpString="*.rar") returned 5 [0069.806] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG", pszSpec="*.7z") returned 0 [0069.806] lstrlenA (lpString="*.7z") returned 4 [0069.806] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG", pszSpec="*.tar") returned 0 [0069.806] lstrlenA (lpString="*.tar") returned 5 [0069.806] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG", pszSpec="*.gzip") returned 0 [0069.806] lstrlenA (lpString="*.gzip") returned 6 [0069.806] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG", pszSpec="*.jpg") returned 1 [0069.806] lstrlenA (lpString="*.jpg") returned 5 [0069.806] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" [0069.806] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" [0069.806] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG." [0069.806] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.BD" [0069.806] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.807] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6f43 [0069.807] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae4bb589, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.807] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.808] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x6ee7, lpOverlapped=0x0) returned 1 [0069.809] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG") returned="J0341554.JPG" [0069.810] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.810] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x6ee7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x6ee7, lpOverlapped=0x0) returned 1 [0069.810] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.810] CloseHandle (hObject=0x1cc) returned 1 [0069.811] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341554.jpg.bd")) returned 1 [0069.812] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4c0461, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341557.JPG", cAlternateFileName="")) returned 1 [0069.812] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.812] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0341557.JPG") returned -1 [0069.812] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0341557.JPG") returned -1 [0069.812] lstrcmpiA (lpString1="", lpString2="J0341557.JPG") returned -1 [0069.812] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG") returned="J0341554.JPG" [0069.812] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.812] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.812] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.812] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.812] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0341557.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" [0069.813] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG", pszSpec="*.zip") returned 0 [0069.813] lstrlenA (lpString="*.zip") returned 5 [0069.813] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG", pszSpec="*.rar") returned 0 [0069.813] lstrlenA (lpString="*.rar") returned 5 [0069.813] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG", pszSpec="*.7z") returned 0 [0069.813] lstrlenA (lpString="*.7z") returned 4 [0069.813] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG", pszSpec="*.tar") returned 0 [0069.813] lstrlenA (lpString="*.tar") returned 5 [0069.813] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG", pszSpec="*.gzip") returned 0 [0069.813] lstrlenA (lpString="*.gzip") returned 6 [0069.813] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG", pszSpec="*.jpg") returned 1 [0069.813] lstrlenA (lpString="*.jpg") returned 5 [0069.813] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" [0069.813] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" [0069.813] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG." [0069.813] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.BD" [0069.813] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.813] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6aa8 [0069.813] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae4c0461, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.813] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.813] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x6a4c, lpOverlapped=0x0) returned 1 [0069.819] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG") returned="J0341557.JPG" [0069.820] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.820] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x6a4c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x6a4c, lpOverlapped=0x0) returned 1 [0069.820] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.820] CloseHandle (hObject=0x1cc) returned 1 [0069.822] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341557.jpg.bd")) returned 1 [0069.823] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3912dcd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6873, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341559.JPG", cAlternateFileName="")) returned 1 [0069.823] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.823] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0341559.JPG") returned -1 [0069.823] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0341559.JPG") returned -1 [0069.823] lstrcmpiA (lpString1="", lpString2="J0341559.JPG") returned -1 [0069.823] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG") returned="J0341557.JPG" [0069.823] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.823] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.823] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.823] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.823] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0341559.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" [0069.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG", pszSpec="*.zip") returned 0 [0069.823] lstrlenA (lpString="*.zip") returned 5 [0069.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG", pszSpec="*.rar") returned 0 [0069.823] lstrlenA (lpString="*.rar") returned 5 [0069.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG", pszSpec="*.7z") returned 0 [0069.823] lstrlenA (lpString="*.7z") returned 4 [0069.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG", pszSpec="*.tar") returned 0 [0069.824] lstrlenA (lpString="*.tar") returned 5 [0069.824] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG", pszSpec="*.gzip") returned 0 [0069.824] lstrlenA (lpString="*.gzip") returned 6 [0069.824] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG", pszSpec="*.jpg") returned 1 [0069.824] lstrlenA (lpString="*.jpg") returned 5 [0069.824] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" [0069.824] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" [0069.824] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG." [0069.824] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.BD" [0069.824] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.824] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6873 [0069.824] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc3912dcd, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.824] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.824] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x6817, lpOverlapped=0x0) returned 1 [0069.826] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG") returned="J0341559.JPG" [0069.826] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.826] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x6817, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x6817, lpOverlapped=0x0) returned 1 [0069.827] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.827] CloseHandle (hObject=0x1cc) returned 1 [0069.828] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341559.jpg.bd")) returned 1 [0069.829] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4c65c0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa497, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341561.JPG", cAlternateFileName="")) returned 1 [0069.829] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.829] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0341561.JPG") returned -1 [0069.829] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0341561.JPG") returned -1 [0069.829] lstrcmpiA (lpString1="", lpString2="J0341561.JPG") returned -1 [0069.829] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG") returned="J0341559.JPG" [0069.829] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.829] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.829] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.829] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.829] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0341561.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" [0069.829] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG", pszSpec="*.zip") returned 0 [0069.829] lstrlenA (lpString="*.zip") returned 5 [0069.830] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG", pszSpec="*.rar") returned 0 [0069.830] lstrlenA (lpString="*.rar") returned 5 [0069.830] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG", pszSpec="*.7z") returned 0 [0069.830] lstrlenA (lpString="*.7z") returned 4 [0069.830] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG", pszSpec="*.tar") returned 0 [0069.830] lstrlenA (lpString="*.tar") returned 5 [0069.830] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG", pszSpec="*.gzip") returned 0 [0069.830] lstrlenA (lpString="*.gzip") returned 6 [0069.830] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG", pszSpec="*.jpg") returned 1 [0069.830] lstrlenA (lpString="*.jpg") returned 5 [0069.830] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" [0069.830] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" [0069.830] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG." [0069.830] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.BD" [0069.830] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.830] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa497 [0069.830] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae4c65c0, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.830] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.830] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xa43b, lpOverlapped=0x0) returned 1 [0069.832] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG") returned="J0341561.JPG" [0069.833] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.833] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xa43b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xa43b, lpOverlapped=0x0) returned 1 [0069.833] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.834] CloseHandle (hObject=0x1cc) returned 1 [0069.835] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341561.jpg.bd")) returned 1 [0069.836] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3918f70, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1e7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341634.JPG", cAlternateFileName="")) returned 1 [0069.836] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.836] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0341634.JPG") returned -1 [0069.836] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0341634.JPG") returned -1 [0069.836] lstrcmpiA (lpString1="", lpString2="J0341634.JPG") returned -1 [0069.836] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG") returned="J0341561.JPG" [0069.836] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.836] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.836] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.836] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.836] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0341634.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" [0069.836] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG", pszSpec="*.zip") returned 0 [0069.836] lstrlenA (lpString="*.zip") returned 5 [0069.836] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG", pszSpec="*.rar") returned 0 [0069.836] lstrlenA (lpString="*.rar") returned 5 [0069.836] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG", pszSpec="*.7z") returned 0 [0069.838] lstrlenA (lpString="*.7z") returned 4 [0069.838] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG", pszSpec="*.tar") returned 0 [0069.838] lstrlenA (lpString="*.tar") returned 5 [0069.838] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG", pszSpec="*.gzip") returned 0 [0069.838] lstrlenA (lpString="*.gzip") returned 6 [0069.838] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG", pszSpec="*.jpg") returned 1 [0069.838] lstrlenA (lpString="*.jpg") returned 5 [0069.838] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" [0069.838] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" [0069.838] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG." [0069.838] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.BD" [0069.838] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.839] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e7b [0069.839] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc3918f70, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.839] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.839] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1e1f, lpOverlapped=0x0) returned 1 [0069.841] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG") returned="J0341634.JPG" [0069.841] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.841] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1e1f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1e1f, lpOverlapped=0x0) returned 1 [0069.841] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.841] CloseHandle (hObject=0x1cc) returned 1 [0069.842] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341634.jpg.bd")) returned 1 [0069.843] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc391dd75, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3615, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341636.JPG", cAlternateFileName="")) returned 1 [0069.843] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.843] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0341636.JPG") returned -1 [0069.843] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0341636.JPG") returned -1 [0069.843] lstrcmpiA (lpString1="", lpString2="J0341636.JPG") returned -1 [0069.843] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG") returned="J0341634.JPG" [0069.843] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.843] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.843] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.843] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.843] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0341636.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" [0069.843] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG", pszSpec="*.zip") returned 0 [0069.843] lstrlenA (lpString="*.zip") returned 5 [0069.843] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG", pszSpec="*.rar") returned 0 [0069.843] lstrlenA (lpString="*.rar") returned 5 [0069.843] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG", pszSpec="*.7z") returned 0 [0069.844] lstrlenA (lpString="*.7z") returned 4 [0069.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG", pszSpec="*.tar") returned 0 [0069.844] lstrlenA (lpString="*.tar") returned 5 [0069.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG", pszSpec="*.gzip") returned 0 [0069.844] lstrlenA (lpString="*.gzip") returned 6 [0069.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG", pszSpec="*.jpg") returned 1 [0069.844] lstrlenA (lpString="*.jpg") returned 5 [0069.844] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" [0069.844] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" [0069.844] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG." [0069.844] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.BD" [0069.844] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.844] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3615 [0069.844] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc391dd75, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.844] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.844] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x35b9, lpOverlapped=0x0) returned 1 [0069.846] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG") returned="J0341636.JPG" [0069.846] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.846] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x35b9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x35b9, lpOverlapped=0x0) returned 1 [0069.846] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.847] CloseHandle (hObject=0x1cc) returned 1 [0069.848] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341636.jpg.bd")) returned 1 [0069.848] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4cc91c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341645.JPG", cAlternateFileName="")) returned 1 [0069.849] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.849] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0341645.JPG") returned -1 [0069.849] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0341645.JPG") returned -1 [0069.849] lstrcmpiA (lpString1="", lpString2="J0341645.JPG") returned -1 [0069.849] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG") returned="J0341636.JPG" [0069.849] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.849] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.849] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.849] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.849] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0341645.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" [0069.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG", pszSpec="*.zip") returned 0 [0069.849] lstrlenA (lpString="*.zip") returned 5 [0069.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG", pszSpec="*.rar") returned 0 [0069.849] lstrlenA (lpString="*.rar") returned 5 [0069.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG", pszSpec="*.7z") returned 0 [0069.849] lstrlenA (lpString="*.7z") returned 4 [0069.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG", pszSpec="*.tar") returned 0 [0069.849] lstrlenA (lpString="*.tar") returned 5 [0069.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG", pszSpec="*.gzip") returned 0 [0069.849] lstrlenA (lpString="*.gzip") returned 6 [0069.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG", pszSpec="*.jpg") returned 1 [0069.849] lstrlenA (lpString="*.jpg") returned 5 [0069.849] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" [0069.849] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" [0069.849] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG." [0069.849] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.BD" [0069.849] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.850] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2026 [0069.850] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae4cc91c, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.850] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.850] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1fca, lpOverlapped=0x0) returned 1 [0069.851] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG") returned="J0341645.JPG" [0069.852] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.852] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1fca, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1fca, lpOverlapped=0x0) returned 1 [0069.852] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.852] CloseHandle (hObject=0x1cc) returned 1 [0069.853] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341645.jpg.bd")) returned 1 [0069.854] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4d3c6a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3df7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341653.JPG", cAlternateFileName="")) returned 1 [0069.854] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.854] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0341653.JPG") returned -1 [0069.854] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0341653.JPG") returned -1 [0069.854] lstrcmpiA (lpString1="", lpString2="J0341653.JPG") returned -1 [0069.854] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG") returned="J0341645.JPG" [0069.854] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.854] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.854] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.854] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.854] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0341653.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" [0069.854] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG", pszSpec="*.zip") returned 0 [0069.854] lstrlenA (lpString="*.zip") returned 5 [0069.854] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG", pszSpec="*.rar") returned 0 [0069.854] lstrlenA (lpString="*.rar") returned 5 [0069.854] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG", pszSpec="*.7z") returned 0 [0069.854] lstrlenA (lpString="*.7z") returned 4 [0069.854] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG", pszSpec="*.tar") returned 0 [0069.854] lstrlenA (lpString="*.tar") returned 5 [0069.854] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG", pszSpec="*.gzip") returned 0 [0069.854] lstrlenA (lpString="*.gzip") returned 6 [0069.855] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG", pszSpec="*.jpg") returned 1 [0069.855] lstrlenA (lpString="*.jpg") returned 5 [0069.855] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" [0069.855] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" [0069.855] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG." [0069.855] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.BD" [0069.855] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.857] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3df7 [0069.857] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae4d3c6a, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.857] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.857] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x3d9b, lpOverlapped=0x0) returned 1 [0069.859] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG") returned="J0341653.JPG" [0069.859] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.859] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x3d9b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x3d9b, lpOverlapped=0x0) returned 1 [0069.860] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.860] CloseHandle (hObject=0x1cc) returned 1 [0069.861] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341653.jpg.bd")) returned 1 [0069.862] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3923f04, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3d7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341654.JPG", cAlternateFileName="")) returned 1 [0069.862] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.862] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0341654.JPG") returned -1 [0069.862] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0341654.JPG") returned -1 [0069.862] lstrcmpiA (lpString1="", lpString2="J0341654.JPG") returned -1 [0069.862] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG") returned="J0341653.JPG" [0069.862] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.862] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.862] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.862] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.862] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0341654.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" [0069.862] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG", pszSpec="*.zip") returned 0 [0069.862] lstrlenA (lpString="*.zip") returned 5 [0069.862] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG", pszSpec="*.rar") returned 0 [0069.862] lstrlenA (lpString="*.rar") returned 5 [0069.862] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG", pszSpec="*.7z") returned 0 [0069.862] lstrlenA (lpString="*.7z") returned 4 [0069.862] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG", pszSpec="*.tar") returned 0 [0069.862] lstrlenA (lpString="*.tar") returned 5 [0069.862] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG", pszSpec="*.gzip") returned 0 [0069.862] lstrlenA (lpString="*.gzip") returned 6 [0069.862] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG", pszSpec="*.jpg") returned 1 [0069.862] lstrlenA (lpString="*.jpg") returned 5 [0069.862] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" [0069.862] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" [0069.862] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG." [0069.862] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.BD" [0069.862] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.863] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d7f [0069.863] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc3923f04, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.863] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.863] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x3d23, lpOverlapped=0x0) returned 1 [0069.864] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG") returned="J0341654.JPG" [0069.865] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.865] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x3d23, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x3d23, lpOverlapped=0x0) returned 1 [0069.865] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.865] CloseHandle (hObject=0x1cc) returned 1 [0069.866] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341654.jpg.bd")) returned 1 [0069.867] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3928d86, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4ec6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341738.JPG", cAlternateFileName="")) returned 1 [0069.867] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.867] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0341738.JPG") returned -1 [0069.867] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0341738.JPG") returned -1 [0069.867] lstrcmpiA (lpString1="", lpString2="J0341738.JPG") returned -1 [0069.867] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG") returned="J0341654.JPG" [0069.867] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.867] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.867] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.867] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.867] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0341738.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" [0069.867] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG", pszSpec="*.zip") returned 0 [0069.868] lstrlenA (lpString="*.zip") returned 5 [0069.868] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG", pszSpec="*.rar") returned 0 [0069.868] lstrlenA (lpString="*.rar") returned 5 [0069.868] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG", pszSpec="*.7z") returned 0 [0069.868] lstrlenA (lpString="*.7z") returned 4 [0069.868] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG", pszSpec="*.tar") returned 0 [0069.868] lstrlenA (lpString="*.tar") returned 5 [0069.868] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG", pszSpec="*.gzip") returned 0 [0069.868] lstrlenA (lpString="*.gzip") returned 6 [0069.868] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG", pszSpec="*.jpg") returned 1 [0069.868] lstrlenA (lpString="*.jpg") returned 5 [0069.868] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" [0069.868] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" [0069.868] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG." [0069.868] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.BD" [0069.868] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.869] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ec6 [0069.869] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc3928d86, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.869] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.869] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x4e6a, lpOverlapped=0x0) returned 1 [0069.870] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG") returned="J0341738.JPG" [0069.871] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.871] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x4e6a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x4e6a, lpOverlapped=0x0) returned 1 [0069.871] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.871] CloseHandle (hObject=0x1cc) returned 1 [0069.872] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341738.jpg.bd")) returned 1 [0069.873] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc39315ce, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x49ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341742.JPG", cAlternateFileName="")) returned 1 [0069.873] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.873] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0341742.JPG") returned -1 [0069.873] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0341742.JPG") returned -1 [0069.873] lstrcmpiA (lpString1="", lpString2="J0341742.JPG") returned -1 [0069.873] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG") returned="J0341738.JPG" [0069.873] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.873] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.873] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.873] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.873] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0341742.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" [0069.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG", pszSpec="*.zip") returned 0 [0069.873] lstrlenA (lpString="*.zip") returned 5 [0069.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG", pszSpec="*.rar") returned 0 [0069.873] lstrlenA (lpString="*.rar") returned 5 [0069.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG", pszSpec="*.7z") returned 0 [0069.873] lstrlenA (lpString="*.7z") returned 4 [0069.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG", pszSpec="*.tar") returned 0 [0069.873] lstrlenA (lpString="*.tar") returned 5 [0069.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG", pszSpec="*.gzip") returned 0 [0069.874] lstrlenA (lpString="*.gzip") returned 6 [0069.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG", pszSpec="*.jpg") returned 1 [0069.874] lstrlenA (lpString="*.jpg") returned 5 [0069.874] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" [0069.874] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" [0069.874] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG." [0069.874] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.BD" [0069.874] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.875] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x49ba [0069.875] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc39315ce, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.875] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.875] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x495e, lpOverlapped=0x0) returned 1 [0069.876] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG") returned="J0341742.JPG" [0069.877] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.877] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x495e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x495e, lpOverlapped=0x0) returned 1 [0069.877] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.877] CloseHandle (hObject=0x1cc) returned 1 [0069.881] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341742.jpg.bd")) returned 1 [0069.881] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4d9e28, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x10bdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382836.JPG", cAlternateFileName="")) returned 1 [0069.881] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.881] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382836.JPG") returned -1 [0069.881] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382836.JPG") returned -1 [0069.881] lstrcmpiA (lpString1="", lpString2="J0382836.JPG") returned -1 [0069.881] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG") returned="J0341742.JPG" [0069.881] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.882] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.882] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.882] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.882] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382836.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" [0069.882] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG", pszSpec="*.zip") returned 0 [0069.882] lstrlenA (lpString="*.zip") returned 5 [0069.882] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG", pszSpec="*.rar") returned 0 [0069.882] lstrlenA (lpString="*.rar") returned 5 [0069.882] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG", pszSpec="*.7z") returned 0 [0069.882] lstrlenA (lpString="*.7z") returned 4 [0069.882] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG", pszSpec="*.tar") returned 0 [0069.882] lstrlenA (lpString="*.tar") returned 5 [0069.882] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG", pszSpec="*.gzip") returned 0 [0069.882] lstrlenA (lpString="*.gzip") returned 6 [0069.882] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG", pszSpec="*.jpg") returned 1 [0069.882] lstrlenA (lpString="*.jpg") returned 5 [0069.882] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" [0069.882] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" [0069.882] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG." [0069.882] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.BD" [0069.882] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.882] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10bdc [0069.882] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae4d9e28, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.883] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.883] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x10b80, lpOverlapped=0x0) returned 1 [0069.885] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG") returned="J0382836.JPG" [0069.887] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.887] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x10b80, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x10b80, lpOverlapped=0x0) returned 1 [0069.887] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.887] CloseHandle (hObject=0x1cc) returned 1 [0069.889] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382836.jpg.bd")) returned 1 [0069.890] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc393b289, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1ce5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382925.JPG", cAlternateFileName="")) returned 1 [0069.890] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.890] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382925.JPG") returned -1 [0069.890] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382925.JPG") returned -1 [0069.890] lstrcmpiA (lpString1="", lpString2="J0382925.JPG") returned -1 [0069.890] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG") returned="J0382836.JPG" [0069.890] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.890] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.890] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.890] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.890] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382925.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" [0069.890] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG", pszSpec="*.zip") returned 0 [0069.890] lstrlenA (lpString="*.zip") returned 5 [0069.890] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG", pszSpec="*.rar") returned 0 [0069.890] lstrlenA (lpString="*.rar") returned 5 [0069.890] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG", pszSpec="*.7z") returned 0 [0069.890] lstrlenA (lpString="*.7z") returned 4 [0069.890] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG", pszSpec="*.tar") returned 0 [0069.891] lstrlenA (lpString="*.tar") returned 5 [0069.891] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG", pszSpec="*.gzip") returned 0 [0069.891] lstrlenA (lpString="*.gzip") returned 6 [0069.891] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG", pszSpec="*.jpg") returned 1 [0069.891] lstrlenA (lpString="*.jpg") returned 5 [0069.891] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" [0069.891] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" [0069.891] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG." [0069.891] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.BD" [0069.891] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.891] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ce5a [0069.891] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc393b289, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.891] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.891] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1cdfe, lpOverlapped=0x0) returned 1 [0069.895] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG") returned="J0382925.JPG" [0069.898] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.898] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1cdfe, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1cdfe, lpOverlapped=0x0) returned 1 [0069.899] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.899] CloseHandle (hObject=0x1cc) returned 1 [0069.902] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382925.jpg.bd")) returned 1 [0069.903] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc394273e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1672c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382926.JPG", cAlternateFileName="")) returned 1 [0069.903] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.903] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382926.JPG") returned -1 [0069.903] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382926.JPG") returned -1 [0069.903] lstrcmpiA (lpString1="", lpString2="J0382926.JPG") returned -1 [0069.903] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG") returned="J0382925.JPG" [0069.903] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.903] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.903] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.903] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.903] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382926.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" [0069.903] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG", pszSpec="*.zip") returned 0 [0069.903] lstrlenA (lpString="*.zip") returned 5 [0069.903] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG", pszSpec="*.rar") returned 0 [0069.903] lstrlenA (lpString="*.rar") returned 5 [0069.903] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG", pszSpec="*.7z") returned 0 [0069.903] lstrlenA (lpString="*.7z") returned 4 [0069.903] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG", pszSpec="*.tar") returned 0 [0069.903] lstrlenA (lpString="*.tar") returned 5 [0069.903] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG", pszSpec="*.gzip") returned 0 [0069.904] lstrlenA (lpString="*.gzip") returned 6 [0069.904] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG", pszSpec="*.jpg") returned 1 [0069.904] lstrlenA (lpString="*.jpg") returned 5 [0069.904] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" [0069.904] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" [0069.904] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG." [0069.904] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.BD" [0069.904] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.904] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1672c [0069.904] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc394273e, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.904] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.904] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x166d0, lpOverlapped=0x0) returned 1 [0069.909] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG") returned="J0382926.JPG" [0069.911] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.911] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x166d0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x166d0, lpOverlapped=0x0) returned 1 [0069.912] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.912] CloseHandle (hObject=0x1cc) returned 1 [0069.914] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382926.jpg.bd")) returned 1 [0069.915] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc394c37a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1f86c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382927.JPG", cAlternateFileName="")) returned 1 [0069.915] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.915] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382927.JPG") returned -1 [0069.915] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382927.JPG") returned -1 [0069.915] lstrcmpiA (lpString1="", lpString2="J0382927.JPG") returned -1 [0069.915] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG") returned="J0382926.JPG" [0069.916] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.916] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.916] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.916] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.916] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382927.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" [0069.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG", pszSpec="*.zip") returned 0 [0069.916] lstrlenA (lpString="*.zip") returned 5 [0069.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG", pszSpec="*.rar") returned 0 [0069.916] lstrlenA (lpString="*.rar") returned 5 [0069.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG", pszSpec="*.7z") returned 0 [0069.916] lstrlenA (lpString="*.7z") returned 4 [0069.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG", pszSpec="*.tar") returned 0 [0069.916] lstrlenA (lpString="*.tar") returned 5 [0069.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG", pszSpec="*.gzip") returned 0 [0069.916] lstrlenA (lpString="*.gzip") returned 6 [0069.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG", pszSpec="*.jpg") returned 1 [0069.916] lstrlenA (lpString="*.jpg") returned 5 [0069.916] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" [0069.916] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" [0069.916] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG." [0069.916] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.BD" [0069.916] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.917] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f86c [0069.917] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc394c37a, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.917] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.917] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1f810, lpOverlapped=0x0) returned 1 [0069.923] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG") returned="J0382927.JPG" [0069.927] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.927] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1f810, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1f810, lpOverlapped=0x0) returned 1 [0069.927] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.927] CloseHandle (hObject=0x1cc) returned 1 [0069.956] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382927.jpg.bd")) returned 1 [0069.956] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc39572f6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1b83a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382930.JPG", cAlternateFileName="")) returned 1 [0069.956] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.957] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382930.JPG") returned -1 [0069.957] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382930.JPG") returned -1 [0069.957] lstrcmpiA (lpString1="", lpString2="J0382930.JPG") returned -1 [0069.957] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG") returned="J0382927.JPG" [0069.957] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.957] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.957] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.957] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.957] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382930.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" [0069.957] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG", pszSpec="*.zip") returned 0 [0069.957] lstrlenA (lpString="*.zip") returned 5 [0069.957] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG", pszSpec="*.rar") returned 0 [0069.957] lstrlenA (lpString="*.rar") returned 5 [0069.957] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG", pszSpec="*.7z") returned 0 [0069.957] lstrlenA (lpString="*.7z") returned 4 [0069.957] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG", pszSpec="*.tar") returned 0 [0069.957] lstrlenA (lpString="*.tar") returned 5 [0069.957] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG", pszSpec="*.gzip") returned 0 [0069.957] lstrlenA (lpString="*.gzip") returned 6 [0069.957] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG", pszSpec="*.jpg") returned 1 [0069.957] lstrlenA (lpString="*.jpg") returned 5 [0069.957] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" [0069.957] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" [0069.957] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG." [0069.957] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.BD" [0069.957] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.958] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b83a [0069.958] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc39572f6, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.958] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.958] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1b7de, lpOverlapped=0x0) returned 1 [0069.962] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG") returned="J0382930.JPG" [0069.965] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.965] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1b7de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1b7de, lpOverlapped=0x0) returned 1 [0069.966] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.966] CloseHandle (hObject=0x1cc) returned 1 [0069.969] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382930.jpg.bd")) returned 1 [0069.970] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4e4dc5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1df43, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382931.JPG", cAlternateFileName="")) returned 1 [0069.970] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.970] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382931.JPG") returned -1 [0069.970] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382931.JPG") returned -1 [0069.970] lstrcmpiA (lpString1="", lpString2="J0382931.JPG") returned -1 [0069.970] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG") returned="J0382930.JPG" [0069.970] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.970] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.970] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.970] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.971] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382931.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" [0069.971] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG", pszSpec="*.zip") returned 0 [0069.971] lstrlenA (lpString="*.zip") returned 5 [0069.971] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG", pszSpec="*.rar") returned 0 [0069.971] lstrlenA (lpString="*.rar") returned 5 [0069.971] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG", pszSpec="*.7z") returned 0 [0069.971] lstrlenA (lpString="*.7z") returned 4 [0069.971] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG", pszSpec="*.tar") returned 0 [0069.971] lstrlenA (lpString="*.tar") returned 5 [0069.971] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG", pszSpec="*.gzip") returned 0 [0069.971] lstrlenA (lpString="*.gzip") returned 6 [0069.971] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG", pszSpec="*.jpg") returned 1 [0069.971] lstrlenA (lpString="*.jpg") returned 5 [0069.971] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" [0069.971] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" [0069.971] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG." [0069.971] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.BD" [0069.971] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.971] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1df43 [0069.971] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae4e4dc5, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.971] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.971] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1dee7, lpOverlapped=0x0) returned 1 [0069.975] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG") returned="J0382931.JPG" [0069.978] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.978] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1dee7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1dee7, lpOverlapped=0x0) returned 1 [0069.979] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.979] CloseHandle (hObject=0x1cc) returned 1 [0069.982] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382931.jpg.bd")) returned 1 [0069.982] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4ed6d6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x184d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382938.JPG", cAlternateFileName="")) returned 1 [0069.982] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.982] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382938.JPG") returned -1 [0069.983] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382938.JPG") returned -1 [0069.983] lstrcmpiA (lpString1="", lpString2="J0382938.JPG") returned -1 [0069.983] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG") returned="J0382931.JPG" [0069.983] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.983] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.983] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.983] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.983] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382938.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" [0069.983] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG", pszSpec="*.zip") returned 0 [0069.983] lstrlenA (lpString="*.zip") returned 5 [0069.983] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG", pszSpec="*.rar") returned 0 [0069.983] lstrlenA (lpString="*.rar") returned 5 [0069.983] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG", pszSpec="*.7z") returned 0 [0069.983] lstrlenA (lpString="*.7z") returned 4 [0069.983] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG", pszSpec="*.tar") returned 0 [0069.983] lstrlenA (lpString="*.tar") returned 5 [0069.983] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG", pszSpec="*.gzip") returned 0 [0069.983] lstrlenA (lpString="*.gzip") returned 6 [0069.983] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG", pszSpec="*.jpg") returned 1 [0069.983] lstrlenA (lpString="*.jpg") returned 5 [0069.983] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" [0069.983] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" [0069.983] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG." [0069.983] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.BD" [0069.983] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.984] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x184d3 [0069.984] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae4ed6d6, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.984] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.984] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x18477, lpOverlapped=0x0) returned 1 [0069.986] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG") returned="J0382938.JPG" [0069.988] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.988] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x18477, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x18477, lpOverlapped=0x0) returned 1 [0069.989] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.989] CloseHandle (hObject=0x1cc) returned 1 [0069.991] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382938.jpg.bd")) returned 1 [0069.992] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4f8686, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1aba5, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382939.JPG", cAlternateFileName="")) returned 1 [0069.992] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0069.992] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382939.JPG") returned -1 [0069.992] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382939.JPG") returned -1 [0069.992] lstrcmpiA (lpString1="", lpString2="J0382939.JPG") returned -1 [0069.992] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG") returned="J0382938.JPG" [0069.992] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0069.992] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0069.992] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0069.992] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0069.992] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382939.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" [0069.992] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG", pszSpec="*.zip") returned 0 [0069.993] lstrlenA (lpString="*.zip") returned 5 [0069.993] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG", pszSpec="*.rar") returned 0 [0069.993] lstrlenA (lpString="*.rar") returned 5 [0069.993] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG", pszSpec="*.7z") returned 0 [0069.993] lstrlenA (lpString="*.7z") returned 4 [0069.993] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG", pszSpec="*.tar") returned 0 [0069.993] lstrlenA (lpString="*.tar") returned 5 [0069.993] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG", pszSpec="*.gzip") returned 0 [0069.993] lstrlenA (lpString="*.gzip") returned 6 [0069.993] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG", pszSpec="*.jpg") returned 1 [0069.993] lstrlenA (lpString="*.jpg") returned 5 [0069.993] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" [0069.993] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" [0069.993] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG." [0069.993] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.BD" [0069.993] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.994] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1aba5 [0069.994] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae4f8686, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0069.994] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0069.994] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1ab49, lpOverlapped=0x0) returned 1 [0070.000] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG") returned="J0382939.JPG" [0070.003] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.003] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1ab49, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1ab49, lpOverlapped=0x0) returned 1 [0070.004] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.004] CloseHandle (hObject=0x1cc) returned 1 [0070.006] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382939.jpg.bd")) returned 1 [0070.007] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4ffb87, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1653a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382942.JPG", cAlternateFileName="")) returned 1 [0070.007] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.007] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382942.JPG") returned -1 [0070.007] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382942.JPG") returned -1 [0070.007] lstrcmpiA (lpString1="", lpString2="J0382942.JPG") returned -1 [0070.007] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG") returned="J0382939.JPG" [0070.007] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.007] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.007] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.007] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.007] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382942.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" [0070.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG", pszSpec="*.zip") returned 0 [0070.008] lstrlenA (lpString="*.zip") returned 5 [0070.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG", pszSpec="*.rar") returned 0 [0070.008] lstrlenA (lpString="*.rar") returned 5 [0070.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG", pszSpec="*.7z") returned 0 [0070.008] lstrlenA (lpString="*.7z") returned 4 [0070.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG", pszSpec="*.tar") returned 0 [0070.008] lstrlenA (lpString="*.tar") returned 5 [0070.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG", pszSpec="*.gzip") returned 0 [0070.008] lstrlenA (lpString="*.gzip") returned 6 [0070.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG", pszSpec="*.jpg") returned 1 [0070.008] lstrlenA (lpString="*.jpg") returned 5 [0070.008] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" [0070.008] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" [0070.008] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG." [0070.008] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.BD" [0070.008] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.008] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1653a [0070.008] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae4ffb87, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0070.008] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.008] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x164de, lpOverlapped=0x0) returned 1 [0070.012] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG") returned="J0382942.JPG" [0070.015] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.015] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x164de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x164de, lpOverlapped=0x0) returned 1 [0070.015] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.015] CloseHandle (hObject=0x1cc) returned 1 [0070.018] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382942.jpg.bd")) returned 1 [0070.019] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc395fbde, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x13e1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382944.JPG", cAlternateFileName="")) returned 1 [0070.019] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.019] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382944.JPG") returned -1 [0070.019] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382944.JPG") returned -1 [0070.019] lstrcmpiA (lpString1="", lpString2="J0382944.JPG") returned -1 [0070.019] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG") returned="J0382942.JPG" [0070.019] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.019] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.019] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.019] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.019] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382944.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" [0070.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG", pszSpec="*.zip") returned 0 [0070.019] lstrlenA (lpString="*.zip") returned 5 [0070.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG", pszSpec="*.rar") returned 0 [0070.019] lstrlenA (lpString="*.rar") returned 5 [0070.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG", pszSpec="*.7z") returned 0 [0070.019] lstrlenA (lpString="*.7z") returned 4 [0070.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG", pszSpec="*.tar") returned 0 [0070.019] lstrlenA (lpString="*.tar") returned 5 [0070.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG", pszSpec="*.gzip") returned 0 [0070.019] lstrlenA (lpString="*.gzip") returned 6 [0070.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG", pszSpec="*.jpg") returned 1 [0070.019] lstrlenA (lpString="*.jpg") returned 5 [0070.019] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" [0070.019] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" [0070.019] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG." [0070.019] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.BD" [0070.019] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.020] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13e1d [0070.020] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc395fbde, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0070.020] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.020] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x13dc1, lpOverlapped=0x0) returned 1 [0070.022] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG") returned="J0382944.JPG" [0070.024] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.024] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x13dc1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x13dc1, lpOverlapped=0x0) returned 1 [0070.025] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.025] CloseHandle (hObject=0x1cc) returned 1 [0070.027] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382944.jpg.bd")) returned 1 [0070.028] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae508456, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1531c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382947.JPG", cAlternateFileName="")) returned 1 [0070.028] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.028] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382947.JPG") returned -1 [0070.028] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382947.JPG") returned -1 [0070.028] lstrcmpiA (lpString1="", lpString2="J0382947.JPG") returned -1 [0070.028] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG") returned="J0382944.JPG" [0070.028] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.028] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.028] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.028] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.028] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382947.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" [0070.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG", pszSpec="*.zip") returned 0 [0070.028] lstrlenA (lpString="*.zip") returned 5 [0070.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG", pszSpec="*.rar") returned 0 [0070.028] lstrlenA (lpString="*.rar") returned 5 [0070.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG", pszSpec="*.7z") returned 0 [0070.028] lstrlenA (lpString="*.7z") returned 4 [0070.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG", pszSpec="*.tar") returned 0 [0070.028] lstrlenA (lpString="*.tar") returned 5 [0070.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG", pszSpec="*.gzip") returned 0 [0070.028] lstrlenA (lpString="*.gzip") returned 6 [0070.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG", pszSpec="*.jpg") returned 1 [0070.028] lstrlenA (lpString="*.jpg") returned 5 [0070.028] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" [0070.028] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" [0070.028] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG." [0070.028] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.BD" [0070.029] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.029] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1531c [0070.029] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae508456, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0070.029] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.029] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x152c0, lpOverlapped=0x0) returned 1 [0070.031] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG") returned="J0382947.JPG" [0070.033] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.033] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x152c0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x152c0, lpOverlapped=0x0) returned 1 [0070.034] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.034] CloseHandle (hObject=0x1cc) returned 1 [0070.036] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382947.jpg.bd")) returned 1 [0070.037] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae51209b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1ad37, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382948.JPG", cAlternateFileName="")) returned 1 [0070.037] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.037] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382948.JPG") returned -1 [0070.037] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382948.JPG") returned -1 [0070.037] lstrcmpiA (lpString1="", lpString2="J0382948.JPG") returned -1 [0070.037] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG") returned="J0382947.JPG" [0070.037] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.037] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.037] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.037] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.037] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382948.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" [0070.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG", pszSpec="*.zip") returned 0 [0070.037] lstrlenA (lpString="*.zip") returned 5 [0070.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG", pszSpec="*.rar") returned 0 [0070.037] lstrlenA (lpString="*.rar") returned 5 [0070.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG", pszSpec="*.7z") returned 0 [0070.037] lstrlenA (lpString="*.7z") returned 4 [0070.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG", pszSpec="*.tar") returned 0 [0070.038] lstrlenA (lpString="*.tar") returned 5 [0070.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG", pszSpec="*.gzip") returned 0 [0070.038] lstrlenA (lpString="*.gzip") returned 6 [0070.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG", pszSpec="*.jpg") returned 1 [0070.038] lstrlenA (lpString="*.jpg") returned 5 [0070.038] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" [0070.038] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" [0070.038] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG." [0070.038] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.BD" [0070.038] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.038] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ad37 [0070.038] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae51209b, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0070.038] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.038] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1acdb, lpOverlapped=0x0) returned 1 [0070.040] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG") returned="J0382948.JPG" [0070.043] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.043] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1acdb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1acdb, lpOverlapped=0x0) returned 1 [0070.044] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.044] CloseHandle (hObject=0x1cc) returned 1 [0070.046] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382948.jpg.bd")) returned 1 [0070.047] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae51d06e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x178d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382950.JPG", cAlternateFileName="")) returned 1 [0070.047] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.047] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382950.JPG") returned -1 [0070.047] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382950.JPG") returned -1 [0070.047] lstrcmpiA (lpString1="", lpString2="J0382950.JPG") returned -1 [0070.047] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG") returned="J0382948.JPG" [0070.047] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.047] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.047] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.047] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.047] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382950.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" [0070.047] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG", pszSpec="*.zip") returned 0 [0070.048] lstrlenA (lpString="*.zip") returned 5 [0070.048] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG", pszSpec="*.rar") returned 0 [0070.048] lstrlenA (lpString="*.rar") returned 5 [0070.048] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG", pszSpec="*.7z") returned 0 [0070.048] lstrlenA (lpString="*.7z") returned 4 [0070.048] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG", pszSpec="*.tar") returned 0 [0070.048] lstrlenA (lpString="*.tar") returned 5 [0070.048] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG", pszSpec="*.gzip") returned 0 [0070.048] lstrlenA (lpString="*.gzip") returned 6 [0070.048] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG", pszSpec="*.jpg") returned 1 [0070.048] lstrlenA (lpString="*.jpg") returned 5 [0070.048] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" [0070.048] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" [0070.048] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG." [0070.048] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.BD" [0070.048] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.049] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x178d2 [0070.049] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae51d06e, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0070.049] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.049] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x17876, lpOverlapped=0x0) returned 1 [0070.051] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG") returned="J0382950.JPG" [0070.054] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.054] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x17876, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x17876, lpOverlapped=0x0) returned 1 [0070.054] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.054] CloseHandle (hObject=0x1cc) returned 1 [0070.058] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382950.jpg.bd")) returned 1 [0070.059] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc39670dc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x17749, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382952.JPG", cAlternateFileName="")) returned 1 [0070.059] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.059] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382952.JPG") returned -1 [0070.059] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382952.JPG") returned -1 [0070.059] lstrcmpiA (lpString1="", lpString2="J0382952.JPG") returned -1 [0070.059] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG") returned="J0382950.JPG" [0070.059] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.059] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.059] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.060] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.060] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382952.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" [0070.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG", pszSpec="*.zip") returned 0 [0070.060] lstrlenA (lpString="*.zip") returned 5 [0070.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG", pszSpec="*.rar") returned 0 [0070.060] lstrlenA (lpString="*.rar") returned 5 [0070.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG", pszSpec="*.7z") returned 0 [0070.060] lstrlenA (lpString="*.7z") returned 4 [0070.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG", pszSpec="*.tar") returned 0 [0070.060] lstrlenA (lpString="*.tar") returned 5 [0070.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG", pszSpec="*.gzip") returned 0 [0070.060] lstrlenA (lpString="*.gzip") returned 6 [0070.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG", pszSpec="*.jpg") returned 1 [0070.060] lstrlenA (lpString="*.jpg") returned 5 [0070.060] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" [0070.060] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" [0070.060] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG." [0070.060] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.BD" [0070.060] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.060] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17749 [0070.060] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc39670dc, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0070.060] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.061] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x176ed, lpOverlapped=0x0) returned 1 [0070.062] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG") returned="J0382952.JPG" [0070.065] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.065] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x176ed, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x176ed, lpOverlapped=0x0) returned 1 [0070.065] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.065] CloseHandle (hObject=0x1cc) returned 1 [0070.068] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382952.jpg.bd")) returned 1 [0070.069] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3970d26, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x15a7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382954.JPG", cAlternateFileName="")) returned 1 [0070.069] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.069] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382954.JPG") returned -1 [0070.069] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382954.JPG") returned -1 [0070.069] lstrcmpiA (lpString1="", lpString2="J0382954.JPG") returned -1 [0070.069] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.069] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.069] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.069] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.069] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382954.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" [0070.069] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG", pszSpec="*.zip") returned 0 [0070.069] lstrlenA (lpString="*.zip") returned 5 [0070.069] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG", pszSpec="*.rar") returned 0 [0070.069] lstrlenA (lpString="*.rar") returned 5 [0070.069] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG", pszSpec="*.7z") returned 0 [0070.069] lstrlenA (lpString="*.7z") returned 4 [0070.069] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG", pszSpec="*.tar") returned 0 [0070.069] lstrlenA (lpString="*.tar") returned 5 [0070.070] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG", pszSpec="*.gzip") returned 0 [0070.070] lstrlenA (lpString="*.gzip") returned 6 [0070.070] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG", pszSpec="*.jpg") returned 1 [0070.070] lstrlenA (lpString="*.jpg") returned 5 [0070.070] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" [0070.070] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" [0070.070] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG." [0070.070] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.BD" [0070.070] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.070] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15a7f [0070.070] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc3970d26, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0070.070] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.070] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x15a23, lpOverlapped=0x0) returned 1 [0070.074] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.074] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x15a23, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x15a23, lpOverlapped=0x0) returned 1 [0070.075] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.075] CloseHandle (hObject=0x1cc) returned 1 [0070.077] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382954.jpg.bd")) returned 1 [0070.078] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae524636, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x15fef, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382955.JPG", cAlternateFileName="")) returned 1 [0070.078] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.078] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382955.JPG") returned -1 [0070.078] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382955.JPG") returned -1 [0070.078] lstrcmpiA (lpString1="", lpString2="J0382955.JPG") returned -1 [0070.078] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG") returned="J0382954.JPG" [0070.078] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.078] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.078] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.078] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.078] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382955.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" [0070.078] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG", pszSpec="*.zip") returned 0 [0070.078] lstrlenA (lpString="*.zip") returned 5 [0070.078] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG", pszSpec="*.rar") returned 0 [0070.078] lstrlenA (lpString="*.rar") returned 5 [0070.078] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG", pszSpec="*.7z") returned 0 [0070.078] lstrlenA (lpString="*.7z") returned 4 [0070.078] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG", pszSpec="*.tar") returned 0 [0070.078] lstrlenA (lpString="*.tar") returned 5 [0070.078] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG", pszSpec="*.gzip") returned 0 [0070.078] lstrlenA (lpString="*.gzip") returned 6 [0070.078] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG", pszSpec="*.jpg") returned 1 [0070.078] lstrlenA (lpString="*.jpg") returned 5 [0070.079] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" [0070.079] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" [0070.079] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG." [0070.079] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.BD" [0070.079] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.079] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15fef [0070.079] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae524636, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0070.079] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.079] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x15f93, lpOverlapped=0x0) returned 1 [0070.083] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG") returned="J0382955.JPG" [0070.085] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.085] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x15f93, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x15f93, lpOverlapped=0x0) returned 1 [0070.085] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.086] CloseHandle (hObject=0x1cc) returned 1 [0070.088] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382955.jpg.bd")) returned 1 [0070.089] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae52e290, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1a9ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382957.JPG", cAlternateFileName="")) returned 1 [0070.089] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.089] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382957.JPG") returned -1 [0070.089] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382957.JPG") returned -1 [0070.089] lstrcmpiA (lpString1="", lpString2="J0382957.JPG") returned -1 [0070.089] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG") returned="J0382955.JPG" [0070.089] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.089] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.089] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.089] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.089] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382957.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" [0070.089] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG", pszSpec="*.zip") returned 0 [0070.089] lstrlenA (lpString="*.zip") returned 5 [0070.089] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG", pszSpec="*.rar") returned 0 [0070.089] lstrlenA (lpString="*.rar") returned 5 [0070.089] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG", pszSpec="*.7z") returned 0 [0070.089] lstrlenA (lpString="*.7z") returned 4 [0070.089] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG", pszSpec="*.tar") returned 0 [0070.089] lstrlenA (lpString="*.tar") returned 5 [0070.089] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG", pszSpec="*.gzip") returned 0 [0070.089] lstrlenA (lpString="*.gzip") returned 6 [0070.090] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG", pszSpec="*.jpg") returned 1 [0070.090] lstrlenA (lpString="*.jpg") returned 5 [0070.090] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" [0070.090] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" [0070.090] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG." [0070.090] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.BD" [0070.090] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.090] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a9ed [0070.090] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae52e290, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0070.090] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.090] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1a991, lpOverlapped=0x0) returned 1 [0070.092] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG") returned="J0382957.JPG" [0070.095] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.095] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1a991, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1a991, lpOverlapped=0x0) returned 1 [0070.095] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.095] CloseHandle (hObject=0x1cc) returned 1 [0070.098] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382957.jpg.bd")) returned 1 [0070.098] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc397a9ef, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x193e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382958.JPG", cAlternateFileName="")) returned 1 [0070.098] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.099] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382958.JPG") returned -1 [0070.099] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382958.JPG") returned -1 [0070.099] lstrcmpiA (lpString1="", lpString2="J0382958.JPG") returned -1 [0070.099] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG") returned="J0382957.JPG" [0070.099] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.099] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.099] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.099] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.099] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382958.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" [0070.099] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG", pszSpec="*.zip") returned 0 [0070.099] lstrlenA (lpString="*.zip") returned 5 [0070.099] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG", pszSpec="*.rar") returned 0 [0070.099] lstrlenA (lpString="*.rar") returned 5 [0070.099] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG", pszSpec="*.7z") returned 0 [0070.099] lstrlenA (lpString="*.7z") returned 4 [0070.099] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG", pszSpec="*.tar") returned 0 [0070.099] lstrlenA (lpString="*.tar") returned 5 [0070.099] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG", pszSpec="*.gzip") returned 0 [0070.099] lstrlenA (lpString="*.gzip") returned 6 [0070.099] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG", pszSpec="*.jpg") returned 1 [0070.099] lstrlenA (lpString="*.jpg") returned 5 [0070.099] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" [0070.099] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" [0070.099] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG." [0070.099] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.BD" [0070.099] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.100] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x193e7 [0070.100] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc397a9ef, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0070.100] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.100] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1938b, lpOverlapped=0x0) returned 1 [0070.105] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG") returned="J0382958.JPG" [0070.108] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.108] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1938b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1938b, lpOverlapped=0x0) returned 1 [0070.108] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.108] CloseHandle (hObject=0x1cc) returned 1 [0070.111] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382958.jpg.bd")) returned 1 [0070.111] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae537ebf, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x14f8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382959.JPG", cAlternateFileName="")) returned 1 [0070.112] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.112] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382959.JPG") returned -1 [0070.112] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382959.JPG") returned -1 [0070.112] lstrcmpiA (lpString1="", lpString2="J0382959.JPG") returned -1 [0070.112] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG") returned="J0382958.JPG" [0070.112] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.112] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.112] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.112] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.112] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382959.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" [0070.112] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG", pszSpec="*.zip") returned 0 [0070.112] lstrlenA (lpString="*.zip") returned 5 [0070.112] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG", pszSpec="*.rar") returned 0 [0070.112] lstrlenA (lpString="*.rar") returned 5 [0070.112] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG", pszSpec="*.7z") returned 0 [0070.112] lstrlenA (lpString="*.7z") returned 4 [0070.112] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG", pszSpec="*.tar") returned 0 [0070.112] lstrlenA (lpString="*.tar") returned 5 [0070.112] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG", pszSpec="*.gzip") returned 0 [0070.112] lstrlenA (lpString="*.gzip") returned 6 [0070.112] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG", pszSpec="*.jpg") returned 1 [0070.112] lstrlenA (lpString="*.jpg") returned 5 [0070.112] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" [0070.112] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" [0070.112] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG." [0070.112] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.BD" [0070.112] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.113] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14f8a [0070.113] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae537ebf, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0070.113] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.113] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x14f2e, lpOverlapped=0x0) returned 1 [0070.128] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG") returned="J0382959.JPG" [0070.131] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.131] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x14f2e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x14f2e, lpOverlapped=0x0) returned 1 [0070.131] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.132] CloseHandle (hObject=0x1cc) returned 1 [0070.134] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382959.jpg.bd")) returned 1 [0070.135] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc398466d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1a3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382960.JPG", cAlternateFileName="")) returned 1 [0070.135] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.135] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382960.JPG") returned -1 [0070.136] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382960.JPG") returned -1 [0070.136] lstrcmpiA (lpString1="", lpString2="J0382960.JPG") returned -1 [0070.136] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG") returned="J0382959.JPG" [0070.136] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.136] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.136] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.136] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.136] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382960.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" [0070.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG", pszSpec="*.zip") returned 0 [0070.136] lstrlenA (lpString="*.zip") returned 5 [0070.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG", pszSpec="*.rar") returned 0 [0070.136] lstrlenA (lpString="*.rar") returned 5 [0070.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG", pszSpec="*.7z") returned 0 [0070.136] lstrlenA (lpString="*.7z") returned 4 [0070.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG", pszSpec="*.tar") returned 0 [0070.136] lstrlenA (lpString="*.tar") returned 5 [0070.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG", pszSpec="*.gzip") returned 0 [0070.136] lstrlenA (lpString="*.gzip") returned 6 [0070.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG", pszSpec="*.jpg") returned 1 [0070.136] lstrlenA (lpString="*.jpg") returned 5 [0070.136] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" [0070.136] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" [0070.136] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG." [0070.136] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.BD" [0070.136] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.137] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a3f4 [0070.137] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc398466d, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0070.137] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.137] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1a398, lpOverlapped=0x0) returned 1 [0070.140] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG") returned="J0382960.JPG" [0070.143] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.143] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1a398, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1a398, lpOverlapped=0x0) returned 1 [0070.144] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.144] CloseHandle (hObject=0x1cc) returned 1 [0070.147] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382960.jpg.bd")) returned 1 [0070.148] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc398cedc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x18ac4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382961.JPG", cAlternateFileName="")) returned 1 [0070.148] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.148] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382961.JPG") returned -1 [0070.148] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382961.JPG") returned -1 [0070.148] lstrcmpiA (lpString1="", lpString2="J0382961.JPG") returned -1 [0070.148] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG") returned="J0382960.JPG" [0070.148] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.149] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.149] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.149] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.149] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382961.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" [0070.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG", pszSpec="*.zip") returned 0 [0070.149] lstrlenA (lpString="*.zip") returned 5 [0070.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG", pszSpec="*.rar") returned 0 [0070.149] lstrlenA (lpString="*.rar") returned 5 [0070.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG", pszSpec="*.7z") returned 0 [0070.149] lstrlenA (lpString="*.7z") returned 4 [0070.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG", pszSpec="*.tar") returned 0 [0070.149] lstrlenA (lpString="*.tar") returned 5 [0070.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG", pszSpec="*.gzip") returned 0 [0070.149] lstrlenA (lpString="*.gzip") returned 6 [0070.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG", pszSpec="*.jpg") returned 1 [0070.150] lstrlenA (lpString="*.jpg") returned 5 [0070.150] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" [0070.150] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" [0070.150] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG." [0070.150] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.BD" [0070.150] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.150] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18ac4 [0070.150] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc398cedc, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0070.150] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.150] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x18a68, lpOverlapped=0x0) returned 1 [0070.153] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG") returned="J0382961.JPG" [0070.156] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.156] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x18a68, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x18a68, lpOverlapped=0x0) returned 1 [0070.157] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.157] CloseHandle (hObject=0x1cc) returned 1 [0070.160] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382961.jpg.bd")) returned 1 [0070.161] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3996aeb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1bef7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382962.JPG", cAlternateFileName="")) returned 1 [0070.161] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.161] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382962.JPG") returned -1 [0070.161] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382962.JPG") returned -1 [0070.161] lstrcmpiA (lpString1="", lpString2="J0382962.JPG") returned -1 [0070.162] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG") returned="J0382961.JPG" [0070.162] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.162] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.162] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.162] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.162] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382962.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" [0070.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG", pszSpec="*.zip") returned 0 [0070.162] lstrlenA (lpString="*.zip") returned 5 [0070.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG", pszSpec="*.rar") returned 0 [0070.162] lstrlenA (lpString="*.rar") returned 5 [0070.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG", pszSpec="*.7z") returned 0 [0070.162] lstrlenA (lpString="*.7z") returned 4 [0070.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG", pszSpec="*.tar") returned 0 [0070.162] lstrlenA (lpString="*.tar") returned 5 [0070.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG", pszSpec="*.gzip") returned 0 [0070.162] lstrlenA (lpString="*.gzip") returned 6 [0070.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG", pszSpec="*.jpg") returned 1 [0070.162] lstrlenA (lpString="*.jpg") returned 5 [0070.162] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" [0070.162] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" [0070.162] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG." [0070.163] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.BD" [0070.163] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.163] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1bef7 [0070.163] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc3996aeb, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0070.163] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.163] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1be9b, lpOverlapped=0x0) returned 1 [0070.167] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG") returned="J0382962.JPG" [0070.170] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.170] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1be9b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1be9b, lpOverlapped=0x0) returned 1 [0070.171] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.171] CloseHandle (hObject=0x1cc) returned 1 [0070.175] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382962.jpg.bd")) returned 1 [0070.175] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae54070c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x17dee, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382963.JPG", cAlternateFileName="")) returned 1 [0070.175] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.176] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382963.JPG") returned -1 [0070.176] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382963.JPG") returned -1 [0070.176] lstrcmpiA (lpString1="", lpString2="J0382963.JPG") returned -1 [0070.176] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG") returned="J0382962.JPG" [0070.176] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.176] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.176] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.176] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.176] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382963.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" [0070.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG", pszSpec="*.zip") returned 0 [0070.176] lstrlenA (lpString="*.zip") returned 5 [0070.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG", pszSpec="*.rar") returned 0 [0070.176] lstrlenA (lpString="*.rar") returned 5 [0070.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG", pszSpec="*.7z") returned 0 [0070.176] lstrlenA (lpString="*.7z") returned 4 [0070.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG", pszSpec="*.tar") returned 0 [0070.176] lstrlenA (lpString="*.tar") returned 5 [0070.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG", pszSpec="*.gzip") returned 0 [0070.176] lstrlenA (lpString="*.gzip") returned 6 [0070.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG", pszSpec="*.jpg") returned 1 [0070.176] lstrlenA (lpString="*.jpg") returned 5 [0070.176] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" [0070.177] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" [0070.177] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG." [0070.177] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.BD" [0070.177] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.178] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17dee [0070.178] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae54070c, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0070.178] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.178] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x17d92, lpOverlapped=0x0) returned 1 [0070.181] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG") returned="J0382963.JPG" [0070.183] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.183] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x17d92, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x17d92, lpOverlapped=0x0) returned 1 [0070.184] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.184] CloseHandle (hObject=0x1cc) returned 1 [0070.188] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382963.jpg.bd")) returned 1 [0070.188] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae54b73f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1bb02, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382965.JPG", cAlternateFileName="")) returned 1 [0070.189] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.189] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382965.JPG") returned -1 [0070.189] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382965.JPG") returned -1 [0070.189] lstrcmpiA (lpString1="", lpString2="J0382965.JPG") returned -1 [0070.189] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG") returned="J0382963.JPG" [0070.189] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.189] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.189] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.189] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.189] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382965.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" [0070.189] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG", pszSpec="*.zip") returned 0 [0070.189] lstrlenA (lpString="*.zip") returned 5 [0070.189] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG", pszSpec="*.rar") returned 0 [0070.189] lstrlenA (lpString="*.rar") returned 5 [0070.189] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG", pszSpec="*.7z") returned 0 [0070.189] lstrlenA (lpString="*.7z") returned 4 [0070.189] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG", pszSpec="*.tar") returned 0 [0070.189] lstrlenA (lpString="*.tar") returned 5 [0070.189] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG", pszSpec="*.gzip") returned 0 [0070.189] lstrlenA (lpString="*.gzip") returned 6 [0070.189] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG", pszSpec="*.jpg") returned 1 [0070.189] lstrlenA (lpString="*.jpg") returned 5 [0070.189] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" [0070.190] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" [0070.190] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG." [0070.190] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.BD" [0070.190] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.190] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1bb02 [0070.190] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae54b73f, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0070.190] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.190] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1baa6, lpOverlapped=0x0) returned 1 [0070.193] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG") returned="J0382965.JPG" [0070.197] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.197] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1baa6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1baa6, lpOverlapped=0x0) returned 1 [0070.197] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.198] CloseHandle (hObject=0x1cc) returned 1 [0070.202] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382965.jpg.bd")) returned 1 [0070.202] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc39a070f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382966.JPG", cAlternateFileName="")) returned 1 [0070.202] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.203] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382966.JPG") returned -1 [0070.203] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382966.JPG") returned -1 [0070.203] lstrcmpiA (lpString1="", lpString2="J0382966.JPG") returned -1 [0070.203] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG") returned="J0382965.JPG" [0070.203] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.203] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.203] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.203] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.203] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382966.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" [0070.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG", pszSpec="*.zip") returned 0 [0070.203] lstrlenA (lpString="*.zip") returned 5 [0070.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG", pszSpec="*.rar") returned 0 [0070.203] lstrlenA (lpString="*.rar") returned 5 [0070.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG", pszSpec="*.7z") returned 0 [0070.203] lstrlenA (lpString="*.7z") returned 4 [0070.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG", pszSpec="*.tar") returned 0 [0070.203] lstrlenA (lpString="*.tar") returned 5 [0070.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG", pszSpec="*.gzip") returned 0 [0070.203] lstrlenA (lpString="*.gzip") returned 6 [0070.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG", pszSpec="*.jpg") returned 1 [0070.203] lstrlenA (lpString="*.jpg") returned 5 [0070.203] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" [0070.204] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" [0070.204] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG." [0070.204] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.BD" [0070.204] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.212] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18888 [0070.212] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc39a070f, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0070.212] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.212] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1882c, lpOverlapped=0x0) returned 1 [0070.215] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG") returned="J0382966.JPG" [0070.218] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.218] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1882c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1882c, lpOverlapped=0x0) returned 1 [0070.219] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.219] CloseHandle (hObject=0x1cc) returned 1 [0070.223] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382966.jpg.bd")) returned 1 [0070.224] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae553f5b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16d08, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382967.JPG", cAlternateFileName="")) returned 1 [0070.224] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.224] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382967.JPG") returned -1 [0070.224] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382967.JPG") returned -1 [0070.224] lstrcmpiA (lpString1="", lpString2="J0382967.JPG") returned -1 [0070.224] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG") returned="J0382966.JPG" [0070.224] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.224] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.224] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.224] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.224] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382967.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" [0070.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG", pszSpec="*.zip") returned 0 [0070.224] lstrlenA (lpString="*.zip") returned 5 [0070.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG", pszSpec="*.rar") returned 0 [0070.224] lstrlenA (lpString="*.rar") returned 5 [0070.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG", pszSpec="*.7z") returned 0 [0070.224] lstrlenA (lpString="*.7z") returned 4 [0070.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG", pszSpec="*.tar") returned 0 [0070.224] lstrlenA (lpString="*.tar") returned 5 [0070.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG", pszSpec="*.gzip") returned 0 [0070.224] lstrlenA (lpString="*.gzip") returned 6 [0070.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG", pszSpec="*.jpg") returned 1 [0070.224] lstrlenA (lpString="*.jpg") returned 5 [0070.224] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" [0070.224] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" [0070.224] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG." [0070.224] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.BD" [0070.225] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.225] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16d08 [0070.225] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae553f5b, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0070.225] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.225] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x16cac, lpOverlapped=0x0) returned 1 [0070.227] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG") returned="J0382967.JPG" [0070.230] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.230] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x16cac, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x16cac, lpOverlapped=0x0) returned 1 [0070.230] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.230] CloseHandle (hObject=0x1cc) returned 1 [0070.233] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382967.jpg.bd")) returned 1 [0070.234] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae55dbab, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1b75f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382968.JPG", cAlternateFileName="")) returned 1 [0070.234] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.234] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382968.JPG") returned -1 [0070.234] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382968.JPG") returned -1 [0070.234] lstrcmpiA (lpString1="", lpString2="J0382968.JPG") returned -1 [0070.234] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG") returned="J0382967.JPG" [0070.234] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.234] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.234] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.234] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.234] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382968.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" [0070.234] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG", pszSpec="*.zip") returned 0 [0070.234] lstrlenA (lpString="*.zip") returned 5 [0070.234] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG", pszSpec="*.rar") returned 0 [0070.234] lstrlenA (lpString="*.rar") returned 5 [0070.234] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG", pszSpec="*.7z") returned 0 [0070.234] lstrlenA (lpString="*.7z") returned 4 [0070.234] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG", pszSpec="*.tar") returned 0 [0070.234] lstrlenA (lpString="*.tar") returned 5 [0070.234] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG", pszSpec="*.gzip") returned 0 [0070.234] lstrlenA (lpString="*.gzip") returned 6 [0070.234] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG", pszSpec="*.jpg") returned 1 [0070.234] lstrlenA (lpString="*.jpg") returned 5 [0070.234] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" [0070.234] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" [0070.234] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG." [0070.234] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.BD" [0070.234] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.235] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b75f [0070.235] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae55dbab, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0070.235] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.235] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1b703, lpOverlapped=0x0) returned 1 [0070.237] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG") returned="J0382968.JPG" [0070.240] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.240] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1b703, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1b703, lpOverlapped=0x0) returned 1 [0070.294] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.294] CloseHandle (hObject=0x1cc) returned 1 [0070.297] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382968.jpg.bd")) returned 1 [0070.297] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae566494, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1779f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382969.JPG", cAlternateFileName="")) returned 1 [0070.297] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.297] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382969.JPG") returned -1 [0070.298] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382969.JPG") returned -1 [0070.298] lstrcmpiA (lpString1="", lpString2="J0382969.JPG") returned -1 [0070.298] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG") returned="J0382968.JPG" [0070.298] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.298] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.298] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.298] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.298] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382969.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" [0070.298] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG", pszSpec="*.zip") returned 0 [0070.298] lstrlenA (lpString="*.zip") returned 5 [0070.298] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG", pszSpec="*.rar") returned 0 [0070.298] lstrlenA (lpString="*.rar") returned 5 [0070.298] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG", pszSpec="*.7z") returned 0 [0070.298] lstrlenA (lpString="*.7z") returned 4 [0070.298] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG", pszSpec="*.tar") returned 0 [0070.298] lstrlenA (lpString="*.tar") returned 5 [0070.298] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG", pszSpec="*.gzip") returned 0 [0070.298] lstrlenA (lpString="*.gzip") returned 6 [0070.298] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG", pszSpec="*.jpg") returned 1 [0070.298] lstrlenA (lpString="*.jpg") returned 5 [0070.298] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" [0070.298] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" [0070.298] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG." [0070.298] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.BD" [0070.298] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.310] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1779f [0070.310] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae566494, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0070.310] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.310] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x17743, lpOverlapped=0x0) returned 1 [0070.312] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG") returned="J0382969.JPG" [0070.314] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.314] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x17743, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x17743, lpOverlapped=0x0) returned 1 [0070.320] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.320] CloseHandle (hObject=0x1cc) returned 1 [0070.323] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382969.jpg.bd")) returned 1 [0070.324] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc39a91f3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x15b94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382970.JPG", cAlternateFileName="")) returned 1 [0070.324] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.324] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0382970.JPG") returned -1 [0070.324] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0382970.JPG") returned -1 [0070.324] lstrcmpiA (lpString1="", lpString2="J0382970.JPG") returned -1 [0070.324] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG") returned="J0382969.JPG" [0070.324] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.324] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.324] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.324] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.324] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0382970.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" [0070.324] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG", pszSpec="*.zip") returned 0 [0070.325] lstrlenA (lpString="*.zip") returned 5 [0070.325] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG", pszSpec="*.rar") returned 0 [0070.325] lstrlenA (lpString="*.rar") returned 5 [0070.325] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG", pszSpec="*.7z") returned 0 [0070.325] lstrlenA (lpString="*.7z") returned 4 [0070.325] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG", pszSpec="*.tar") returned 0 [0070.325] lstrlenA (lpString="*.tar") returned 5 [0070.325] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG", pszSpec="*.gzip") returned 0 [0070.325] lstrlenA (lpString="*.gzip") returned 6 [0070.325] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG", pszSpec="*.jpg") returned 1 [0070.325] lstrlenA (lpString="*.jpg") returned 5 [0070.325] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" [0070.325] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" [0070.325] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG." [0070.325] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.BD" [0070.325] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.325] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15b94 [0070.325] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc39a91f3, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0070.325] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.325] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x15b38, lpOverlapped=0x0) returned 1 [0070.327] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG") returned="J0382970.JPG" [0070.330] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.330] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x15b38, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x15b38, lpOverlapped=0x0) returned 1 [0070.330] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.330] CloseHandle (hObject=0x1cc) returned 1 [0070.333] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382970.jpg.bd")) returned 1 [0070.334] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae57019f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x190e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0384862.JPG", cAlternateFileName="")) returned 1 [0070.334] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.334] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0384862.JPG") returned -1 [0070.334] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0384862.JPG") returned -1 [0070.334] lstrcmpiA (lpString1="", lpString2="J0384862.JPG") returned -1 [0070.334] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG") returned="J0382970.JPG" [0070.334] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.334] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.334] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.334] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.334] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0384862.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" [0070.334] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG", pszSpec="*.zip") returned 0 [0070.334] lstrlenA (lpString="*.zip") returned 5 [0070.334] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG", pszSpec="*.rar") returned 0 [0070.334] lstrlenA (lpString="*.rar") returned 5 [0070.334] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG", pszSpec="*.7z") returned 0 [0070.334] lstrlenA (lpString="*.7z") returned 4 [0070.334] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG", pszSpec="*.tar") returned 0 [0070.335] lstrlenA (lpString="*.tar") returned 5 [0070.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG", pszSpec="*.gzip") returned 0 [0070.335] lstrlenA (lpString="*.gzip") returned 6 [0070.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG", pszSpec="*.jpg") returned 1 [0070.335] lstrlenA (lpString="*.jpg") returned 5 [0070.335] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" [0070.335] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" [0070.335] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG." [0070.335] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.BD" [0070.335] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.335] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x190e9 [0070.335] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae57019f, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0070.335] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.335] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1908d, lpOverlapped=0x0) returned 1 [0070.338] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG") returned="J0384862.JPG" [0070.340] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.340] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1908d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1908d, lpOverlapped=0x0) returned 1 [0070.341] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.341] CloseHandle (hObject=0x1cc) returned 1 [0070.344] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384862.jpg.bd")) returned 1 [0070.344] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc39b18b1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x17b79, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0384885.JPG", cAlternateFileName="")) returned 1 [0070.344] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.344] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0384885.JPG") returned -1 [0070.344] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0384885.JPG") returned -1 [0070.344] lstrcmpiA (lpString1="", lpString2="J0384885.JPG") returned -1 [0070.345] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG") returned="J0384862.JPG" [0070.345] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.345] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.345] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.345] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.345] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0384885.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" [0070.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG", pszSpec="*.zip") returned 0 [0070.345] lstrlenA (lpString="*.zip") returned 5 [0070.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG", pszSpec="*.rar") returned 0 [0070.345] lstrlenA (lpString="*.rar") returned 5 [0070.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG", pszSpec="*.7z") returned 0 [0070.345] lstrlenA (lpString="*.7z") returned 4 [0070.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG", pszSpec="*.tar") returned 0 [0070.345] lstrlenA (lpString="*.tar") returned 5 [0070.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG", pszSpec="*.gzip") returned 0 [0070.345] lstrlenA (lpString="*.gzip") returned 6 [0070.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG", pszSpec="*.jpg") returned 1 [0070.345] lstrlenA (lpString="*.jpg") returned 5 [0070.345] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" [0070.345] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" [0070.345] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG." [0070.345] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.BD" [0070.345] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.346] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17b79 [0070.346] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc39b18b1, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0070.346] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.346] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x17b1d, lpOverlapped=0x0) returned 1 [0070.348] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG") returned="J0384885.JPG" [0070.351] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.351] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x17b1d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x17b1d, lpOverlapped=0x0) returned 1 [0070.351] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.351] CloseHandle (hObject=0x1cc) returned 1 [0070.361] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384885.jpg.bd")) returned 1 [0070.361] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc39c8d27, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x14033, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0384888.JPG", cAlternateFileName="")) returned 1 [0070.362] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.362] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0384888.JPG") returned -1 [0070.362] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0384888.JPG") returned -1 [0070.362] lstrcmpiA (lpString1="", lpString2="J0384888.JPG") returned -1 [0070.362] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG") returned="J0384885.JPG" [0070.362] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.362] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.362] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.362] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.362] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0384888.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" [0070.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG", pszSpec="*.zip") returned 0 [0070.362] lstrlenA (lpString="*.zip") returned 5 [0070.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG", pszSpec="*.rar") returned 0 [0070.362] lstrlenA (lpString="*.rar") returned 5 [0070.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG", pszSpec="*.7z") returned 0 [0070.362] lstrlenA (lpString="*.7z") returned 4 [0070.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG", pszSpec="*.tar") returned 0 [0070.362] lstrlenA (lpString="*.tar") returned 5 [0070.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG", pszSpec="*.gzip") returned 0 [0070.362] lstrlenA (lpString="*.gzip") returned 6 [0070.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG", pszSpec="*.jpg") returned 1 [0070.362] lstrlenA (lpString="*.jpg") returned 5 [0070.362] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" [0070.362] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" [0070.362] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG." [0070.362] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.BD" [0070.362] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.363] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14033 [0070.363] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc39c8d27, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0070.363] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.363] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x13fd7, lpOverlapped=0x0) returned 1 [0070.365] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG") returned="J0384888.JPG" [0070.367] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.367] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x13fd7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x13fd7, lpOverlapped=0x0) returned 1 [0070.367] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.367] CloseHandle (hObject=0x1cc) returned 1 [0070.371] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384888.jpg.bd")) returned 1 [0070.371] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc39dd825, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd8f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0384895.JPG", cAlternateFileName="")) returned 1 [0070.371] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.371] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0384895.JPG") returned -1 [0070.372] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0384895.JPG") returned -1 [0070.372] lstrcmpiA (lpString1="", lpString2="J0384895.JPG") returned -1 [0070.372] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG") returned="J0384888.JPG" [0070.372] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.372] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.372] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.372] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.372] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0384895.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" [0070.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG", pszSpec="*.zip") returned 0 [0070.372] lstrlenA (lpString="*.zip") returned 5 [0070.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG", pszSpec="*.rar") returned 0 [0070.372] lstrlenA (lpString="*.rar") returned 5 [0070.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG", pszSpec="*.7z") returned 0 [0070.372] lstrlenA (lpString="*.7z") returned 4 [0070.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG", pszSpec="*.tar") returned 0 [0070.372] lstrlenA (lpString="*.tar") returned 5 [0070.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG", pszSpec="*.gzip") returned 0 [0070.372] lstrlenA (lpString="*.gzip") returned 6 [0070.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG", pszSpec="*.jpg") returned 1 [0070.372] lstrlenA (lpString="*.jpg") returned 5 [0070.372] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" [0070.372] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" [0070.372] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG." [0070.372] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.BD" [0070.372] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.373] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd8f6 [0070.373] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc39dd825, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8aece400, dwHighDateTime=0x1d0ca66)) returned 1 [0070.373] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.373] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xd89a, lpOverlapped=0x0) returned 1 [0070.375] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG") returned="J0384895.JPG" [0070.377] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.377] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xd89a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xd89a, lpOverlapped=0x0) returned 1 [0070.377] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.377] CloseHandle (hObject=0x1cc) returned 1 [0070.379] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384895.jpg.bd")) returned 1 [0070.379] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae578992, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x11780, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0384900.JPG", cAlternateFileName="")) returned 1 [0070.379] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.379] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0384900.JPG") returned -1 [0070.379] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0384900.JPG") returned -1 [0070.379] lstrcmpiA (lpString1="", lpString2="J0384900.JPG") returned -1 [0070.380] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG") returned="J0384895.JPG" [0070.380] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.380] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.380] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.380] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.380] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0384900.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" [0070.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG", pszSpec="*.zip") returned 0 [0070.380] lstrlenA (lpString="*.zip") returned 5 [0070.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG", pszSpec="*.rar") returned 0 [0070.380] lstrlenA (lpString="*.rar") returned 5 [0070.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG", pszSpec="*.7z") returned 0 [0070.380] lstrlenA (lpString="*.7z") returned 4 [0070.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG", pszSpec="*.tar") returned 0 [0070.380] lstrlenA (lpString="*.tar") returned 5 [0070.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG", pszSpec="*.gzip") returned 0 [0070.380] lstrlenA (lpString="*.gzip") returned 6 [0070.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG", pszSpec="*.jpg") returned 1 [0070.380] lstrlenA (lpString="*.jpg") returned 5 [0070.380] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" [0070.380] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" [0070.380] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG." [0070.380] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.BD" [0070.380] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.381] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11780 [0070.381] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae578992, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.381] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.381] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x11724, lpOverlapped=0x0) returned 1 [0070.383] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG") returned="J0384900.JPG" [0070.385] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.385] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x11724, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x11724, lpOverlapped=0x0) returned 1 [0070.385] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.385] CloseHandle (hObject=0x1cc) returned 1 [0070.387] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384900.jpg.bd")) returned 1 [0070.388] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae57eb1b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x787a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0386120.JPG", cAlternateFileName="")) returned 1 [0070.388] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.388] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0386120.JPG") returned -1 [0070.388] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0386120.JPG") returned -1 [0070.388] lstrcmpiA (lpString1="", lpString2="J0386120.JPG") returned -1 [0070.388] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG") returned="J0384900.JPG" [0070.388] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.388] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.388] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.388] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.388] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0386120.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" [0070.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG", pszSpec="*.zip") returned 0 [0070.388] lstrlenA (lpString="*.zip") returned 5 [0070.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG", pszSpec="*.rar") returned 0 [0070.389] lstrlenA (lpString="*.rar") returned 5 [0070.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG", pszSpec="*.7z") returned 0 [0070.389] lstrlenA (lpString="*.7z") returned 4 [0070.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG", pszSpec="*.tar") returned 0 [0070.389] lstrlenA (lpString="*.tar") returned 5 [0070.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG", pszSpec="*.gzip") returned 0 [0070.389] lstrlenA (lpString="*.gzip") returned 6 [0070.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG", pszSpec="*.jpg") returned 1 [0070.389] lstrlenA (lpString="*.jpg") returned 5 [0070.389] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" [0070.389] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" [0070.389] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG." [0070.389] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.BD" [0070.389] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.389] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x787a [0070.389] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae57eb1b, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.389] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.389] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x781e, lpOverlapped=0x0) returned 1 [0070.391] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG") returned="J0386120.JPG" [0070.392] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.392] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x781e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x781e, lpOverlapped=0x0) returned 1 [0070.392] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.392] CloseHandle (hObject=0x1cc) returned 1 [0070.394] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386120.jpg.bd")) returned 1 [0070.394] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae584cae, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa91e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0386267.JPG", cAlternateFileName="")) returned 1 [0070.394] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.394] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0386267.JPG") returned -1 [0070.394] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0386267.JPG") returned -1 [0070.394] lstrcmpiA (lpString1="", lpString2="J0386267.JPG") returned -1 [0070.394] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG") returned="J0386120.JPG" [0070.394] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.394] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.394] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.395] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.395] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0386267.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" [0070.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG", pszSpec="*.zip") returned 0 [0070.395] lstrlenA (lpString="*.zip") returned 5 [0070.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG", pszSpec="*.rar") returned 0 [0070.395] lstrlenA (lpString="*.rar") returned 5 [0070.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG", pszSpec="*.7z") returned 0 [0070.395] lstrlenA (lpString="*.7z") returned 4 [0070.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG", pszSpec="*.tar") returned 0 [0070.395] lstrlenA (lpString="*.tar") returned 5 [0070.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG", pszSpec="*.gzip") returned 0 [0070.395] lstrlenA (lpString="*.gzip") returned 6 [0070.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG", pszSpec="*.jpg") returned 1 [0070.395] lstrlenA (lpString="*.jpg") returned 5 [0070.395] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" [0070.395] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" [0070.395] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG." [0070.395] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.BD" [0070.395] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.397] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa91e [0070.397] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae584cae, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.397] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.397] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xa8c2, lpOverlapped=0x0) returned 1 [0070.398] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG") returned="J0386267.JPG" [0070.400] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.400] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xa8c2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xa8c2, lpOverlapped=0x0) returned 1 [0070.400] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.400] CloseHandle (hObject=0x1cc) returned 1 [0070.402] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386267.jpg.bd")) returned 1 [0070.403] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae589b25, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3b43, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0386270.JPG", cAlternateFileName="")) returned 1 [0070.403] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.403] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0386270.JPG") returned -1 [0070.403] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0386270.JPG") returned -1 [0070.403] lstrcmpiA (lpString1="", lpString2="J0386270.JPG") returned -1 [0070.403] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG") returned="J0386267.JPG" [0070.403] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.403] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.403] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.403] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.403] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0386270.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" [0070.403] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG", pszSpec="*.zip") returned 0 [0070.403] lstrlenA (lpString="*.zip") returned 5 [0070.403] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG", pszSpec="*.rar") returned 0 [0070.403] lstrlenA (lpString="*.rar") returned 5 [0070.403] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG", pszSpec="*.7z") returned 0 [0070.403] lstrlenA (lpString="*.7z") returned 4 [0070.403] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG", pszSpec="*.tar") returned 0 [0070.403] lstrlenA (lpString="*.tar") returned 5 [0070.403] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG", pszSpec="*.gzip") returned 0 [0070.403] lstrlenA (lpString="*.gzip") returned 6 [0070.403] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG", pszSpec="*.jpg") returned 1 [0070.403] lstrlenA (lpString="*.jpg") returned 5 [0070.403] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" [0070.403] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" [0070.404] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG." [0070.404] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.BD" [0070.404] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.404] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b43 [0070.404] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae589b25, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.404] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.404] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x3ae7, lpOverlapped=0x0) returned 1 [0070.406] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG") returned="J0386270.JPG" [0070.406] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.406] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x3ae7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x3ae7, lpOverlapped=0x0) returned 1 [0070.407] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.407] CloseHandle (hObject=0x1cc) returned 1 [0070.408] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386270.jpg.bd")) returned 1 [0070.409] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae58fc9a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x396a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0386485.JPG", cAlternateFileName="")) returned 1 [0070.409] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.409] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0386485.JPG") returned -1 [0070.409] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0386485.JPG") returned -1 [0070.409] lstrcmpiA (lpString1="", lpString2="J0386485.JPG") returned -1 [0070.409] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG") returned="J0386270.JPG" [0070.409] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.409] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.409] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.409] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.409] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0386485.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" [0070.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG", pszSpec="*.zip") returned 0 [0070.409] lstrlenA (lpString="*.zip") returned 5 [0070.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG", pszSpec="*.rar") returned 0 [0070.409] lstrlenA (lpString="*.rar") returned 5 [0070.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG", pszSpec="*.7z") returned 0 [0070.409] lstrlenA (lpString="*.7z") returned 4 [0070.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG", pszSpec="*.tar") returned 0 [0070.409] lstrlenA (lpString="*.tar") returned 5 [0070.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG", pszSpec="*.gzip") returned 0 [0070.409] lstrlenA (lpString="*.gzip") returned 6 [0070.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG", pszSpec="*.jpg") returned 1 [0070.409] lstrlenA (lpString="*.jpg") returned 5 [0070.409] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" [0070.409] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" [0070.409] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG." [0070.410] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.BD" [0070.410] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.410] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x396a [0070.410] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae58fc9a, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.410] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.410] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x390e, lpOverlapped=0x0) returned 1 [0070.411] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG") returned="J0386485.JPG" [0070.412] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.412] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x390e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x390e, lpOverlapped=0x0) returned 1 [0070.412] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.412] CloseHandle (hObject=0x1cc) returned 1 [0070.413] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386485.jpg.bd")) returned 1 [0070.414] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae595e1c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x693e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0386764.JPG", cAlternateFileName="")) returned 1 [0070.414] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.414] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0386764.JPG") returned -1 [0070.414] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0386764.JPG") returned -1 [0070.414] lstrcmpiA (lpString1="", lpString2="J0386764.JPG") returned -1 [0070.414] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG") returned="J0386485.JPG" [0070.414] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.414] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.414] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.414] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.414] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0386764.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" [0070.414] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG", pszSpec="*.zip") returned 0 [0070.414] lstrlenA (lpString="*.zip") returned 5 [0070.414] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG", pszSpec="*.rar") returned 0 [0070.414] lstrlenA (lpString="*.rar") returned 5 [0070.414] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG", pszSpec="*.7z") returned 0 [0070.414] lstrlenA (lpString="*.7z") returned 4 [0070.414] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG", pszSpec="*.tar") returned 0 [0070.414] lstrlenA (lpString="*.tar") returned 5 [0070.414] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG", pszSpec="*.gzip") returned 0 [0070.414] lstrlenA (lpString="*.gzip") returned 6 [0070.414] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG", pszSpec="*.jpg") returned 1 [0070.414] lstrlenA (lpString="*.jpg") returned 5 [0070.414] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" [0070.414] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" [0070.414] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG." [0070.414] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.BD" [0070.415] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.415] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x693e [0070.415] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae595e1c, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.415] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.415] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x68e2, lpOverlapped=0x0) returned 1 [0070.417] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG") returned="J0386764.JPG" [0070.417] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.417] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x68e2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x68e2, lpOverlapped=0x0) returned 1 [0070.418] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.418] CloseHandle (hObject=0x1cc) returned 1 [0070.419] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386764.jpg.bd")) returned 1 [0070.420] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc39e395f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xcb0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0387337.JPG", cAlternateFileName="")) returned 1 [0070.420] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.421] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0387337.JPG") returned -1 [0070.421] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0387337.JPG") returned -1 [0070.421] lstrcmpiA (lpString1="", lpString2="J0387337.JPG") returned -1 [0070.421] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG") returned="J0386764.JPG" [0070.421] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.421] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.421] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.421] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.421] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0387337.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" [0070.422] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG", pszSpec="*.zip") returned 0 [0070.422] lstrlenA (lpString="*.zip") returned 5 [0070.422] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG", pszSpec="*.rar") returned 0 [0070.422] lstrlenA (lpString="*.rar") returned 5 [0070.422] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG", pszSpec="*.7z") returned 0 [0070.422] lstrlenA (lpString="*.7z") returned 4 [0070.422] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG", pszSpec="*.tar") returned 0 [0070.422] lstrlenA (lpString="*.tar") returned 5 [0070.422] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG", pszSpec="*.gzip") returned 0 [0070.422] lstrlenA (lpString="*.gzip") returned 6 [0070.422] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG", pszSpec="*.jpg") returned 1 [0070.422] lstrlenA (lpString="*.jpg") returned 5 [0070.422] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" [0070.422] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" [0070.422] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG." [0070.422] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.BD" [0070.422] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.422] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcb0a [0070.422] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc39e395f, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.422] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.422] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xcaae, lpOverlapped=0x0) returned 1 [0070.424] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG") returned="J0387337.JPG" [0070.426] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.426] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xcaae, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xcaae, lpOverlapped=0x0) returned 1 [0070.426] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.429] CloseHandle (hObject=0x1cc) returned 1 [0070.431] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387337.jpg.bd")) returned 1 [0070.432] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc39e87a5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6cec, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0387578.JPG", cAlternateFileName="")) returned 1 [0070.432] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.432] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0387578.JPG") returned -1 [0070.432] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0387578.JPG") returned -1 [0070.432] lstrcmpiA (lpString1="", lpString2="J0387578.JPG") returned -1 [0070.432] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG") returned="J0387337.JPG" [0070.432] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.432] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.432] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.432] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.432] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0387578.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" [0070.432] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG", pszSpec="*.zip") returned 0 [0070.432] lstrlenA (lpString="*.zip") returned 5 [0070.432] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG", pszSpec="*.rar") returned 0 [0070.432] lstrlenA (lpString="*.rar") returned 5 [0070.432] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG", pszSpec="*.7z") returned 0 [0070.432] lstrlenA (lpString="*.7z") returned 4 [0070.432] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG", pszSpec="*.tar") returned 0 [0070.432] lstrlenA (lpString="*.tar") returned 5 [0070.432] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG", pszSpec="*.gzip") returned 0 [0070.432] lstrlenA (lpString="*.gzip") returned 6 [0070.432] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG", pszSpec="*.jpg") returned 1 [0070.432] lstrlenA (lpString="*.jpg") returned 5 [0070.433] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" [0070.433] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" [0070.433] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG." [0070.433] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.BD" [0070.433] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.433] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6cec [0070.433] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc39e87a5, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.433] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.433] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x6c90, lpOverlapped=0x0) returned 1 [0070.435] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG") returned="J0387578.JPG" [0070.435] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.436] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x6c90, lpOverlapped=0x0) returned 1 [0070.436] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.436] CloseHandle (hObject=0x1cc) returned 1 [0070.437] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387578.jpg.bd")) returned 1 [0070.438] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae59bfa7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x98c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0387591.JPG", cAlternateFileName="")) returned 1 [0070.438] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.438] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0387591.JPG") returned -1 [0070.438] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0387591.JPG") returned -1 [0070.438] lstrcmpiA (lpString1="", lpString2="J0387591.JPG") returned -1 [0070.438] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG") returned="J0387578.JPG" [0070.438] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.438] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.438] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.438] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.438] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0387591.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" [0070.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG", pszSpec="*.zip") returned 0 [0070.438] lstrlenA (lpString="*.zip") returned 5 [0070.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG", pszSpec="*.rar") returned 0 [0070.438] lstrlenA (lpString="*.rar") returned 5 [0070.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG", pszSpec="*.7z") returned 0 [0070.438] lstrlenA (lpString="*.7z") returned 4 [0070.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG", pszSpec="*.tar") returned 0 [0070.438] lstrlenA (lpString="*.tar") returned 5 [0070.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG", pszSpec="*.gzip") returned 0 [0070.438] lstrlenA (lpString="*.gzip") returned 6 [0070.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG", pszSpec="*.jpg") returned 1 [0070.438] lstrlenA (lpString="*.jpg") returned 5 [0070.438] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" [0070.438] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" [0070.438] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG." [0070.438] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.BD" [0070.439] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.439] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x98c7 [0070.439] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae59bfa7, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.439] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.439] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x986b, lpOverlapped=0x0) returned 1 [0070.441] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG") returned="J0387591.JPG" [0070.442] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.442] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x986b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x986b, lpOverlapped=0x0) returned 1 [0070.442] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.442] CloseHandle (hObject=0x1cc) returned 1 [0070.444] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387591.jpg.bd")) returned 1 [0070.445] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc39f102d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb9bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0387604.JPG", cAlternateFileName="")) returned 1 [0070.445] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.445] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0387604.JPG") returned -1 [0070.445] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0387604.JPG") returned -1 [0070.445] lstrcmpiA (lpString1="", lpString2="J0387604.JPG") returned -1 [0070.445] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG") returned="J0387591.JPG" [0070.446] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.446] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.446] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.446] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.446] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0387604.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" [0070.446] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG", pszSpec="*.zip") returned 0 [0070.446] lstrlenA (lpString="*.zip") returned 5 [0070.446] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG", pszSpec="*.rar") returned 0 [0070.447] lstrlenA (lpString="*.rar") returned 5 [0070.447] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG", pszSpec="*.7z") returned 0 [0070.447] lstrlenA (lpString="*.7z") returned 4 [0070.447] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG", pszSpec="*.tar") returned 0 [0070.447] lstrlenA (lpString="*.tar") returned 5 [0070.447] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG", pszSpec="*.gzip") returned 0 [0070.447] lstrlenA (lpString="*.gzip") returned 6 [0070.447] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG", pszSpec="*.jpg") returned 1 [0070.447] lstrlenA (lpString="*.jpg") returned 5 [0070.447] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" [0070.447] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" [0070.447] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG." [0070.447] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.BD" [0070.447] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.448] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9bf [0070.448] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc39f102d, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.448] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.448] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xb963, lpOverlapped=0x0) returned 1 [0070.450] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG") returned="J0387604.JPG" [0070.453] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.453] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xb963, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xb963, lpOverlapped=0x0) returned 1 [0070.454] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.454] CloseHandle (hObject=0x1cc) returned 1 [0070.457] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387604.jpg.bd")) returned 1 [0070.457] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc39fac60, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x98ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0387882.JPG", cAlternateFileName="")) returned 1 [0070.457] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.457] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0387882.JPG") returned -1 [0070.458] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0387882.JPG") returned -1 [0070.458] lstrcmpiA (lpString1="", lpString2="J0387882.JPG") returned -1 [0070.458] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG") returned="J0387604.JPG" [0070.458] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.458] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.458] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.458] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.458] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0387882.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" [0070.458] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG", pszSpec="*.zip") returned 0 [0070.458] lstrlenA (lpString="*.zip") returned 5 [0070.458] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG", pszSpec="*.rar") returned 0 [0070.458] lstrlenA (lpString="*.rar") returned 5 [0070.458] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG", pszSpec="*.7z") returned 0 [0070.458] lstrlenA (lpString="*.7z") returned 4 [0070.458] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG", pszSpec="*.tar") returned 0 [0070.458] lstrlenA (lpString="*.tar") returned 5 [0070.458] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG", pszSpec="*.gzip") returned 0 [0070.458] lstrlenA (lpString="*.gzip") returned 6 [0070.458] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG", pszSpec="*.jpg") returned 1 [0070.458] lstrlenA (lpString="*.jpg") returned 5 [0070.458] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" [0070.458] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" [0070.458] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG." [0070.458] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.BD" [0070.458] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.459] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x98ec [0070.459] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc39fac60, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.459] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.459] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x9890, lpOverlapped=0x0) returned 1 [0070.464] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG") returned="J0387882.JPG" [0070.465] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.465] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x9890, lpOverlapped=0x0) returned 1 [0070.466] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.466] CloseHandle (hObject=0x1cc) returned 1 [0070.468] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387882.jpg.bd")) returned 1 [0070.468] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae5a216a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7df3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0387895.JPG", cAlternateFileName="")) returned 1 [0070.468] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.468] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0387895.JPG") returned -1 [0070.468] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0387895.JPG") returned -1 [0070.468] lstrcmpiA (lpString1="", lpString2="J0387895.JPG") returned -1 [0070.468] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG") returned="J0387882.JPG" [0070.468] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.468] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.469] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.469] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.469] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0387895.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" [0070.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG", pszSpec="*.zip") returned 0 [0070.469] lstrlenA (lpString="*.zip") returned 5 [0070.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG", pszSpec="*.rar") returned 0 [0070.469] lstrlenA (lpString="*.rar") returned 5 [0070.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG", pszSpec="*.7z") returned 0 [0070.469] lstrlenA (lpString="*.7z") returned 4 [0070.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG", pszSpec="*.tar") returned 0 [0070.469] lstrlenA (lpString="*.tar") returned 5 [0070.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG", pszSpec="*.gzip") returned 0 [0070.469] lstrlenA (lpString="*.gzip") returned 6 [0070.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG", pszSpec="*.jpg") returned 1 [0070.469] lstrlenA (lpString="*.jpg") returned 5 [0070.469] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" [0070.469] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" [0070.469] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG." [0070.469] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.BD" [0070.469] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.469] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7df3 [0070.469] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae5a216a, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.470] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.470] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7d97, lpOverlapped=0x0) returned 1 [0070.472] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG") returned="J0387895.JPG" [0070.473] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.473] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7d97, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7d97, lpOverlapped=0x0) returned 1 [0070.473] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.473] CloseHandle (hObject=0x1cc) returned 1 [0070.475] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387895.jpg.bd")) returned 1 [0070.475] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae5a6f41, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x351c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0390072.JPG", cAlternateFileName="")) returned 1 [0070.475] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.475] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0390072.JPG") returned -1 [0070.476] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0390072.JPG") returned -1 [0070.476] lstrcmpiA (lpString1="", lpString2="J0390072.JPG") returned -1 [0070.476] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG") returned="J0387895.JPG" [0070.476] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.476] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.476] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.476] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.476] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0390072.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" [0070.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG", pszSpec="*.zip") returned 0 [0070.476] lstrlenA (lpString="*.zip") returned 5 [0070.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG", pszSpec="*.rar") returned 0 [0070.476] lstrlenA (lpString="*.rar") returned 5 [0070.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG", pszSpec="*.7z") returned 0 [0070.476] lstrlenA (lpString="*.7z") returned 4 [0070.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG", pszSpec="*.tar") returned 0 [0070.476] lstrlenA (lpString="*.tar") returned 5 [0070.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG", pszSpec="*.gzip") returned 0 [0070.476] lstrlenA (lpString="*.gzip") returned 6 [0070.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG", pszSpec="*.jpg") returned 1 [0070.476] lstrlenA (lpString="*.jpg") returned 5 [0070.476] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" [0070.476] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" [0070.476] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG." [0070.476] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.BD" [0070.476] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.477] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x351c [0070.477] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae5a6f41, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.477] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.477] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x34c0, lpOverlapped=0x0) returned 1 [0070.478] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG") returned="J0390072.JPG" [0070.479] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.479] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x34c0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x34c0, lpOverlapped=0x0) returned 1 [0070.479] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.479] CloseHandle (hObject=0x1cc) returned 1 [0070.481] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0390072.jpg.bd")) returned 1 [0070.481] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae5b1f15, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x31883, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0400001.PNG", cAlternateFileName="")) returned 1 [0070.483] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.483] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0400001.PNG") returned -1 [0070.483] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0400001.PNG") returned -1 [0070.483] lstrcmpiA (lpString1="", lpString2="J0400001.PNG") returned -1 [0070.483] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG") returned="J0390072.JPG" [0070.483] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.483] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.483] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.483] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.483] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0400001.PNG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" [0070.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG", pszSpec="*.zip") returned 0 [0070.483] lstrlenA (lpString="*.zip") returned 5 [0070.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG", pszSpec="*.rar") returned 0 [0070.483] lstrlenA (lpString="*.rar") returned 5 [0070.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG", pszSpec="*.7z") returned 0 [0070.483] lstrlenA (lpString="*.7z") returned 4 [0070.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG", pszSpec="*.tar") returned 0 [0070.483] lstrlenA (lpString="*.tar") returned 5 [0070.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG", pszSpec="*.gzip") returned 0 [0070.483] lstrlenA (lpString="*.gzip") returned 6 [0070.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG", pszSpec="*.jpg") returned 0 [0070.483] lstrlenA (lpString="*.jpg") returned 5 [0070.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG", pszSpec="*.jpeg") returned 0 [0070.483] lstrlenA (lpString="*.jpeg") returned 6 [0070.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG", pszSpec="*.psd") returned 0 [0070.483] lstrlenA (lpString="*.psd") returned 5 [0070.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG", pszSpec="*.cdr") returned 0 [0070.483] lstrlenA (lpString="*.cdr") returned 5 [0070.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG", pszSpec="*.dwg") returned 0 [0070.483] lstrlenA (lpString="*.dwg") returned 5 [0070.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG", pszSpec="*.max") returned 0 [0070.484] lstrlenA (lpString="*.max") returned 5 [0070.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG", pszSpec="*.bmp") returned 0 [0070.484] lstrlenA (lpString="*.bmp") returned 5 [0070.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG", pszSpec="*.gif") returned 0 [0070.484] lstrlenA (lpString="*.gif") returned 5 [0070.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG", pszSpec="*.png") returned 1 [0070.484] lstrlenA (lpString="*.png") returned 5 [0070.484] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" [0070.484] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" [0070.484] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG." [0070.484] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.BD" [0070.484] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400001.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.484] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x31883 [0070.484] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae5b1f15, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.484] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.484] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x31827, lpOverlapped=0x0) returned 1 [0070.490] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG") returned="J0400001.PNG" [0070.495] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.495] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x31827, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x31827, lpOverlapped=0x0) returned 1 [0070.496] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.496] CloseHandle (hObject=0x1cc) returned 1 [0070.501] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400001.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400001.png.bd")) returned 1 [0070.502] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae5bbdc2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x15d49, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0400002.PNG", cAlternateFileName="")) returned 1 [0070.502] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.502] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0400002.PNG") returned -1 [0070.502] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0400002.PNG") returned -1 [0070.502] lstrcmpiA (lpString1="", lpString2="J0400002.PNG") returned -1 [0070.502] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG") returned="J0400001.PNG" [0070.502] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.502] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.502] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.502] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.502] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0400002.PNG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" [0070.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG", pszSpec="*.zip") returned 0 [0070.502] lstrlenA (lpString="*.zip") returned 5 [0070.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG", pszSpec="*.rar") returned 0 [0070.502] lstrlenA (lpString="*.rar") returned 5 [0070.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG", pszSpec="*.7z") returned 0 [0070.503] lstrlenA (lpString="*.7z") returned 4 [0070.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG", pszSpec="*.tar") returned 0 [0070.503] lstrlenA (lpString="*.tar") returned 5 [0070.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG", pszSpec="*.gzip") returned 0 [0070.503] lstrlenA (lpString="*.gzip") returned 6 [0070.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG", pszSpec="*.jpg") returned 0 [0070.503] lstrlenA (lpString="*.jpg") returned 5 [0070.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG", pszSpec="*.jpeg") returned 0 [0070.503] lstrlenA (lpString="*.jpeg") returned 6 [0070.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG", pszSpec="*.psd") returned 0 [0070.503] lstrlenA (lpString="*.psd") returned 5 [0070.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG", pszSpec="*.cdr") returned 0 [0070.503] lstrlenA (lpString="*.cdr") returned 5 [0070.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG", pszSpec="*.dwg") returned 0 [0070.503] lstrlenA (lpString="*.dwg") returned 5 [0070.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG", pszSpec="*.max") returned 0 [0070.503] lstrlenA (lpString="*.max") returned 5 [0070.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG", pszSpec="*.bmp") returned 0 [0070.503] lstrlenA (lpString="*.bmp") returned 5 [0070.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG", pszSpec="*.gif") returned 0 [0070.503] lstrlenA (lpString="*.gif") returned 5 [0070.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG", pszSpec="*.png") returned 1 [0070.503] lstrlenA (lpString="*.png") returned 5 [0070.503] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" [0070.503] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" [0070.503] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG." [0070.503] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.BD" [0070.503] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400002.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.505] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15d49 [0070.505] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae5bbdc2, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.505] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.505] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x15ced, lpOverlapped=0x0) returned 1 [0070.507] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG") returned="J0400002.PNG" [0070.510] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.510] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x15ced, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x15ced, lpOverlapped=0x0) returned 1 [0070.510] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.510] CloseHandle (hObject=0x1cc) returned 1 [0070.513] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400002.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400002.png.bd")) returned 1 [0070.513] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae5c57bd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1e836, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0400003.PNG", cAlternateFileName="")) returned 1 [0070.513] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.513] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0400003.PNG") returned -1 [0070.513] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0400003.PNG") returned -1 [0070.513] lstrcmpiA (lpString1="", lpString2="J0400003.PNG") returned -1 [0070.513] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG") returned="J0400002.PNG" [0070.513] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.513] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.513] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.513] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.514] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0400003.PNG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" [0070.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG", pszSpec="*.zip") returned 0 [0070.514] lstrlenA (lpString="*.zip") returned 5 [0070.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG", pszSpec="*.rar") returned 0 [0070.514] lstrlenA (lpString="*.rar") returned 5 [0070.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG", pszSpec="*.7z") returned 0 [0070.514] lstrlenA (lpString="*.7z") returned 4 [0070.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG", pszSpec="*.tar") returned 0 [0070.514] lstrlenA (lpString="*.tar") returned 5 [0070.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG", pszSpec="*.gzip") returned 0 [0070.514] lstrlenA (lpString="*.gzip") returned 6 [0070.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG", pszSpec="*.jpg") returned 0 [0070.514] lstrlenA (lpString="*.jpg") returned 5 [0070.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG", pszSpec="*.jpeg") returned 0 [0070.514] lstrlenA (lpString="*.jpeg") returned 6 [0070.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG", pszSpec="*.psd") returned 0 [0070.514] lstrlenA (lpString="*.psd") returned 5 [0070.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG", pszSpec="*.cdr") returned 0 [0070.514] lstrlenA (lpString="*.cdr") returned 5 [0070.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG", pszSpec="*.dwg") returned 0 [0070.514] lstrlenA (lpString="*.dwg") returned 5 [0070.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG", pszSpec="*.max") returned 0 [0070.514] lstrlenA (lpString="*.max") returned 5 [0070.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG", pszSpec="*.bmp") returned 0 [0070.514] lstrlenA (lpString="*.bmp") returned 5 [0070.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG", pszSpec="*.gif") returned 0 [0070.514] lstrlenA (lpString="*.gif") returned 5 [0070.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG", pszSpec="*.png") returned 1 [0070.514] lstrlenA (lpString="*.png") returned 5 [0070.514] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" [0070.514] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" [0070.515] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG." [0070.515] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.BD" [0070.515] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400003.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.515] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e836 [0070.515] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae5c57bd, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.515] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.515] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1e7da, lpOverlapped=0x0) returned 1 [0070.519] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG") returned="J0400003.PNG" [0070.522] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.522] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1e7da, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1e7da, lpOverlapped=0x0) returned 1 [0070.523] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.523] CloseHandle (hObject=0x1cc) returned 1 [0070.527] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400003.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400003.png.bd")) returned 1 [0070.527] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3a021a9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x19a5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0400004.PNG", cAlternateFileName="")) returned 1 [0070.527] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.527] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0400004.PNG") returned -1 [0070.527] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0400004.PNG") returned -1 [0070.527] lstrcmpiA (lpString1="", lpString2="J0400004.PNG") returned -1 [0070.527] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG") returned="J0400003.PNG" [0070.527] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.527] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.527] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.528] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.528] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0400004.PNG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" [0070.528] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG", pszSpec="*.zip") returned 0 [0070.528] lstrlenA (lpString="*.zip") returned 5 [0070.528] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG", pszSpec="*.rar") returned 0 [0070.528] lstrlenA (lpString="*.rar") returned 5 [0070.528] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG", pszSpec="*.7z") returned 0 [0070.528] lstrlenA (lpString="*.7z") returned 4 [0070.528] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG", pszSpec="*.tar") returned 0 [0070.528] lstrlenA (lpString="*.tar") returned 5 [0070.528] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG", pszSpec="*.gzip") returned 0 [0070.528] lstrlenA (lpString="*.gzip") returned 6 [0070.528] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG", pszSpec="*.jpg") returned 0 [0070.528] lstrlenA (lpString="*.jpg") returned 5 [0070.528] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG", pszSpec="*.jpeg") returned 0 [0070.528] lstrlenA (lpString="*.jpeg") returned 6 [0070.528] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG", pszSpec="*.psd") returned 0 [0070.528] lstrlenA (lpString="*.psd") returned 5 [0070.528] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG", pszSpec="*.cdr") returned 0 [0070.528] lstrlenA (lpString="*.cdr") returned 5 [0070.528] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG", pszSpec="*.dwg") returned 0 [0070.528] lstrlenA (lpString="*.dwg") returned 5 [0070.528] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG", pszSpec="*.max") returned 0 [0070.528] lstrlenA (lpString="*.max") returned 5 [0070.528] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG", pszSpec="*.bmp") returned 0 [0070.528] lstrlenA (lpString="*.bmp") returned 5 [0070.528] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG", pszSpec="*.gif") returned 0 [0070.528] lstrlenA (lpString="*.gif") returned 5 [0070.528] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG", pszSpec="*.png") returned 1 [0070.529] lstrlenA (lpString="*.png") returned 5 [0070.529] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" [0070.529] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" [0070.529] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG." [0070.529] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.BD" [0070.529] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400004.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.529] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19a5d [0070.529] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc3a021a9, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.529] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.529] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x19a01, lpOverlapped=0x0) returned 1 [0070.531] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG") returned="J0400004.PNG" [0070.534] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.534] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x19a01, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x19a01, lpOverlapped=0x0) returned 1 [0070.535] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.535] CloseHandle (hObject=0x1cc) returned 1 [0070.538] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400004.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400004.png.bd")) returned 1 [0070.538] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae5cccc5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x17742, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0400005.PNG", cAlternateFileName="")) returned 1 [0070.538] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.538] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0400005.PNG") returned -1 [0070.539] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0400005.PNG") returned -1 [0070.539] lstrcmpiA (lpString1="", lpString2="J0400005.PNG") returned -1 [0070.539] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG") returned="J0400004.PNG" [0070.539] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.539] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.539] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.539] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.539] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="J0400005.PNG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" [0070.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG", pszSpec="*.zip") returned 0 [0070.539] lstrlenA (lpString="*.zip") returned 5 [0070.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG", pszSpec="*.rar") returned 0 [0070.539] lstrlenA (lpString="*.rar") returned 5 [0070.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG", pszSpec="*.7z") returned 0 [0070.539] lstrlenA (lpString="*.7z") returned 4 [0070.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG", pszSpec="*.tar") returned 0 [0070.539] lstrlenA (lpString="*.tar") returned 5 [0070.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG", pszSpec="*.gzip") returned 0 [0070.539] lstrlenA (lpString="*.gzip") returned 6 [0070.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG", pszSpec="*.jpg") returned 0 [0070.539] lstrlenA (lpString="*.jpg") returned 5 [0070.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG", pszSpec="*.jpeg") returned 0 [0070.539] lstrlenA (lpString="*.jpeg") returned 6 [0070.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG", pszSpec="*.psd") returned 0 [0070.539] lstrlenA (lpString="*.psd") returned 5 [0070.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG", pszSpec="*.cdr") returned 0 [0070.539] lstrlenA (lpString="*.cdr") returned 5 [0070.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG", pszSpec="*.dwg") returned 0 [0070.539] lstrlenA (lpString="*.dwg") returned 5 [0070.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG", pszSpec="*.max") returned 0 [0070.539] lstrlenA (lpString="*.max") returned 5 [0070.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG", pszSpec="*.bmp") returned 0 [0070.540] lstrlenA (lpString="*.bmp") returned 5 [0070.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG", pszSpec="*.gif") returned 0 [0070.540] lstrlenA (lpString="*.gif") returned 5 [0070.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG", pszSpec="*.png") returned 1 [0070.540] lstrlenA (lpString="*.png") returned 5 [0070.548] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" [0070.548] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" [0070.548] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG." [0070.548] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.BD" [0070.548] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400005.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.549] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17742 [0070.549] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xae5cccc5, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.549] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.549] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x176e6, lpOverlapped=0x0) returned 1 [0070.551] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG") returned="J0400005.PNG" [0070.554] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.554] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x176e6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x176e6, lpOverlapped=0x0) returned 1 [0070.554] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.555] CloseHandle (hObject=0x1cc) returned 1 [0070.558] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400005.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400005.png.bd")) returned 1 [0070.558] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae5d2ea0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2645, dwReserved0=0x0, dwReserved1=0x0, cFileName="JAVA_01.MID", cAlternateFileName="")) returned 1 [0070.558] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.558] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="JAVA_01.MID") returned -1 [0070.558] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="JAVA_01.MID") returned -1 [0070.559] lstrcmpiA (lpString1="", lpString2="JAVA_01.MID") returned -1 [0070.559] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG") returned="J0400005.PNG" [0070.559] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.559] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.559] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.559] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.559] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="JAVA_01.MID" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" [0070.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.zip") returned 0 [0070.559] lstrlenA (lpString="*.zip") returned 5 [0070.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.rar") returned 0 [0070.559] lstrlenA (lpString="*.rar") returned 5 [0070.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.7z") returned 0 [0070.559] lstrlenA (lpString="*.7z") returned 4 [0070.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.tar") returned 0 [0070.559] lstrlenA (lpString="*.tar") returned 5 [0070.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.gzip") returned 0 [0070.559] lstrlenA (lpString="*.gzip") returned 6 [0070.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.jpg") returned 0 [0070.559] lstrlenA (lpString="*.jpg") returned 5 [0070.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.jpeg") returned 0 [0070.559] lstrlenA (lpString="*.jpeg") returned 6 [0070.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.psd") returned 0 [0070.559] lstrlenA (lpString="*.psd") returned 5 [0070.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.cdr") returned 0 [0070.559] lstrlenA (lpString="*.cdr") returned 5 [0070.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.dwg") returned 0 [0070.559] lstrlenA (lpString="*.dwg") returned 5 [0070.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.max") returned 0 [0070.559] lstrlenA (lpString="*.max") returned 5 [0070.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.bmp") returned 0 [0070.560] lstrlenA (lpString="*.bmp") returned 5 [0070.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.gif") returned 0 [0070.560] lstrlenA (lpString="*.gif") returned 5 [0070.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.png") returned 0 [0070.560] lstrlenA (lpString="*.png") returned 5 [0070.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.doc") returned 0 [0070.560] lstrlenA (lpString="*.doc") returned 5 [0070.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.docx") returned 0 [0070.560] lstrlenA (lpString="*.docx") returned 6 [0070.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.xls") returned 0 [0070.560] lstrlenA (lpString="*.xls") returned 5 [0070.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.xlsx") returned 0 [0070.560] lstrlenA (lpString="*.xlsx") returned 6 [0070.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.ppt") returned 0 [0070.560] lstrlenA (lpString="*.ppt") returned 5 [0070.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.pptx") returned 0 [0070.560] lstrlenA (lpString="*.pptx") returned 6 [0070.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.txt") returned 0 [0070.560] lstrlenA (lpString="*.txt") returned 5 [0070.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.pdf") returned 0 [0070.560] lstrlenA (lpString="*.pdf") returned 5 [0070.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.djvu") returned 0 [0070.560] lstrlenA (lpString="*.djvu") returned 6 [0070.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.htm") returned 0 [0070.560] lstrlenA (lpString="*.htm") returned 5 [0070.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.html") returned 0 [0070.560] lstrlenA (lpString="*.html") returned 6 [0070.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.mdb") returned 0 [0070.560] lstrlenA (lpString="*.mdb") returned 5 [0070.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.cer") returned 0 [0070.560] lstrlenA (lpString="*.cer") returned 5 [0070.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.p12") returned 0 [0070.560] lstrlenA (lpString="*.p12") returned 5 [0070.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.pfx") returned 0 [0070.560] lstrlenA (lpString="*.pfx") returned 5 [0070.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.kwm") returned 0 [0070.561] lstrlenA (lpString="*.kwm") returned 5 [0070.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.pwm") returned 0 [0070.561] lstrlenA (lpString="*.pwm") returned 5 [0070.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.1cd") returned 0 [0070.561] lstrlenA (lpString="*.1cd") returned 5 [0070.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.md") returned 0 [0070.561] lstrlenA (lpString="*.md") returned 4 [0070.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.mdf") returned 0 [0070.561] lstrlenA (lpString="*.mdf") returned 5 [0070.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.dbf") returned 0 [0070.561] lstrlenA (lpString="*.dbf") returned 5 [0070.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.odt") returned 0 [0070.561] lstrlenA (lpString="*.odt") returned 5 [0070.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.vob") returned 0 [0070.561] lstrlenA (lpString="*.vob") returned 5 [0070.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.ifo") returned 0 [0070.561] lstrlenA (lpString="*.ifo") returned 5 [0070.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.lnk") returned 0 [0070.561] lstrlenA (lpString="*.lnk") returned 5 [0070.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.torrent") returned 0 [0070.561] lstrlenA (lpString="*.torrent") returned 9 [0070.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.mov") returned 0 [0070.561] lstrlenA (lpString="*.mov") returned 5 [0070.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.m2v") returned 0 [0070.561] lstrlenA (lpString="*.m2v") returned 5 [0070.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.3gp") returned 0 [0070.561] lstrlenA (lpString="*.3gp") returned 5 [0070.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.mpeg") returned 0 [0070.561] lstrlenA (lpString="*.mpeg") returned 6 [0070.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.mpg") returned 0 [0070.561] lstrlenA (lpString="*.mpg") returned 5 [0070.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.flv") returned 0 [0070.562] lstrlenA (lpString="*.flv") returned 5 [0070.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.avi") returned 0 [0070.562] lstrlenA (lpString="*.avi") returned 5 [0070.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.mp4") returned 0 [0070.562] lstrlenA (lpString="*.mp4") returned 5 [0070.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.wmv") returned 0 [0070.562] lstrlenA (lpString="*.wmv") returned 5 [0070.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.divx") returned 0 [0070.562] lstrlenA (lpString="*.divx") returned 6 [0070.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.mkv") returned 0 [0070.562] lstrlenA (lpString="*.mkv") returned 5 [0070.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.mp3") returned 0 [0070.562] lstrlenA (lpString="*.mp3") returned 5 [0070.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.wav") returned 0 [0070.562] lstrlenA (lpString="*.wav") returned 5 [0070.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.flac") returned 0 [0070.562] lstrlenA (lpString="*.flac") returned 6 [0070.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.ape") returned 0 [0070.562] lstrlenA (lpString="*.ape") returned 5 [0070.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.wma") returned 0 [0070.562] lstrlenA (lpString="*.wma") returned 5 [0070.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.ac3") returned 0 [0070.562] lstrlenA (lpString="*.ac3") returned 5 [0070.562] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3a13315, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNGLE_01.MID", cAlternateFileName="")) returned 1 [0070.562] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.562] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="JNGLE_01.MID") returned -1 [0070.562] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="JNGLE_01.MID") returned -1 [0070.562] lstrcmpiA (lpString1="", lpString2="JNGLE_01.MID") returned -1 [0070.562] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned="JAVA_01.MID" [0070.562] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.562] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.563] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.563] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.563] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="JNGLE_01.MID" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" [0070.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.zip") returned 0 [0070.563] lstrlenA (lpString="*.zip") returned 5 [0070.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.rar") returned 0 [0070.563] lstrlenA (lpString="*.rar") returned 5 [0070.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.7z") returned 0 [0070.563] lstrlenA (lpString="*.7z") returned 4 [0070.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.tar") returned 0 [0070.563] lstrlenA (lpString="*.tar") returned 5 [0070.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.gzip") returned 0 [0070.563] lstrlenA (lpString="*.gzip") returned 6 [0070.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.jpg") returned 0 [0070.563] lstrlenA (lpString="*.jpg") returned 5 [0070.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.jpeg") returned 0 [0070.563] lstrlenA (lpString="*.jpeg") returned 6 [0070.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.psd") returned 0 [0070.563] lstrlenA (lpString="*.psd") returned 5 [0070.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.cdr") returned 0 [0070.563] lstrlenA (lpString="*.cdr") returned 5 [0070.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.dwg") returned 0 [0070.563] lstrlenA (lpString="*.dwg") returned 5 [0070.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.max") returned 0 [0070.563] lstrlenA (lpString="*.max") returned 5 [0070.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.bmp") returned 0 [0070.563] lstrlenA (lpString="*.bmp") returned 5 [0070.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.gif") returned 0 [0070.563] lstrlenA (lpString="*.gif") returned 5 [0070.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.png") returned 0 [0070.564] lstrlenA (lpString="*.png") returned 5 [0070.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.doc") returned 0 [0070.564] lstrlenA (lpString="*.doc") returned 5 [0070.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.docx") returned 0 [0070.564] lstrlenA (lpString="*.docx") returned 6 [0070.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.xls") returned 0 [0070.564] lstrlenA (lpString="*.xls") returned 5 [0070.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.xlsx") returned 0 [0070.564] lstrlenA (lpString="*.xlsx") returned 6 [0070.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.ppt") returned 0 [0070.564] lstrlenA (lpString="*.ppt") returned 5 [0070.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.pptx") returned 0 [0070.564] lstrlenA (lpString="*.pptx") returned 6 [0070.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.txt") returned 0 [0070.564] lstrlenA (lpString="*.txt") returned 5 [0070.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.pdf") returned 0 [0070.564] lstrlenA (lpString="*.pdf") returned 5 [0070.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.djvu") returned 0 [0070.564] lstrlenA (lpString="*.djvu") returned 6 [0070.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.htm") returned 0 [0070.564] lstrlenA (lpString="*.htm") returned 5 [0070.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.html") returned 0 [0070.564] lstrlenA (lpString="*.html") returned 6 [0070.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.mdb") returned 0 [0070.564] lstrlenA (lpString="*.mdb") returned 5 [0070.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.cer") returned 0 [0070.564] lstrlenA (lpString="*.cer") returned 5 [0070.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.p12") returned 0 [0070.564] lstrlenA (lpString="*.p12") returned 5 [0070.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.pfx") returned 0 [0070.564] lstrlenA (lpString="*.pfx") returned 5 [0070.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.kwm") returned 0 [0070.564] lstrlenA (lpString="*.kwm") returned 5 [0070.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.pwm") returned 0 [0070.565] lstrlenA (lpString="*.pwm") returned 5 [0070.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.1cd") returned 0 [0070.565] lstrlenA (lpString="*.1cd") returned 5 [0070.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.md") returned 0 [0070.565] lstrlenA (lpString="*.md") returned 4 [0070.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.mdf") returned 0 [0070.565] lstrlenA (lpString="*.mdf") returned 5 [0070.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.dbf") returned 0 [0070.565] lstrlenA (lpString="*.dbf") returned 5 [0070.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.odt") returned 0 [0070.565] lstrlenA (lpString="*.odt") returned 5 [0070.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.vob") returned 0 [0070.565] lstrlenA (lpString="*.vob") returned 5 [0070.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.ifo") returned 0 [0070.565] lstrlenA (lpString="*.ifo") returned 5 [0070.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.lnk") returned 0 [0070.565] lstrlenA (lpString="*.lnk") returned 5 [0070.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.torrent") returned 0 [0070.565] lstrlenA (lpString="*.torrent") returned 9 [0070.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.mov") returned 0 [0070.565] lstrlenA (lpString="*.mov") returned 5 [0070.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.m2v") returned 0 [0070.565] lstrlenA (lpString="*.m2v") returned 5 [0070.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.3gp") returned 0 [0070.565] lstrlenA (lpString="*.3gp") returned 5 [0070.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.mpeg") returned 0 [0070.565] lstrlenA (lpString="*.mpeg") returned 6 [0070.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.mpg") returned 0 [0070.565] lstrlenA (lpString="*.mpg") returned 5 [0070.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.flv") returned 0 [0070.565] lstrlenA (lpString="*.flv") returned 5 [0070.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.avi") returned 0 [0070.565] lstrlenA (lpString="*.avi") returned 5 [0070.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.mp4") returned 0 [0070.565] lstrlenA (lpString="*.mp4") returned 5 [0070.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.wmv") returned 0 [0070.566] lstrlenA (lpString="*.wmv") returned 5 [0070.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.divx") returned 0 [0070.566] lstrlenA (lpString="*.divx") returned 6 [0070.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.mkv") returned 0 [0070.566] lstrlenA (lpString="*.mkv") returned 5 [0070.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.mp3") returned 0 [0070.566] lstrlenA (lpString="*.mp3") returned 5 [0070.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.wav") returned 0 [0070.566] lstrlenA (lpString="*.wav") returned 5 [0070.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.flac") returned 0 [0070.566] lstrlenA (lpString="*.flac") returned 6 [0070.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.ape") returned 0 [0070.566] lstrlenA (lpString="*.ape") returned 5 [0070.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.wma") returned 0 [0070.566] lstrlenA (lpString="*.wma") returned 5 [0070.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.ac3") returned 0 [0070.566] lstrlenA (lpString="*.ac3") returned 5 [0070.566] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb16de9b7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x15f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MP00021_.WMF", cAlternateFileName="")) returned 1 [0070.566] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.566] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MP00021_.WMF") returned -1 [0070.566] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MP00021_.WMF") returned -1 [0070.566] lstrcmpiA (lpString1="", lpString2="MP00021_.WMF") returned -1 [0070.566] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned="JNGLE_01.MID" [0070.566] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.566] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.566] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.566] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.566] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="MP00021_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" [0070.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.zip") returned 0 [0070.567] lstrlenA (lpString="*.zip") returned 5 [0070.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.rar") returned 0 [0070.567] lstrlenA (lpString="*.rar") returned 5 [0070.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.7z") returned 0 [0070.567] lstrlenA (lpString="*.7z") returned 4 [0070.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.tar") returned 0 [0070.567] lstrlenA (lpString="*.tar") returned 5 [0070.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.gzip") returned 0 [0070.567] lstrlenA (lpString="*.gzip") returned 6 [0070.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.jpg") returned 0 [0070.567] lstrlenA (lpString="*.jpg") returned 5 [0070.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.jpeg") returned 0 [0070.567] lstrlenA (lpString="*.jpeg") returned 6 [0070.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.psd") returned 0 [0070.567] lstrlenA (lpString="*.psd") returned 5 [0070.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.cdr") returned 0 [0070.567] lstrlenA (lpString="*.cdr") returned 5 [0070.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.dwg") returned 0 [0070.567] lstrlenA (lpString="*.dwg") returned 5 [0070.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.max") returned 0 [0070.567] lstrlenA (lpString="*.max") returned 5 [0070.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.bmp") returned 0 [0070.567] lstrlenA (lpString="*.bmp") returned 5 [0070.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.gif") returned 0 [0070.567] lstrlenA (lpString="*.gif") returned 5 [0070.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.png") returned 0 [0070.567] lstrlenA (lpString="*.png") returned 5 [0070.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.doc") returned 0 [0070.567] lstrlenA (lpString="*.doc") returned 5 [0070.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.docx") returned 0 [0070.567] lstrlenA (lpString="*.docx") returned 6 [0070.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.xls") returned 0 [0070.567] lstrlenA (lpString="*.xls") returned 5 [0070.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.xlsx") returned 0 [0070.568] lstrlenA (lpString="*.xlsx") returned 6 [0070.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.ppt") returned 0 [0070.568] lstrlenA (lpString="*.ppt") returned 5 [0070.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.pptx") returned 0 [0070.568] lstrlenA (lpString="*.pptx") returned 6 [0070.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.txt") returned 0 [0070.568] lstrlenA (lpString="*.txt") returned 5 [0070.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.pdf") returned 0 [0070.568] lstrlenA (lpString="*.pdf") returned 5 [0070.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.djvu") returned 0 [0070.568] lstrlenA (lpString="*.djvu") returned 6 [0070.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.htm") returned 0 [0070.568] lstrlenA (lpString="*.htm") returned 5 [0070.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.html") returned 0 [0070.568] lstrlenA (lpString="*.html") returned 6 [0070.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.mdb") returned 0 [0070.568] lstrlenA (lpString="*.mdb") returned 5 [0070.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.cer") returned 0 [0070.568] lstrlenA (lpString="*.cer") returned 5 [0070.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.p12") returned 0 [0070.568] lstrlenA (lpString="*.p12") returned 5 [0070.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.pfx") returned 0 [0070.568] lstrlenA (lpString="*.pfx") returned 5 [0070.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.kwm") returned 0 [0070.568] lstrlenA (lpString="*.kwm") returned 5 [0070.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.pwm") returned 0 [0070.568] lstrlenA (lpString="*.pwm") returned 5 [0070.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.1cd") returned 0 [0070.568] lstrlenA (lpString="*.1cd") returned 5 [0070.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.md") returned 0 [0070.568] lstrlenA (lpString="*.md") returned 4 [0070.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.mdf") returned 0 [0070.568] lstrlenA (lpString="*.mdf") returned 5 [0070.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.dbf") returned 0 [0070.569] lstrlenA (lpString="*.dbf") returned 5 [0070.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.odt") returned 0 [0070.569] lstrlenA (lpString="*.odt") returned 5 [0070.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.vob") returned 0 [0070.569] lstrlenA (lpString="*.vob") returned 5 [0070.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.ifo") returned 0 [0070.569] lstrlenA (lpString="*.ifo") returned 5 [0070.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.lnk") returned 0 [0070.569] lstrlenA (lpString="*.lnk") returned 5 [0070.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.torrent") returned 0 [0070.569] lstrlenA (lpString="*.torrent") returned 9 [0070.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.mov") returned 0 [0070.569] lstrlenA (lpString="*.mov") returned 5 [0070.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.m2v") returned 0 [0070.569] lstrlenA (lpString="*.m2v") returned 5 [0070.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.3gp") returned 0 [0070.569] lstrlenA (lpString="*.3gp") returned 5 [0070.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.mpeg") returned 0 [0070.569] lstrlenA (lpString="*.mpeg") returned 6 [0070.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.mpg") returned 0 [0070.569] lstrlenA (lpString="*.mpg") returned 5 [0070.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.flv") returned 0 [0070.569] lstrlenA (lpString="*.flv") returned 5 [0070.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.avi") returned 0 [0070.569] lstrlenA (lpString="*.avi") returned 5 [0070.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.mp4") returned 0 [0070.569] lstrlenA (lpString="*.mp4") returned 5 [0070.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.wmv") returned 0 [0070.569] lstrlenA (lpString="*.wmv") returned 5 [0070.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.divx") returned 0 [0070.569] lstrlenA (lpString="*.divx") returned 6 [0070.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.mkv") returned 0 [0070.569] lstrlenA (lpString="*.mkv") returned 5 [0070.570] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.mp3") returned 0 [0070.570] lstrlenA (lpString="*.mp3") returned 5 [0070.570] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.wav") returned 0 [0070.570] lstrlenA (lpString="*.wav") returned 5 [0070.570] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.flac") returned 0 [0070.570] lstrlenA (lpString="*.flac") returned 6 [0070.570] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.ape") returned 0 [0070.570] lstrlenA (lpString="*.ape") returned 5 [0070.570] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.wma") returned 0 [0070.570] lstrlenA (lpString="*.wma") returned 5 [0070.570] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.ac3") returned 0 [0070.570] lstrlenA (lpString="*.ac3") returned 5 [0070.570] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb16e383f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1090, dwReserved0=0x0, dwReserved1=0x0, cFileName="MP00132_.WMF", cAlternateFileName="")) returned 1 [0070.570] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.570] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MP00132_.WMF") returned -1 [0070.570] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MP00132_.WMF") returned -1 [0070.570] lstrcmpiA (lpString1="", lpString2="MP00132_.WMF") returned -1 [0070.570] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF") returned="MP00021_.WMF" [0070.570] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.570] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.570] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.570] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.570] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="MP00132_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" [0070.570] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.zip") returned 0 [0070.571] lstrlenA (lpString="*.zip") returned 5 [0070.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.rar") returned 0 [0070.571] lstrlenA (lpString="*.rar") returned 5 [0070.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.7z") returned 0 [0070.571] lstrlenA (lpString="*.7z") returned 4 [0070.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.tar") returned 0 [0070.571] lstrlenA (lpString="*.tar") returned 5 [0070.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.gzip") returned 0 [0070.571] lstrlenA (lpString="*.gzip") returned 6 [0070.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.jpg") returned 0 [0070.571] lstrlenA (lpString="*.jpg") returned 5 [0070.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.jpeg") returned 0 [0070.571] lstrlenA (lpString="*.jpeg") returned 6 [0070.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.psd") returned 0 [0070.571] lstrlenA (lpString="*.psd") returned 5 [0070.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.cdr") returned 0 [0070.571] lstrlenA (lpString="*.cdr") returned 5 [0070.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.dwg") returned 0 [0070.571] lstrlenA (lpString="*.dwg") returned 5 [0070.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.max") returned 0 [0070.571] lstrlenA (lpString="*.max") returned 5 [0070.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.bmp") returned 0 [0070.571] lstrlenA (lpString="*.bmp") returned 5 [0070.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.gif") returned 0 [0070.571] lstrlenA (lpString="*.gif") returned 5 [0070.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.png") returned 0 [0070.572] lstrlenA (lpString="*.png") returned 5 [0070.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.doc") returned 0 [0070.572] lstrlenA (lpString="*.doc") returned 5 [0070.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.docx") returned 0 [0070.572] lstrlenA (lpString="*.docx") returned 6 [0070.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.xls") returned 0 [0070.572] lstrlenA (lpString="*.xls") returned 5 [0070.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.xlsx") returned 0 [0070.572] lstrlenA (lpString="*.xlsx") returned 6 [0070.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.ppt") returned 0 [0070.572] lstrlenA (lpString="*.ppt") returned 5 [0070.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.pptx") returned 0 [0070.572] lstrlenA (lpString="*.pptx") returned 6 [0070.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.txt") returned 0 [0070.572] lstrlenA (lpString="*.txt") returned 5 [0070.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.pdf") returned 0 [0070.572] lstrlenA (lpString="*.pdf") returned 5 [0070.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.djvu") returned 0 [0070.572] lstrlenA (lpString="*.djvu") returned 6 [0070.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.htm") returned 0 [0070.572] lstrlenA (lpString="*.htm") returned 5 [0070.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.html") returned 0 [0070.572] lstrlenA (lpString="*.html") returned 6 [0070.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.mdb") returned 0 [0070.572] lstrlenA (lpString="*.mdb") returned 5 [0070.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.cer") returned 0 [0070.572] lstrlenA (lpString="*.cer") returned 5 [0070.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.p12") returned 0 [0070.572] lstrlenA (lpString="*.p12") returned 5 [0070.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.pfx") returned 0 [0070.572] lstrlenA (lpString="*.pfx") returned 5 [0070.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.kwm") returned 0 [0070.572] lstrlenA (lpString="*.kwm") returned 5 [0070.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.pwm") returned 0 [0070.573] lstrlenA (lpString="*.pwm") returned 5 [0070.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.1cd") returned 0 [0070.573] lstrlenA (lpString="*.1cd") returned 5 [0070.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.md") returned 0 [0070.573] lstrlenA (lpString="*.md") returned 4 [0070.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.mdf") returned 0 [0070.573] lstrlenA (lpString="*.mdf") returned 5 [0070.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.dbf") returned 0 [0070.573] lstrlenA (lpString="*.dbf") returned 5 [0070.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.odt") returned 0 [0070.573] lstrlenA (lpString="*.odt") returned 5 [0070.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.vob") returned 0 [0070.573] lstrlenA (lpString="*.vob") returned 5 [0070.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.ifo") returned 0 [0070.573] lstrlenA (lpString="*.ifo") returned 5 [0070.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.lnk") returned 0 [0070.573] lstrlenA (lpString="*.lnk") returned 5 [0070.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.torrent") returned 0 [0070.573] lstrlenA (lpString="*.torrent") returned 9 [0070.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.mov") returned 0 [0070.573] lstrlenA (lpString="*.mov") returned 5 [0070.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.m2v") returned 0 [0070.573] lstrlenA (lpString="*.m2v") returned 5 [0070.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.3gp") returned 0 [0070.573] lstrlenA (lpString="*.3gp") returned 5 [0070.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.mpeg") returned 0 [0070.573] lstrlenA (lpString="*.mpeg") returned 6 [0070.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.mpg") returned 0 [0070.573] lstrlenA (lpString="*.mpg") returned 5 [0070.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.flv") returned 0 [0070.573] lstrlenA (lpString="*.flv") returned 5 [0070.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.avi") returned 0 [0070.574] lstrlenA (lpString="*.avi") returned 5 [0070.574] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.mp4") returned 0 [0070.574] lstrlenA (lpString="*.mp4") returned 5 [0070.574] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.wmv") returned 0 [0070.574] lstrlenA (lpString="*.wmv") returned 5 [0070.574] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.divx") returned 0 [0070.574] lstrlenA (lpString="*.divx") returned 6 [0070.574] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.mkv") returned 0 [0070.574] lstrlenA (lpString="*.mkv") returned 5 [0070.574] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.mp3") returned 0 [0070.574] lstrlenA (lpString="*.mp3") returned 5 [0070.574] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.wav") returned 0 [0070.574] lstrlenA (lpString="*.wav") returned 5 [0070.574] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.flac") returned 0 [0070.574] lstrlenA (lpString="*.flac") returned 6 [0070.574] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.ape") returned 0 [0070.574] lstrlenA (lpString="*.ape") returned 5 [0070.574] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.wma") returned 0 [0070.574] lstrlenA (lpString="*.wma") returned 5 [0070.574] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.ac3") returned 0 [0070.574] lstrlenA (lpString="*.ac3") returned 5 [0070.574] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb16e9993, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x31e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="MP00646_.WMF", cAlternateFileName="")) returned 1 [0070.574] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.574] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MP00646_.WMF") returned -1 [0070.574] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MP00646_.WMF") returned -1 [0070.574] lstrcmpiA (lpString1="", lpString2="MP00646_.WMF") returned -1 [0070.574] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF") returned="MP00132_.WMF" [0070.574] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.574] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.574] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.574] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.575] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="MP00646_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" [0070.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF", pszSpec="*.zip") returned 0 [0070.575] lstrlenA (lpString="*.zip") returned 5 [0070.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF", pszSpec="*.rar") returned 0 [0070.575] lstrlenA (lpString="*.rar") returned 5 [0070.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF", pszSpec="*.7z") returned 0 [0070.575] lstrlenA (lpString="*.7z") returned 4 [0070.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF", pszSpec="*.tar") returned 0 [0070.575] lstrlenA (lpString="*.tar") returned 5 [0070.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF", pszSpec="*.gzip") returned 0 [0070.575] lstrlenA (lpString="*.gzip") returned 6 [0070.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF", pszSpec="*.jpg") returned 0 [0070.575] lstrlenA (lpString="*.jpg") returned 5 [0070.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF", pszSpec="*.jpeg") returned 0 [0070.575] lstrlenA (lpString="*.jpeg") returned 6 [0070.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF", pszSpec="*.psd") returned 0 [0070.575] lstrlenA (lpString="*.psd") returned 5 [0070.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF", pszSpec="*.cdr") returned 0 [0070.575] lstrlenA (lpString="*.cdr") returned 5 [0070.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF", pszSpec="*.dwg") returned 0 [0070.575] lstrlenA (lpString="*.dwg") returned 5 [0070.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF", pszSpec="*.max") returned 0 [0070.575] lstrlenA (lpString="*.max") returned 5 [0070.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF", pszSpec="*.bmp") returned 0 [0070.575] lstrlenA (lpString="*.bmp") returned 5 [0070.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF", pszSpec="*.gif") returned 0 [0070.575] lstrlenA (lpString="*.gif") returned 5 [0070.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF", pszSpec="*.png") returned 0 [0070.575] lstrlenA (lpString="*.png") returned 5 [0070.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF", pszSpec="*.doc") returned 0 [0070.575] lstrlenA (lpString="*.doc") returned 5 [0070.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF", pszSpec="*.docx") returned 0 [0070.575] lstrlenA (lpString="*.docx") returned 6 [0070.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF", pszSpec="*.xls") returned 0 [0070.576] lstrlenA (lpString="*.xls") returned 5 [0070.576] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF", pszSpec="*.xlsx") returned 0 [0070.576] lstrlenA (lpString="*.xlsx") returned 6 [0070.576] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF", pszSpec="*.ppt") returned 0 [0070.576] lstrlenA (lpString="*.ppt") returned 5 [0070.576] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF", pszSpec="*.pptx") returned 0 [0070.576] lstrlenA (lpString="*.pptx") returned 6 [0070.576] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF", pszSpec="*.txt") returned 0 [0070.576] lstrlenA (lpString="*.txt") returned 5 [0070.576] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb52aa0eb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1ae0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUSIC_01.MID", cAlternateFileName="")) returned 1 [0070.576] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.576] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MUSIC_01.MID") returned -1 [0070.576] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MUSIC_01.MID") returned -1 [0070.576] lstrcmpiA (lpString1="", lpString2="MUSIC_01.MID") returned -1 [0070.576] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF") returned="MP00646_.WMF" [0070.576] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.576] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.576] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.576] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.576] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="MUSIC_01.MID" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" [0070.577] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc92bc247, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5044, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00042_.WMF", cAlternateFileName="")) returned 1 [0070.577] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.577] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00042_.WMF") returned -1 [0070.577] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00042_.WMF") returned -1 [0070.577] lstrcmpiA (lpString1="", lpString2="NA00042_.WMF") returned -1 [0070.577] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned="MUSIC_01.MID" [0070.577] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.577] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.577] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.577] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.577] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00042_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" [0070.577] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb52f82f7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2a42, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00057_.WMF", cAlternateFileName="")) returned 1 [0070.577] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.577] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00057_.WMF") returned -1 [0070.577] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00057_.WMF") returned -1 [0070.577] lstrcmpiA (lpString1="", lpString2="NA00057_.WMF") returned -1 [0070.577] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF") returned="NA00042_.WMF" [0070.577] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.577] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.577] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.577] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.577] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00057_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" [0070.577] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc92c0fec, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xeaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00058_.WMF", cAlternateFileName="")) returned 1 [0070.577] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.578] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00058_.WMF") returned -1 [0070.578] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00058_.WMF") returned -1 [0070.578] lstrcmpiA (lpString1="", lpString2="NA00058_.WMF") returned -1 [0070.578] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF") returned="NA00057_.WMF" [0070.578] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.578] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.578] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.578] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.578] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00058_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" [0070.578] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb52fbd6d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1324, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00068_.WMF", cAlternateFileName="")) returned 1 [0070.578] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.578] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00068_.WMF") returned -1 [0070.578] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00068_.WMF") returned -1 [0070.578] lstrcmpiA (lpString1="", lpString2="NA00068_.WMF") returned -1 [0070.578] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF") returned="NA00058_.WMF" [0070.578] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.578] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.578] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.578] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.578] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00068_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" [0070.578] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5304622, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00238_.WMF", cAlternateFileName="")) returned 1 [0070.578] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.578] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00238_.WMF") returned -1 [0070.578] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00238_.WMF") returned -1 [0070.578] lstrcmpiA (lpString1="", lpString2="NA00238_.WMF") returned -1 [0070.578] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF") returned="NA00068_.WMF" [0070.578] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.579] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.579] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.579] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.579] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00238_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" [0070.579] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc92c5e2a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x864, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00330_.WMF", cAlternateFileName="")) returned 1 [0070.579] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.579] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00330_.WMF") returned -1 [0070.579] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00330_.WMF") returned -1 [0070.579] lstrcmpiA (lpString1="", lpString2="NA00330_.WMF") returned -1 [0070.579] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF") returned="NA00238_.WMF" [0070.579] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.579] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.579] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.579] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.579] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00330_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" [0070.579] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb530944a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1172, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00388_.WMF", cAlternateFileName="")) returned 1 [0070.579] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.579] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00388_.WMF") returned -1 [0070.579] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00388_.WMF") returned -1 [0070.579] lstrcmpiA (lpString1="", lpString2="NA00388_.WMF") returned -1 [0070.579] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF") returned="NA00330_.WMF" [0070.579] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.579] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.579] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.579] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.580] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00388_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" [0070.580] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc92cac7f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x20ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00389_.WMF", cAlternateFileName="")) returned 1 [0070.580] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.580] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00389_.WMF") returned -1 [0070.580] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00389_.WMF") returned -1 [0070.580] lstrcmpiA (lpString1="", lpString2="NA00389_.WMF") returned -1 [0070.580] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF") returned="NA00388_.WMF" [0070.580] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.580] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.580] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.580] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.580] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00389_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" [0070.580] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc92cfb2c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x21c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00390_.WMF", cAlternateFileName="")) returned 1 [0070.580] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.580] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00390_.WMF") returned -1 [0070.580] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00390_.WMF") returned -1 [0070.580] lstrcmpiA (lpString1="", lpString2="NA00390_.WMF") returned -1 [0070.580] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF") returned="NA00389_.WMF" [0070.580] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.580] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.580] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.580] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.580] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00390_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" [0070.580] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc92d6fa4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x21ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00391_.WMF", cAlternateFileName="")) returned 1 [0070.581] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.581] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00391_.WMF") returned -1 [0070.581] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00391_.WMF") returned -1 [0070.581] lstrcmpiA (lpString1="", lpString2="NA00391_.WMF") returned -1 [0070.581] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF") returned="NA00390_.WMF" [0070.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.581] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.581] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.581] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.581] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00391_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" [0070.581] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb530e30f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2ad4, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00394_.WMF", cAlternateFileName="")) returned 1 [0070.581] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.581] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00394_.WMF") returned -1 [0070.581] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00394_.WMF") returned -1 [0070.581] lstrcmpiA (lpString1="", lpString2="NA00394_.WMF") returned -1 [0070.581] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF") returned="NA00391_.WMF" [0070.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.581] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.581] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.581] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.581] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00394_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" [0070.581] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5313076, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x194a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00395_.WMF", cAlternateFileName="")) returned 1 [0070.581] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.581] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00395_.WMF") returned -1 [0070.582] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00395_.WMF") returned -1 [0070.582] lstrcmpiA (lpString1="", lpString2="NA00395_.WMF") returned -1 [0070.582] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF") returned="NA00394_.WMF" [0070.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.582] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.582] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.582] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.582] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00395_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" [0070.582] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb535bea8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x38c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00396_.WMF", cAlternateFileName="")) returned 1 [0070.582] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.582] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00396_.WMF") returned -1 [0070.582] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00396_.WMF") returned -1 [0070.582] lstrcmpiA (lpString1="", lpString2="NA00396_.WMF") returned -1 [0070.582] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF") returned="NA00395_.WMF" [0070.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.582] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.582] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.582] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.582] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00396_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" [0070.582] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5362008, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x173e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00417_.WMF", cAlternateFileName="")) returned 1 [0070.582] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.582] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00417_.WMF") returned -1 [0070.582] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00417_.WMF") returned -1 [0070.582] lstrcmpiA (lpString1="", lpString2="NA00417_.WMF") returned -1 [0070.582] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF") returned="NA00396_.WMF" [0070.583] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.583] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.583] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.583] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.583] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00417_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" [0070.583] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53681ac, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4696, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00433_.WMF", cAlternateFileName="")) returned 1 [0070.583] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.583] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00433_.WMF") returned -1 [0070.583] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00433_.WMF") returned -1 [0070.583] lstrcmpiA (lpString1="", lpString2="NA00433_.WMF") returned -1 [0070.583] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF") returned="NA00417_.WMF" [0070.583] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.583] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.583] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.583] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.583] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00433_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" [0070.583] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb536e3a0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2f38, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00438_.WMF", cAlternateFileName="")) returned 1 [0070.583] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.583] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00438_.WMF") returned -1 [0070.583] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00438_.WMF") returned -1 [0070.583] lstrcmpiA (lpString1="", lpString2="NA00438_.WMF") returned -1 [0070.583] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF") returned="NA00433_.WMF" [0070.583] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.583] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.583] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.583] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.584] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00438_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" [0070.584] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53731e1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x14bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00452_.WMF", cAlternateFileName="")) returned 1 [0070.584] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.584] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00452_.WMF") returned -1 [0070.584] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00452_.WMF") returned -1 [0070.584] lstrcmpiA (lpString1="", lpString2="NA00452_.WMF") returned -1 [0070.584] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF") returned="NA00438_.WMF" [0070.584] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.584] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.584] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.584] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.584] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00452_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" [0070.584] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc92dbdbe, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1580, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00454_.WMF", cAlternateFileName="")) returned 1 [0070.584] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.584] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00454_.WMF") returned -1 [0070.584] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00454_.WMF") returned -1 [0070.584] lstrcmpiA (lpString1="", lpString2="NA00454_.WMF") returned -1 [0070.584] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF") returned="NA00452_.WMF" [0070.584] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.584] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.584] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.584] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.584] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00454_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" [0070.585] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc92e0bbd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00458_.WMF", cAlternateFileName="")) returned 1 [0070.585] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.585] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00458_.WMF") returned -1 [0070.585] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00458_.WMF") returned -1 [0070.585] lstrcmpiA (lpString1="", lpString2="NA00458_.WMF") returned -1 [0070.585] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF") returned="NA00454_.WMF" [0070.585] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.585] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.585] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.585] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.585] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00458_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" [0070.585] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc92e5994, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4f6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00462_.WMF", cAlternateFileName="")) returned 1 [0070.585] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.585] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00462_.WMF") returned -1 [0070.585] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00462_.WMF") returned -1 [0070.585] lstrcmpiA (lpString1="", lpString2="NA00462_.WMF") returned -1 [0070.585] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF") returned="NA00458_.WMF" [0070.585] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.585] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.585] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.585] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.585] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00462_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" [0070.585] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5377fe9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xc10, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00487_.WMF", cAlternateFileName="")) returned 1 [0070.585] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.586] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00487_.WMF") returned -1 [0070.586] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00487_.WMF") returned -1 [0070.586] lstrcmpiA (lpString1="", lpString2="NA00487_.WMF") returned -1 [0070.586] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF") returned="NA00462_.WMF" [0070.586] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.586] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.586] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.586] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.586] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00487_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" [0070.586] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb537ce86, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00494_.WMF", cAlternateFileName="")) returned 1 [0070.586] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.586] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00494_.WMF") returned -1 [0070.586] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00494_.WMF") returned -1 [0070.586] lstrcmpiA (lpString1="", lpString2="NA00494_.WMF") returned -1 [0070.586] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF") returned="NA00487_.WMF" [0070.586] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.586] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.586] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.586] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.586] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00494_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" [0070.586] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5382f9b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00512_.WMF", cAlternateFileName="")) returned 1 [0070.586] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.586] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00512_.WMF") returned -1 [0070.586] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00512_.WMF") returned -1 [0070.586] lstrcmpiA (lpString1="", lpString2="NA00512_.WMF") returned -1 [0070.586] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF") returned="NA00494_.WMF" [0070.586] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.587] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.588] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.588] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.588] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00512_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" [0070.588] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc92ebb75, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6efa, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00523_.WMF", cAlternateFileName="")) returned 1 [0070.588] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.588] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00523_.WMF") returned -1 [0070.588] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00523_.WMF") returned -1 [0070.588] lstrcmpiA (lpString1="", lpString2="NA00523_.WMF") returned -1 [0070.588] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF") returned="NA00512_.WMF" [0070.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.588] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.588] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.588] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.588] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00523_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" [0070.588] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc92f09d3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5880, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00525_.WMF", cAlternateFileName="")) returned 1 [0070.588] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.588] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00525_.WMF") returned -1 [0070.589] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00525_.WMF") returned -1 [0070.589] lstrcmpiA (lpString1="", lpString2="NA00525_.WMF") returned -1 [0070.589] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF") returned="NA00523_.WMF" [0070.589] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.589] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.589] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.589] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.589] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00525_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" [0070.589] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5387dae, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x477c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00530_.WMF", cAlternateFileName="")) returned 1 [0070.589] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.589] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00530_.WMF") returned -1 [0070.589] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00530_.WMF") returned -1 [0070.589] lstrcmpiA (lpString1="", lpString2="NA00530_.WMF") returned -1 [0070.589] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF") returned="NA00525_.WMF" [0070.589] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.589] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.589] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.589] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.589] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00530_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" [0070.589] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc92f57e9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x530, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00532_.WMF", cAlternateFileName="")) returned 1 [0070.589] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.589] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00532_.WMF") returned -1 [0070.589] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00532_.WMF") returned -1 [0070.589] lstrcmpiA (lpString1="", lpString2="NA00532_.WMF") returned -1 [0070.589] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF") returned="NA00530_.WMF" [0070.589] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.589] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.590] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.590] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.590] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00532_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" [0070.590] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb538f2b6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7d14, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00538_.WMF", cAlternateFileName="")) returned 1 [0070.590] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.590] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00538_.WMF") returned -1 [0070.590] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00538_.WMF") returned -1 [0070.590] lstrcmpiA (lpString1="", lpString2="NA00538_.WMF") returned -1 [0070.590] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF") returned="NA00532_.WMF" [0070.590] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.590] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.590] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.590] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.590] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00538_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" [0070.590] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc92fb9c6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00641_.WMF", cAlternateFileName="")) returned 1 [0070.590] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.590] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00641_.WMF") returned -1 [0070.590] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00641_.WMF") returned -1 [0070.590] lstrcmpiA (lpString1="", lpString2="NA00641_.WMF") returned -1 [0070.590] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF") returned="NA00538_.WMF" [0070.590] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.590] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.590] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.590] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.590] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00641_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" [0070.591] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9300797, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7658, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00784_.WMF", cAlternateFileName="")) returned 1 [0070.591] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.591] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00784_.WMF") returned -1 [0070.591] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00784_.WMF") returned -1 [0070.591] lstrcmpiA (lpString1="", lpString2="NA00784_.WMF") returned -1 [0070.591] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF") returned="NA00641_.WMF" [0070.591] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.591] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.591] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.591] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.591] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00784_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" [0070.591] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5395471, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x23f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00798_.WMF", cAlternateFileName="")) returned 1 [0070.591] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.591] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00798_.WMF") returned -1 [0070.591] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00798_.WMF") returned -1 [0070.591] lstrcmpiA (lpString1="", lpString2="NA00798_.WMF") returned -1 [0070.591] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF") returned="NA00784_.WMF" [0070.591] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.591] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.591] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.591] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.591] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00798_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" [0070.591] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc93055a9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x788, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00806_.WMF", cAlternateFileName="")) returned 1 [0070.591] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.591] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00806_.WMF") returned -1 [0070.591] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00806_.WMF") returned -1 [0070.592] lstrcmpiA (lpString1="", lpString2="NA00806_.WMF") returned -1 [0070.592] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF") returned="NA00798_.WMF" [0070.592] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.592] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.592] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.592] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.592] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00806_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" [0070.592] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc930a3ed, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xba4, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00807_.WMF", cAlternateFileName="")) returned 1 [0070.592] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.592] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00807_.WMF") returned -1 [0070.592] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00807_.WMF") returned -1 [0070.592] lstrcmpiA (lpString1="", lpString2="NA00807_.WMF") returned -1 [0070.592] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF") returned="NA00806_.WMF" [0070.592] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.592] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.592] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.592] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.592] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00807_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" [0070.592] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc93105c2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00808_.WMF", cAlternateFileName="")) returned 1 [0070.592] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.592] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00808_.WMF") returned -1 [0070.592] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00808_.WMF") returned -1 [0070.592] lstrcmpiA (lpString1="", lpString2="NA00808_.WMF") returned -1 [0070.592] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF") returned="NA00807_.WMF" [0070.592] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.593] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.593] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.593] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.593] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00808_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" [0070.593] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb539a290, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00809_.WMF", cAlternateFileName="")) returned 1 [0070.593] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.593] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00809_.WMF") returned -1 [0070.593] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00809_.WMF") returned -1 [0070.593] lstrcmpiA (lpString1="", lpString2="NA00809_.WMF") returned -1 [0070.593] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF") returned="NA00808_.WMF" [0070.593] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.593] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.593] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.593] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.593] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00809_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" [0070.593] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53a04b1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00810_.WMF", cAlternateFileName="")) returned 1 [0070.593] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.593] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00810_.WMF") returned -1 [0070.593] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00810_.WMF") returned -1 [0070.593] lstrcmpiA (lpString1="", lpString2="NA00810_.WMF") returned -1 [0070.593] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF") returned="NA00809_.WMF" [0070.593] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.593] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.593] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.593] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.593] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00810_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" [0070.594] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc93153de, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3210, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00932_.WMF", cAlternateFileName="")) returned 1 [0070.594] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.594] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA00932_.WMF") returned -1 [0070.594] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA00932_.WMF") returned -1 [0070.594] lstrcmpiA (lpString1="", lpString2="NA00932_.WMF") returned -1 [0070.594] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF") returned="NA00810_.WMF" [0070.594] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.594] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.594] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.594] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.594] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA00932_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" [0070.594] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53a6615, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7c46, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01064_.WMF", cAlternateFileName="")) returned 1 [0070.594] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.594] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01064_.WMF") returned -1 [0070.594] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01064_.WMF") returned -1 [0070.594] lstrcmpiA (lpString1="", lpString2="NA01064_.WMF") returned -1 [0070.594] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF") returned="NA00932_.WMF" [0070.594] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.594] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.594] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.594] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.594] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01064_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" [0070.594] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53b295d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x54a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01066_.WMF", cAlternateFileName="")) returned 1 [0070.594] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.594] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01066_.WMF") returned -1 [0070.594] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01066_.WMF") returned -1 [0070.595] lstrcmpiA (lpString1="", lpString2="NA01066_.WMF") returned -1 [0070.595] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF") returned="NA01064_.WMF" [0070.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.595] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.595] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.595] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.595] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01066_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" [0070.595] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53b77af, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1a7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01069_.WMF", cAlternateFileName="")) returned 1 [0070.595] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.595] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01069_.WMF") returned -1 [0070.595] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01069_.WMF") returned -1 [0070.595] lstrcmpiA (lpString1="", lpString2="NA01069_.WMF") returned -1 [0070.595] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF") returned="NA01066_.WMF" [0070.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.595] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.595] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.595] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.595] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01069_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" [0070.595] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc931a1d4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01123_.WMF", cAlternateFileName="")) returned 1 [0070.595] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.595] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01123_.WMF") returned -1 [0070.595] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01123_.WMF") returned -1 [0070.595] lstrcmpiA (lpString1="", lpString2="NA01123_.WMF") returned -1 [0070.595] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF") returned="NA01069_.WMF" [0070.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.595] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.595] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.596] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.596] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01123_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" [0070.596] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53bb1b0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01126_.WMF", cAlternateFileName="")) returned 1 [0070.596] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.596] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01126_.WMF") returned -1 [0070.596] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01126_.WMF") returned -1 [0070.596] lstrcmpiA (lpString1="", lpString2="NA01126_.WMF") returned -1 [0070.596] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF") returned="NA01123_.WMF" [0070.596] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.596] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.596] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.596] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.596] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01126_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" [0070.596] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53bffa6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01130_.WMF", cAlternateFileName="")) returned 1 [0070.596] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.596] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01130_.WMF") returned -1 [0070.596] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01130_.WMF") returned -1 [0070.596] lstrcmpiA (lpString1="", lpString2="NA01130_.WMF") returned -1 [0070.596] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF") returned="NA01126_.WMF" [0070.596] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.596] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.596] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.596] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.596] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01130_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" [0070.597] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53c75b4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01141_.WMF", cAlternateFileName="")) returned 1 [0070.597] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.597] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01141_.WMF") returned -1 [0070.597] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01141_.WMF") returned -1 [0070.597] lstrcmpiA (lpString1="", lpString2="NA01141_.WMF") returned -1 [0070.597] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF") returned="NA01130_.WMF" [0070.597] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.597] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.597] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.597] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.597] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01141_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" [0070.597] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc931f05a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1f38, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01148_.WMF", cAlternateFileName="")) returned 1 [0070.597] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.597] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01148_.WMF") returned -1 [0070.597] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01148_.WMF") returned -1 [0070.597] lstrcmpiA (lpString1="", lpString2="NA01148_.WMF") returned -1 [0070.597] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF") returned="NA01141_.WMF" [0070.597] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.597] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.597] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.597] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.597] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01148_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" [0070.597] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a034fa, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1248, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01149_.WMF", cAlternateFileName="")) returned 1 [0070.597] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.598] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01149_.WMF") returned -1 [0070.598] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01149_.WMF") returned -1 [0070.598] lstrcmpiA (lpString1="", lpString2="NA01149_.WMF") returned -1 [0070.598] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF") returned="NA01148_.WMF" [0070.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.598] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.598] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.598] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.598] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01149_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" [0070.598] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53cc37a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2230, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01152_.WMF", cAlternateFileName="")) returned 1 [0070.598] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.598] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01152_.WMF") returned -1 [0070.598] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01152_.WMF") returned -1 [0070.598] lstrcmpiA (lpString1="", lpString2="NA01152_.WMF") returned -1 [0070.598] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF") returned="NA01149_.WMF" [0070.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.598] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.598] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.598] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.598] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01152_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" [0070.598] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a034fa, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x15b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01154_.WMF", cAlternateFileName="")) returned 1 [0070.598] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.598] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01154_.WMF") returned -1 [0070.598] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01154_.WMF") returned -1 [0070.598] lstrcmpiA (lpString1="", lpString2="NA01154_.WMF") returned -1 [0070.598] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF") returned="NA01152_.WMF" [0070.599] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.599] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.599] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.599] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.599] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01154_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" [0070.599] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a034fa, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1858, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01157_.WMF", cAlternateFileName="")) returned 1 [0070.599] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.599] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01157_.WMF") returned -1 [0070.599] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01157_.WMF") returned -1 [0070.599] lstrcmpiA (lpString1="", lpString2="NA01157_.WMF") returned -1 [0070.599] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF") returned="NA01154_.WMF" [0070.599] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.599] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.599] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.599] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.599] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01157_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" [0070.599] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53d11dc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1c74, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01158_.WMF", cAlternateFileName="")) returned 1 [0070.599] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.599] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01158_.WMF") returned -1 [0070.599] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01158_.WMF") returned -1 [0070.599] lstrcmpiA (lpString1="", lpString2="NA01158_.WMF") returned -1 [0070.599] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF") returned="NA01157_.WMF" [0070.599] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.599] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.599] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.600] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.600] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01158_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" [0070.600] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a297de, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1694, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01161_.WMF", cAlternateFileName="")) returned 1 [0070.600] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.600] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01161_.WMF") returned -1 [0070.600] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01161_.WMF") returned -1 [0070.600] lstrcmpiA (lpString1="", lpString2="NA01161_.WMF") returned -1 [0070.600] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF") returned="NA01158_.WMF" [0070.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.600] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.600] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.600] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.600] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01161_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" [0070.600] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a297de, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa04, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01164_.WMF", cAlternateFileName="")) returned 1 [0070.600] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.600] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01164_.WMF") returned -1 [0070.600] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01164_.WMF") returned -1 [0070.600] lstrcmpiA (lpString1="", lpString2="NA01164_.WMF") returned -1 [0070.600] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF") returned="NA01161_.WMF" [0070.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.600] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.600] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.600] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.600] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01164_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" [0070.601] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a297de, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x70f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01293_.WMF", cAlternateFileName="")) returned 1 [0070.601] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.601] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01293_.WMF") returned -1 [0070.601] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01293_.WMF") returned -1 [0070.601] lstrcmpiA (lpString1="", lpString2="NA01293_.WMF") returned -1 [0070.601] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF") returned="NA01164_.WMF" [0070.601] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.601] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.601] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.601] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.601] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01293_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" [0070.601] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a297de, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01354_.WMF", cAlternateFileName="")) returned 1 [0070.601] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.601] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01354_.WMF") returned -1 [0070.601] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01354_.WMF") returned -1 [0070.601] lstrcmpiA (lpString1="", lpString2="NA01354_.WMF") returned -1 [0070.601] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF") returned="NA01293_.WMF" [0070.601] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.601] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.601] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.601] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.601] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01354_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" [0070.602] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53d731a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4732, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01356_.WMF", cAlternateFileName="")) returned 1 [0070.602] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.602] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01356_.WMF") returned -1 [0070.602] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01356_.WMF") returned -1 [0070.602] lstrcmpiA (lpString1="", lpString2="NA01356_.WMF") returned -1 [0070.602] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF") returned="NA01354_.WMF" [0070.602] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.602] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.602] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.602] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.602] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01356_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" [0070.602] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53dc184, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6bf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01357_.WMF", cAlternateFileName="")) returned 1 [0070.602] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.602] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01357_.WMF") returned -1 [0070.602] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01357_.WMF") returned -1 [0070.602] lstrcmpiA (lpString1="", lpString2="NA01357_.WMF") returned -1 [0070.602] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF") returned="NA01356_.WMF" [0070.602] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.613] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.613] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.613] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.613] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01357_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" [0070.614] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53e230b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01358_.WMF", cAlternateFileName="")) returned 1 [0070.614] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.614] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01358_.WMF") returned -1 [0070.614] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01358_.WMF") returned -1 [0070.614] lstrcmpiA (lpString1="", lpString2="NA01358_.WMF") returned -1 [0070.614] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF") returned="NA01357_.WMF" [0070.614] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.614] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.614] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.614] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.614] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01358_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" [0070.614] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53e71d1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1b74, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01361_.WMF", cAlternateFileName="")) returned 1 [0070.615] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.615] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01361_.WMF") returned -1 [0070.615] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01361_.WMF") returned -1 [0070.615] lstrcmpiA (lpString1="", lpString2="NA01361_.WMF") returned -1 [0070.615] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF") returned="NA01358_.WMF" [0070.615] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.616] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.616] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.616] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.616] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01361_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" [0070.616] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53f20da, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x40412, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01368_.WMF", cAlternateFileName="")) returned 1 [0070.616] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.616] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01368_.WMF") returned -1 [0070.616] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01368_.WMF") returned -1 [0070.616] lstrcmpiA (lpString1="", lpString2="NA01368_.WMF") returned -1 [0070.616] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF") returned="NA01361_.WMF" [0070.616] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.616] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.616] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.616] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.616] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01368_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" [0070.616] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53fbcf8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2b16e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01421_.WMF", cAlternateFileName="")) returned 1 [0070.616] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.616] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01421_.WMF") returned -1 [0070.616] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01421_.WMF") returned -1 [0070.616] lstrcmpiA (lpString1="", lpString2="NA01421_.WMF") returned -1 [0070.616] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF") returned="NA01368_.WMF" [0070.616] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.616] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.616] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.617] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.617] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01421_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" [0070.617] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a297de, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4e82, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01468_.WMF", cAlternateFileName="")) returned 1 [0070.617] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.617] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01468_.WMF") returned -1 [0070.617] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01468_.WMF") returned -1 [0070.617] lstrcmpiA (lpString1="", lpString2="NA01468_.WMF") returned -1 [0070.617] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF") returned="NA01421_.WMF" [0070.617] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.617] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.617] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.617] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.617] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01468_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" [0070.617] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5403280, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4ada, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01470_.WMF", cAlternateFileName="")) returned 1 [0070.617] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.617] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01470_.WMF") returned -1 [0070.617] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01470_.WMF") returned -1 [0070.617] lstrcmpiA (lpString1="", lpString2="NA01470_.WMF") returned -1 [0070.617] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF") returned="NA01468_.WMF" [0070.617] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.617] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.617] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.617] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.618] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01470_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" [0070.618] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a297de, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2028, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01472_.WMF", cAlternateFileName="")) returned 1 [0070.618] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.618] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01472_.WMF") returned -1 [0070.618] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01472_.WMF") returned -1 [0070.618] lstrcmpiA (lpString1="", lpString2="NA01472_.WMF") returned -1 [0070.618] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF") returned="NA01470_.WMF" [0070.618] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.618] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.619] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.619] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.619] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01472_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" [0070.619] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a297de, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x28ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01473_.WMF", cAlternateFileName="")) returned 1 [0070.619] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.619] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01473_.WMF") returned -1 [0070.619] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01473_.WMF") returned -1 [0070.619] lstrcmpiA (lpString1="", lpString2="NA01473_.WMF") returned -1 [0070.619] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF") returned="NA01472_.WMF" [0070.619] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.619] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.619] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.619] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.619] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01473_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" [0070.619] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb540806e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x349c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01474_.WMF", cAlternateFileName="")) returned 1 [0070.619] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.619] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01474_.WMF") returned -1 [0070.619] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01474_.WMF") returned -1 [0070.619] lstrcmpiA (lpString1="", lpString2="NA01474_.WMF") returned -1 [0070.619] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF") returned="NA01473_.WMF" [0070.619] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.619] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.619] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.619] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.619] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01474_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" [0070.620] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb541a5a4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01627_.WMF", cAlternateFileName="")) returned 1 [0070.620] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.620] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01627_.WMF") returned -1 [0070.620] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01627_.WMF") returned -1 [0070.620] lstrcmpiA (lpString1="", lpString2="NA01627_.WMF") returned -1 [0070.620] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF") returned="NA01474_.WMF" [0070.620] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.620] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.620] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.620] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.620] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01627_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" [0070.620] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5422ed0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01680_.WMF", cAlternateFileName="")) returned 1 [0070.620] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.620] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01680_.WMF") returned -1 [0070.620] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01680_.WMF") returned -1 [0070.620] lstrcmpiA (lpString1="", lpString2="NA01680_.WMF") returned -1 [0070.620] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF") returned="NA01627_.WMF" [0070.620] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.620] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.620] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.620] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.620] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01680_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" [0070.620] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a297de, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xc88, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01682_.WMF", cAlternateFileName="")) returned 1 [0070.620] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.620] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01682_.WMF") returned -1 [0070.621] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01682_.WMF") returned -1 [0070.621] lstrcmpiA (lpString1="", lpString2="NA01682_.WMF") returned -1 [0070.621] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF") returned="NA01680_.WMF" [0070.621] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.621] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.621] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.621] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.621] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01682_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" [0070.621] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb542b6f0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x14c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01701_.WMF", cAlternateFileName="")) returned 1 [0070.621] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.621] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01701_.WMF") returned -1 [0070.621] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01701_.WMF") returned -1 [0070.621] lstrcmpiA (lpString1="", lpString2="NA01701_.WMF") returned -1 [0070.621] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF") returned="NA01682_.WMF" [0070.621] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.621] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.621] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.621] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.621] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01701_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" [0070.621] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a4f9db, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01848_.WMF", cAlternateFileName="")) returned 1 [0070.621] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.621] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01848_.WMF") returned -1 [0070.621] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01848_.WMF") returned -1 [0070.621] lstrcmpiA (lpString1="", lpString2="NA01848_.WMF") returned -1 [0070.621] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF") returned="NA01701_.WMF" [0070.621] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.621] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.622] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.622] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.622] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01848_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" [0070.622] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb54318a4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01849_.WMF", cAlternateFileName="")) returned 1 [0070.622] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.622] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01849_.WMF") returned -1 [0070.622] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01849_.WMF") returned -1 [0070.622] lstrcmpiA (lpString1="", lpString2="NA01849_.WMF") returned -1 [0070.622] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF") returned="NA01848_.WMF" [0070.622] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.622] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.622] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.622] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.622] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01849_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" [0070.622] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb54379cc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01852_.WMF", cAlternateFileName="")) returned 1 [0070.622] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.622] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01852_.WMF") returned -1 [0070.622] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01852_.WMF") returned -1 [0070.622] lstrcmpiA (lpString1="", lpString2="NA01852_.WMF") returned -1 [0070.622] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF") returned="NA01849_.WMF" [0070.622] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.622] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.623] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.623] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.623] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01852_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" [0070.623] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb543db2c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01858_.WMF", cAlternateFileName="")) returned 1 [0070.623] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.623] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01858_.WMF") returned -1 [0070.623] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01858_.WMF") returned -1 [0070.623] lstrcmpiA (lpString1="", lpString2="NA01858_.WMF") returned -1 [0070.623] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF") returned="NA01852_.WMF" [0070.623] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.623] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.623] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.623] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.623] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01858_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" [0070.623] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a55e07, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xdb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01866_.WMF", cAlternateFileName="")) returned 1 [0070.623] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.623] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA01866_.WMF") returned -1 [0070.624] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA01866_.WMF") returned -1 [0070.624] lstrcmpiA (lpString1="", lpString2="NA01866_.WMF") returned -1 [0070.624] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF") returned="NA01858_.WMF" [0070.624] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.624] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.624] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.624] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.624] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA01866_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" [0070.624] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5443d5f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x27e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02009_.WMF", cAlternateFileName="")) returned 1 [0070.624] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.624] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA02009_.WMF") returned -1 [0070.624] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA02009_.WMF") returned -1 [0070.624] lstrcmpiA (lpString1="", lpString2="NA02009_.WMF") returned -1 [0070.624] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF") returned="NA01866_.WMF" [0070.624] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.624] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.624] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.624] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.624] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02009_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" [0070.624] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5448b82, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x918, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02041_.WMF", cAlternateFileName="")) returned 1 [0070.624] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.624] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA02041_.WMF") returned -1 [0070.625] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA02041_.WMF") returned -1 [0070.625] lstrcmpiA (lpString1="", lpString2="NA02041_.WMF") returned -1 [0070.625] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF") returned="NA02009_.WMF" [0070.625] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.625] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.625] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.625] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.625] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02041_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" [0070.625] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a598e0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x43c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02066_.WMF", cAlternateFileName="")) returned 1 [0070.625] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.625] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NA02066_.WMF") returned -1 [0070.625] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NA02066_.WMF") returned -1 [0070.625] lstrcmpiA (lpString1="", lpString2="NA02066_.WMF") returned -1 [0070.625] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF") returned="NA02041_.WMF" [0070.625] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.625] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.625] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.625] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.625] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02066_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" [0070.625] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a5e5d1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x474, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02091_.WMF", cAlternateFileName="")) returned 1 [0070.625] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.625] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF") returned="NA02066_.WMF" [0070.625] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.626] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.626] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.626] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.626] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02091_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" [0070.626] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb544c5d3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02092_.WMF", cAlternateFileName="")) returned 1 [0070.626] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.626] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF") returned="NA02091_.WMF" [0070.626] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.626] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.626] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.626] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.626] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02092_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" [0070.626] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a5f96e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02093_.WMF", cAlternateFileName="")) returned 1 [0070.626] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.626] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF") returned="NA02092_.WMF" [0070.626] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.626] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.626] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.626] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.626] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02093_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" [0070.627] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a5f96e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1fe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02124_.WMF", cAlternateFileName="")) returned 1 [0070.627] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.627] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF") returned="NA02093_.WMF" [0070.627] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.627] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.627] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.627] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.627] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02124_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" [0070.627] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a5f96e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4816, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02125_.WMF", cAlternateFileName="")) returned 1 [0070.627] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.633] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF") returned="NA02124_.WMF" [0070.633] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.633] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.633] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.633] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.633] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02125_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" [0070.633] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a5f96e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02126_.WMF", cAlternateFileName="")) returned 1 [0070.633] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.633] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF") returned="NA02125_.WMF" [0070.633] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.633] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.633] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.633] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.633] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02126_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" [0070.633] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a5f96e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xfe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02127_.WMF", cAlternateFileName="")) returned 1 [0070.633] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.633] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF") returned="NA02126_.WMF" [0070.633] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.634] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.634] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.634] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.634] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02127_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" [0070.634] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb545893f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd00, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02262_.WMF", cAlternateFileName="")) returned 1 [0070.634] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.634] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF") returned="NA02127_.WMF" [0070.634] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.634] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.634] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.634] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.634] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02262_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" [0070.635] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a5f96e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02264_.WMF", cAlternateFileName="")) returned 1 [0070.635] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.635] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF") returned="NA02262_.WMF" [0070.635] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.635] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.635] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.635] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.635] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02264_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" [0070.635] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a5f96e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02356_.WMF", cAlternateFileName="")) returned 1 [0070.635] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.635] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF") returned="NA02264_.WMF" [0070.635] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.635] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.635] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.635] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.635] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02356_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" [0070.635] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a5f96e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x17c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02361_.WMF", cAlternateFileName="")) returned 1 [0070.635] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.635] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF") returned="NA02356_.WMF" [0070.635] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.635] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.635] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.635] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.635] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02361_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" [0070.636] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a86253, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd28, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02368_.WMF", cAlternateFileName="")) returned 1 [0070.636] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.636] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF") returned="NA02361_.WMF" [0070.636] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.636] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.636] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.636] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.636] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02368_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" [0070.638] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a86253, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02371_.WMF", cAlternateFileName="")) returned 1 [0070.638] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.638] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF") returned="NA02368_.WMF" [0070.638] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.638] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.639] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.639] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.639] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02371_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" [0070.639] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a86253, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xcec, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02373_.WMF", cAlternateFileName="")) returned 1 [0070.639] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.639] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF") returned="NA02371_.WMF" [0070.639] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.639] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.639] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.639] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.639] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02373_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" [0070.639] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb545d767, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xbd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02384_.WMF", cAlternateFileName="")) returned 1 [0070.640] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.640] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF") returned="NA02373_.WMF" [0070.640] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.640] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.640] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.640] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.640] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02384_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" [0070.640] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a86253, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02386_.WMF", cAlternateFileName="")) returned 1 [0070.640] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.640] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF") returned="NA02384_.WMF" [0070.640] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.640] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.640] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.640] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.640] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02386_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" [0070.641] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5462653, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xc84, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02388_.WMF", cAlternateFileName="")) returned 1 [0070.641] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.641] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF") returned="NA02386_.WMF" [0070.641] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.641] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.641] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.641] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.641] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02388_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" [0070.641] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a86253, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02389_.WMF", cAlternateFileName="")) returned 1 [0070.641] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.641] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF") returned="NA02388_.WMF" [0070.641] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.641] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.641] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.641] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.641] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02389_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" [0070.641] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a86253, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe64, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02390_.WMF", cAlternateFileName="")) returned 1 [0070.641] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.641] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF") returned="NA02389_.WMF" [0070.641] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.641] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.641] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.641] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.642] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02390_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" [0070.642] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a86253, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02398_.WMF", cAlternateFileName="")) returned 1 [0070.642] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.642] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF") returned="NA02390_.WMF" [0070.642] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.642] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.642] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.642] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.642] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02398_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" [0070.642] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5467341, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd24, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02400_.WMF", cAlternateFileName="")) returned 1 [0070.642] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.642] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF") returned="NA02398_.WMF" [0070.642] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.642] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.642] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.642] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.642] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02400_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" [0070.642] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a86253, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2120, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02404_.WMF", cAlternateFileName="")) returned 1 [0070.642] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.642] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF") returned="NA02400_.WMF" [0070.643] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.643] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.643] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.643] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.643] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02404_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" [0070.643] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9aac204, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02405_.WMF", cAlternateFileName="")) returned 1 [0070.643] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.643] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF") returned="NA02404_.WMF" [0070.643] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.643] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.643] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.643] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.643] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02405_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" [0070.643] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9aac204, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02407_.WMF", cAlternateFileName="")) returned 1 [0070.643] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.643] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF") returned="NA02405_.WMF" [0070.643] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.643] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.643] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.643] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.643] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02407_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" [0070.644] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb546d530, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x28ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02413_.WMF", cAlternateFileName="")) returned 1 [0070.644] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.644] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF") returned="NA02407_.WMF" [0070.644] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.644] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.644] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.644] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.644] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02413_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" [0070.644] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9aac204, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb24, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02417_.WMF", cAlternateFileName="")) returned 1 [0070.644] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.644] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF") returned="NA02413_.WMF" [0070.644] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.644] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.644] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.644] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.644] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02417_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" [0070.644] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9aac204, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02423_.WMF", cAlternateFileName="")) returned 1 [0070.644] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.644] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF") returned="NA02417_.WMF" [0070.644] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.644] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.644] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.644] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.645] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02423_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" [0070.645] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb547238c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x53c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02424_.WMF", cAlternateFileName="")) returned 1 [0070.645] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.645] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF") returned="NA02423_.WMF" [0070.645] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.645] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.645] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.645] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.645] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02424_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" [0070.645] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5475e41, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1948, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02426_.WMF", cAlternateFileName="")) returned 1 [0070.645] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.645] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF") returned="NA02424_.WMF" [0070.645] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.645] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.645] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.645] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.645] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02426_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" [0070.645] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb547ac4a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1c2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02431_.WMF", cAlternateFileName="")) returned 1 [0070.645] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.645] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF") returned="NA02426_.WMF" [0070.645] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.646] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.646] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.646] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.646] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02431_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" [0070.646] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb548218d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xff8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02435_.WMF", cAlternateFileName="")) returned 1 [0070.646] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.646] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF") returned="NA02431_.WMF" [0070.646] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.646] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.646] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.646] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.646] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02435_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" [0070.646] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9aac204, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02439_.WMF", cAlternateFileName="")) returned 1 [0070.646] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.646] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF") returned="NA02435_.WMF" [0070.646] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.646] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.646] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.646] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.646] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02439_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" [0070.646] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9aac204, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3218, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02441_.WMF", cAlternateFileName="")) returned 1 [0070.647] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.647] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF") returned="NA02439_.WMF" [0070.647] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.647] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.647] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.647] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.647] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02441_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" [0070.647] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5485c63, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02443_.WMF", cAlternateFileName="")) returned 1 [0070.647] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.647] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF") returned="NA02441_.WMF" [0070.647] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.647] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.647] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.647] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.647] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02443_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" [0070.647] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9aac204, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x88c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02444_.WMF", cAlternateFileName="")) returned 1 [0070.647] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.647] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF") returned="NA02443_.WMF" [0070.647] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.647] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.647] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.647] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.648] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="NA02444_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" [0070.648] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb548a9fd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa34, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02446_.WMF", cAlternateFileName="")) returned 1 [0070.648] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.648] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF") returned="NA02444_.WMF" [0070.648] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.648] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.648] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.648] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.648] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9aac204, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02448_.WMF", cAlternateFileName="")) returned 1 [0070.648] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.648] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF") returned="NA02446_.WMF" [0070.648] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.648] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.648] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.648] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb548f880, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xc28, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02450_.WMF", cAlternateFileName="")) returned 1 [0070.648] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.648] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF") returned="NA02448_.WMF" [0070.648] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.648] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.648] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.649] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5494758, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd70, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02451_.WMF", cAlternateFileName="")) returned 1 [0070.649] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.649] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF") returned="NA02450_.WMF" [0070.649] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.649] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.649] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.649] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5499451, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02453_.WMF", cAlternateFileName="")) returned 1 [0070.649] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.649] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF") returned="NA02451_.WMF" [0070.649] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.649] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.649] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.649] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9ad23d4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1750, dwReserved0=0x0, dwReserved1=0x0, cFileName="NBOOK_01.MID", cAlternateFileName="")) returned 1 [0070.649] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.650] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF") returned="NA02453_.WMF" [0070.650] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.650] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.650] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.650] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9c139b8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1540, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCEAN_01.MID", cAlternateFileName="")) returned 1 [0070.650] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.650] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned="NBOOK_01.MID" [0070.650] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.650] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.650] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.650] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb6cdb133, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x19f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTDR_01.MID", cAlternateFileName="")) returned 1 [0070.650] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.650] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned="OCEAN_01.MID" [0070.650] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.650] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.650] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.650] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb816a475, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1a6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPER_01.MID", cAlternateFileName="")) returned 1 [0070.650] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.650] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned="OUTDR_01.MID" [0070.650] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.650] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.651] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.651] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca5cce36, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x195b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_01.MID", cAlternateFileName="")) returned 1 [0070.651] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.651] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned="PAPER_01.MID" [0070.651] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.651] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.651] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.651] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca5cce36, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1652, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_02.MID", cAlternateFileName="")) returned 1 [0070.651] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.651] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned="PARNT_01.MID" [0070.651] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.651] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.651] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.651] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb816a475, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x215a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_03.MID", cAlternateFileName="")) returned 1 [0070.651] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.651] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned="PARNT_02.MID" [0070.651] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.651] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.651] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.651] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca5f3089, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x17b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_04.MID", cAlternateFileName="")) returned 1 [0070.652] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.652] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned="PARNT_03.MID" [0070.652] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.652] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.652] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.652] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb816a475, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1784, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_05.MID", cAlternateFileName="")) returned 1 [0070.654] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.654] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned="PARNT_04.MID" [0070.654] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.654] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.654] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.654] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb816a475, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_06.MID", cAlternateFileName="")) returned 1 [0070.654] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.654] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned="PARNT_05.MID" [0070.655] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.655] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.655] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.655] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca5f3089, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x19a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_07.MID", cAlternateFileName="")) returned 1 [0070.655] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.655] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned="PARNT_06.MID" [0070.655] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.655] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.656] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.656] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca5f3089, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1cb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_08.MID", cAlternateFileName="")) returned 1 [0070.656] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.656] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned="PARNT_07.MID" [0070.656] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.656] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.656] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.657] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca5f3089, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1a6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_09.MID", cAlternateFileName="")) returned 1 [0070.657] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.657] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned="PARNT_08.MID" [0070.657] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.657] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.657] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.657] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8190569, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1511, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_10.MID", cAlternateFileName="")) returned 1 [0070.658] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.658] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned="PARNT_09.MID" [0070.658] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.658] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.658] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.658] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca5f3089, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6140, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00013_.WMF", cAlternateFileName="")) returned 1 [0070.658] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.658] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned="PARNT_10.MID" [0070.659] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.659] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.659] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.659] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8279128, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x411a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00014_.WMF", cAlternateFileName="")) returned 1 [0070.659] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.659] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF") returned="PE00013_.WMF" [0070.659] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.659] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.660] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.660] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca5f3089, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00034_.WMF", cAlternateFileName="")) returned 1 [0070.660] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.660] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF") returned="PE00014_.WMF" [0070.660] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.660] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.660] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.661] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb82867f2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00049_.WMF", cAlternateFileName="")) returned 1 [0070.661] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.661] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF") returned="PE00034_.WMF" [0070.661] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.661] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.661] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.661] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca5f3089, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4d18, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00050_.WMF", cAlternateFileName="")) returned 1 [0070.662] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.662] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF") returned="PE00049_.WMF" [0070.662] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.662] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.662] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.662] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca5f3089, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x47ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00052_.WMF", cAlternateFileName="")) returned 1 [0070.662] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.662] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF") returned="PE00050_.WMF" [0070.662] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.663] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.663] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.663] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca5f3089, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00231_.WMF", cAlternateFileName="")) returned 1 [0070.663] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.663] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF") returned="PE00052_.WMF" [0070.663] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.663] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.663] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.664] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb828dd25, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xaf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00272_.WMF", cAlternateFileName="")) returned 1 [0070.664] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.664] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF") returned="PE00231_.WMF" [0070.664] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.664] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.664] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.665] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8297964, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5aa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00468_.WMF", cAlternateFileName="")) returned 1 [0070.665] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.665] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF") returned="PE00272_.WMF" [0070.665] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.665] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.665] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.665] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca619381, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1cf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00478_.WMF", cAlternateFileName="")) returned 1 [0070.665] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.665] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF") returned="PE00468_.WMF" [0070.665] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.665] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.666] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.666] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb82a0252, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00485_.WMF", cAlternateFileName="")) returned 1 [0070.666] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.666] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF") returned="PE00478_.WMF" [0070.666] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.666] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.666] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.666] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca619381, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1402c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00489_.WMF", cAlternateFileName="")) returned 1 [0070.666] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.666] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF") returned="PE00485_.WMF" [0070.666] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.666] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.666] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.666] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca619381, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1ee4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00531_.WMF", cAlternateFileName="")) returned 1 [0070.667] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.667] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF") returned="PE00489_.WMF" [0070.667] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.667] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.667] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.667] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb82ab18c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00542_.WMF", cAlternateFileName="")) returned 1 [0070.667] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.667] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF") returned="PE00531_.WMF" [0070.667] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.667] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.667] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.667] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb82b6137, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x140c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00555_.WMF", cAlternateFileName="")) returned 1 [0070.667] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.667] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF") returned="PE00542_.WMF" [0070.667] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.667] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.668] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.668] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb82bd6a8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x26b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00559_.WMF", cAlternateFileName="")) returned 1 [0070.668] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.668] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF") returned="PE00555_.WMF" [0070.668] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.668] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.668] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.668] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca619381, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5670, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00563_.WMF", cAlternateFileName="")) returned 1 [0070.668] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.668] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF") returned="PE00559_.WMF" [0070.668] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.668] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.668] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.669] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca619381, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1ae6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00578_.WMF", cAlternateFileName="")) returned 1 [0070.669] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.669] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF") returned="PE00563_.WMF" [0070.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.669] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.669] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.669] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca619381, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00608_.WMF", cAlternateFileName="")) returned 1 [0070.669] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.669] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF") returned="PE00578_.WMF" [0070.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.669] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.669] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.669] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb82c5f65, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4cea, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00633_.WMF", cAlternateFileName="")) returned 1 [0070.669] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.669] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF") returned="PE00608_.WMF" [0070.670] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.670] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.670] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.670] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb82d22ea, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb12c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00640_.WMF", cAlternateFileName="")) returned 1 [0070.670] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.670] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF") returned="PE00633_.WMF" [0070.670] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.670] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.670] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.670] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb82dbeb7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6028, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00668_.WMF", cAlternateFileName="")) returned 1 [0070.670] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.670] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF") returned="PE00640_.WMF" [0070.670] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.670] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.670] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.671] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca619381, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x108a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00685_.WMF", cAlternateFileName="")) returned 1 [0070.671] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.671] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF") returned="PE00668_.WMF" [0070.671] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.671] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.671] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.671] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca619381, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x112e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00686_.WMF", cAlternateFileName="")) returned 1 [0070.671] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.671] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF") returned="PE00685_.WMF" [0070.671] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.671] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.671] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.671] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca63f639, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00693_.WMF", cAlternateFileName="")) returned 1 [0070.671] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.671] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF") returned="PE00686_.WMF" [0070.672] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.672] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.672] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.672] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb82e5b2b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3926, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00720_.WMF", cAlternateFileName="")) returned 1 [0070.672] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.672] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF") returned="PE00693_.WMF" [0070.672] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.672] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.672] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.672] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb82ed022, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1afc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00723_.WMF", cAlternateFileName="")) returned 1 [0070.672] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.672] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF") returned="PE00720_.WMF" [0070.672] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.672] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.672] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.673] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca63f639, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00726_.WMF", cAlternateFileName="")) returned 1 [0070.673] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.673] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF") returned="PE00723_.WMF" [0070.673] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.673] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.673] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.673] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca63f639, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x9e2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00737_.WMF", cAlternateFileName="")) returned 1 [0070.675] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.675] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF") returned="PE00726_.WMF" [0070.675] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.675] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.675] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.675] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb82f6d23, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00833_.WMF", cAlternateFileName="")) returned 1 [0070.675] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.675] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF") returned="PE00737_.WMF" [0070.675] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.675] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.675] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.675] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca63f639, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1908, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00898_.WMF", cAlternateFileName="")) returned 1 [0070.675] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.675] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF") returned="PE00833_.WMF" [0070.676] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.676] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.676] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.676] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca63f639, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3100, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00934_.WMF", cAlternateFileName="")) returned 1 [0070.676] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.676] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF") returned="PE00898_.WMF" [0070.676] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.676] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.676] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.676] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8301bff, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2904, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00998_.WMF", cAlternateFileName="")) returned 1 [0070.676] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.676] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF") returned="PE00934_.WMF" [0070.676] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.676] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.676] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.676] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb830a508, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE01160_.WMF", cAlternateFileName="")) returned 1 [0070.676] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.676] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF") returned="PE00998_.WMF" [0070.676] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.676] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.676] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.677] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca63f639, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE01172_.WMF", cAlternateFileName="")) returned 1 [0070.677] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.677] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF") returned="PE01160_.WMF" [0070.677] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.677] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.677] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.677] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8312d74, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3f9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE01191_.WMF", cAlternateFileName="")) returned 1 [0070.677] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.677] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF") returned="PE01172_.WMF" [0070.677] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.677] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.677] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.677] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb831ca62, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1418, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE01661_.WMF", cAlternateFileName="")) returned 1 [0070.677] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.677] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF") returned="PE01191_.WMF" [0070.677] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.677] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.677] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.678] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca63f639, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE01797_.WMF", cAlternateFileName="")) returned 1 [0070.678] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.678] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF") returned="PE01661_.WMF" [0070.678] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.678] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.678] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.678] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8326629, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x23d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02120_.WMF", cAlternateFileName="")) returned 1 [0070.678] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.678] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF") returned="PE01797_.WMF" [0070.678] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.678] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.678] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.678] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb832eef1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1fc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02169_.WMF", cAlternateFileName="")) returned 1 [0070.678] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.678] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF") returned="PE02120_.WMF" [0070.678] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.678] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.678] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.678] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca63f639, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x75e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02262_.WMF", cAlternateFileName="")) returned 1 [0070.678] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.679] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.679] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.679] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.679] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8338b0b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x824e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02263_.WMF", cAlternateFileName="")) returned 1 [0070.679] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.679] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.679] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.679] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.679] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca66993f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x62b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02265_.WMF", cAlternateFileName="")) returned 1 [0070.679] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.679] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.679] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.679] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.679] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca670c70, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x78e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02267_.WMF", cAlternateFileName="")) returned 1 [0070.679] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.679] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.679] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.679] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca675ae4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6f26, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02270_.WMF", cAlternateFileName="")) returned 1 [0070.679] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.680] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.680] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.680] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8344e56, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb9c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02278_.WMF", cAlternateFileName="")) returned 1 [0070.680] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.680] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.680] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.680] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb834eaf7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6928, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02280_.WMF", cAlternateFileName="")) returned 1 [0070.680] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.680] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.680] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.680] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca675ae4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02282_.WMF", cAlternateFileName="")) returned 1 [0070.680] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.680] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.680] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.681] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb83586ce, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02285_.WMF", cAlternateFileName="")) returned 1 [0070.681] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.681] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.681] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.681] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca675ae4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4584, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02287_.WMF", cAlternateFileName="")) returned 1 [0070.681] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.681] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.681] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.681] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8362317, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x76e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02288_.WMF", cAlternateFileName="")) returned 1 [0070.681] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.695] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.695] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.695] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca675ae4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5850, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02293_.WMF", cAlternateFileName="")) returned 1 [0070.695] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.695] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.695] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.695] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb836ab44, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5328, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02296_.WMF", cAlternateFileName="")) returned 1 [0070.695] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.695] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.695] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.695] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb836e5ad, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02369_.WMF", cAlternateFileName="")) returned 1 [0070.696] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.696] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.696] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.696] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca675ae4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x39f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02522_.WMF", cAlternateFileName="")) returned 1 [0070.696] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.696] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.696] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.696] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8375ae8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1d2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02950_.WMF", cAlternateFileName="")) returned 1 [0070.696] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.696] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.696] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.696] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb837a92b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xc70, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02957_.WMF", cAlternateFileName="")) returned 1 [0070.696] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.696] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.697] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.697] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb837f79e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x614, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03236_.WMF", cAlternateFileName="")) returned 1 [0070.697] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.697] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.697] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.697] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca675ae4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03241_.WMF", cAlternateFileName="")) returned 1 [0070.697] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.697] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.697] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.697] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8384554, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3380, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03257_.WMF", cAlternateFileName="")) returned 1 [0070.697] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.697] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.697] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.697] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8389395, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03331_.WMF", cAlternateFileName="")) returned 1 [0070.697] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.697] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.697] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.698] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca675ae4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x282c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03339_.WMF", cAlternateFileName="")) returned 1 [0070.698] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.698] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.698] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.698] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb838e20b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2108, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03451_.WMF", cAlternateFileName="")) returned 1 [0070.701] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.701] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.701] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.701] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca675ae4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1f24, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03453_.WMF", cAlternateFileName="")) returned 1 [0070.701] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.701] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.701] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.701] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8394386, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2178, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03459_.WMF", cAlternateFileName="")) returned 1 [0070.701] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.701] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.701] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.701] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca675ae4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1664, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03464_.WMF", cAlternateFileName="")) returned 1 [0070.701] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.701] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.701] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.702] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca69c007, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x41a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03466_.WMF", cAlternateFileName="")) returned 1 [0070.702] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.702] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.702] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.702] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca69c007, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3998, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03470_.WMF", cAlternateFileName="")) returned 1 [0070.702] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.702] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.702] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.702] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb83991ca, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03513_.WMF", cAlternateFileName="")) returned 1 [0070.702] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.702] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.702] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.702] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca69c007, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1868, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03668_.WMF", cAlternateFileName="")) returned 1 [0070.702] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.702] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.702] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.702] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb839dfa1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03731_.WMF", cAlternateFileName="")) returned 1 [0070.703] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.703] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.703] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.703] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca69c007, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03795_.WMF", cAlternateFileName="")) returned 1 [0070.703] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.703] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.703] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.703] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb83a1a4a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1020, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE04050_.WMF", cAlternateFileName="")) returned 1 [0070.703] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.703] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.703] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.703] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb83a8f9e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x37f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE05665_.WMF", cAlternateFileName="")) returned 1 [0070.703] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.703] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.703] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.703] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb83addc2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x167c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE05710_.WMF", cAlternateFileName="")) returned 1 [0070.704] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.704] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.704] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.704] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb83b2c0e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE05869_.WMF", cAlternateFileName="")) returned 1 [0070.704] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.704] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.704] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.704] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb83b665b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE05870_.WMF", cAlternateFileName="")) returned 1 [0070.704] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.704] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.704] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.704] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb83bef2b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7fce, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE05930_.WMF", cAlternateFileName="")) returned 1 [0070.704] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.704] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.704] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.704] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca69c007, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE06049_.WMF", cAlternateFileName="")) returned 1 [0070.704] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.704] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.704] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.705] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb83c3dd4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4048, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE06450_.WMF", cAlternateFileName="")) returned 1 [0070.705] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.705] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.705] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.705] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8503a61, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x629, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH00601G.GIF", cAlternateFileName="")) returned 1 [0070.705] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.705] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.705] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.705] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.706] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x629 [0070.706] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb8503a61, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.706] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.707] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x5cd, lpOverlapped=0x0) returned 1 [0070.708] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.709] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x5cd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x5cd, lpOverlapped=0x0) returned 1 [0070.709] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.709] CloseHandle (hObject=0x1cc) returned 1 [0070.710] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph00601g.gif.bd")) returned 1 [0070.711] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca7c5287, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8628, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH00780U.BMP", cAlternateFileName="")) returned 1 [0070.711] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.711] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH00780U.BMP") returned -1 [0070.711] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH00780U.BMP") returned -1 [0070.711] lstrcmpiA (lpString1="", lpString2="PH00780U.BMP") returned -1 [0070.711] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.711] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.711] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.711] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH00780U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" [0070.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP", pszSpec="*.zip") returned 0 [0070.711] lstrlenA (lpString="*.zip") returned 5 [0070.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP", pszSpec="*.rar") returned 0 [0070.711] lstrlenA (lpString="*.rar") returned 5 [0070.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP", pszSpec="*.7z") returned 0 [0070.711] lstrlenA (lpString="*.7z") returned 4 [0070.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP", pszSpec="*.tar") returned 0 [0070.711] lstrlenA (lpString="*.tar") returned 5 [0070.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP", pszSpec="*.gzip") returned 0 [0070.711] lstrlenA (lpString="*.gzip") returned 6 [0070.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP", pszSpec="*.jpg") returned 0 [0070.711] lstrlenA (lpString="*.jpg") returned 5 [0070.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP", pszSpec="*.jpeg") returned 0 [0070.711] lstrlenA (lpString="*.jpeg") returned 6 [0070.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP", pszSpec="*.psd") returned 0 [0070.713] lstrlenA (lpString="*.psd") returned 5 [0070.713] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP", pszSpec="*.cdr") returned 0 [0070.713] lstrlenA (lpString="*.cdr") returned 5 [0070.713] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP", pszSpec="*.dwg") returned 0 [0070.713] lstrlenA (lpString="*.dwg") returned 5 [0070.713] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP", pszSpec="*.max") returned 0 [0070.713] lstrlenA (lpString="*.max") returned 5 [0070.713] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP", pszSpec="*.bmp") returned 1 [0070.713] lstrlenA (lpString="*.bmp") returned 5 [0070.713] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" [0070.713] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" [0070.714] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP." [0070.714] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.BD" [0070.714] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.714] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8628 [0070.715] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca7c5287, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.715] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.715] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x85cc, lpOverlapped=0x0) returned 1 [0070.721] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP") returned="PH00780U.BMP" [0070.722] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.722] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x85cc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x85cc, lpOverlapped=0x0) returned 1 [0070.723] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.723] CloseHandle (hObject=0x1cc) returned 1 [0070.725] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp.bd")) returned 1 [0070.725] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca7ca077, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01035U.BMP", cAlternateFileName="")) returned 1 [0070.725] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.725] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH01035U.BMP") returned -1 [0070.725] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH01035U.BMP") returned -1 [0070.725] lstrcmpiA (lpString1="", lpString2="PH01035U.BMP") returned -1 [0070.725] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP") returned="PH00780U.BMP" [0070.725] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.725] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.725] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.725] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.725] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH01035U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" [0070.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP", pszSpec="*.zip") returned 0 [0070.726] lstrlenA (lpString="*.zip") returned 5 [0070.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP", pszSpec="*.rar") returned 0 [0070.726] lstrlenA (lpString="*.rar") returned 5 [0070.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP", pszSpec="*.7z") returned 0 [0070.726] lstrlenA (lpString="*.7z") returned 4 [0070.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP", pszSpec="*.tar") returned 0 [0070.726] lstrlenA (lpString="*.tar") returned 5 [0070.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP", pszSpec="*.gzip") returned 0 [0070.726] lstrlenA (lpString="*.gzip") returned 6 [0070.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP", pszSpec="*.jpg") returned 0 [0070.726] lstrlenA (lpString="*.jpg") returned 5 [0070.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP", pszSpec="*.jpeg") returned 0 [0070.726] lstrlenA (lpString="*.jpeg") returned 6 [0070.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP", pszSpec="*.psd") returned 0 [0070.726] lstrlenA (lpString="*.psd") returned 5 [0070.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP", pszSpec="*.cdr") returned 0 [0070.726] lstrlenA (lpString="*.cdr") returned 5 [0070.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP", pszSpec="*.dwg") returned 0 [0070.726] lstrlenA (lpString="*.dwg") returned 5 [0070.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP", pszSpec="*.max") returned 0 [0070.726] lstrlenA (lpString="*.max") returned 5 [0070.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP", pszSpec="*.bmp") returned 1 [0070.726] lstrlenA (lpString="*.bmp") returned 5 [0070.726] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" [0070.726] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" [0070.726] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP." [0070.726] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.BD" [0070.726] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.727] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7e90 [0070.727] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca7ca077, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.727] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.727] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7e34, lpOverlapped=0x0) returned 1 [0070.730] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP") returned="PH01035U.BMP" [0070.731] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.731] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7e34, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7e34, lpOverlapped=0x0) returned 1 [0070.731] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.731] CloseHandle (hObject=0x1cc) returned 1 [0070.733] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp.bd")) returned 1 [0070.734] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca7d290f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x211bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01046J.JPG", cAlternateFileName="")) returned 1 [0070.734] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.734] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH01046J.JPG") returned -1 [0070.734] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH01046J.JPG") returned -1 [0070.734] lstrcmpiA (lpString1="", lpString2="PH01046J.JPG") returned -1 [0070.734] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP") returned="PH01035U.BMP" [0070.734] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.734] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.734] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.734] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.734] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH01046J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" [0070.734] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG", pszSpec="*.zip") returned 0 [0070.734] lstrlenA (lpString="*.zip") returned 5 [0070.734] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG", pszSpec="*.rar") returned 0 [0070.734] lstrlenA (lpString="*.rar") returned 5 [0070.734] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG", pszSpec="*.7z") returned 0 [0070.734] lstrlenA (lpString="*.7z") returned 4 [0070.734] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG", pszSpec="*.tar") returned 0 [0070.734] lstrlenA (lpString="*.tar") returned 5 [0070.734] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG", pszSpec="*.gzip") returned 0 [0070.734] lstrlenA (lpString="*.gzip") returned 6 [0070.734] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG", pszSpec="*.jpg") returned 1 [0070.734] lstrlenA (lpString="*.jpg") returned 5 [0070.735] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" [0070.735] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" [0070.735] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG." [0070.735] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.BD" [0070.735] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.735] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x211bb [0070.735] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca7d290f, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.735] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.735] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x2115f, lpOverlapped=0x0) returned 1 [0070.750] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG") returned="PH01046J.JPG" [0070.754] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.754] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x2115f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x2115f, lpOverlapped=0x0) returned 1 [0070.754] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.754] CloseHandle (hObject=0x1cc) returned 1 [0070.758] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg.bd")) returned 1 [0070.770] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca7d9e50, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa202, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01179J.JPG", cAlternateFileName="")) returned 1 [0070.770] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.770] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH01179J.JPG") returned -1 [0070.770] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH01179J.JPG") returned -1 [0070.770] lstrcmpiA (lpString1="", lpString2="PH01179J.JPG") returned -1 [0070.770] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG") returned="PH01046J.JPG" [0070.770] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.770] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.770] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.771] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.771] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH01179J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" [0070.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG", pszSpec="*.zip") returned 0 [0070.771] lstrlenA (lpString="*.zip") returned 5 [0070.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG", pszSpec="*.rar") returned 0 [0070.771] lstrlenA (lpString="*.rar") returned 5 [0070.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG", pszSpec="*.7z") returned 0 [0070.771] lstrlenA (lpString="*.7z") returned 4 [0070.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG", pszSpec="*.tar") returned 0 [0070.771] lstrlenA (lpString="*.tar") returned 5 [0070.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG", pszSpec="*.gzip") returned 0 [0070.771] lstrlenA (lpString="*.gzip") returned 6 [0070.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG", pszSpec="*.jpg") returned 1 [0070.771] lstrlenA (lpString="*.jpg") returned 5 [0070.771] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" [0070.771] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" [0070.771] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG." [0070.771] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.BD" [0070.771] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.772] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa202 [0070.772] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca7d9e50, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.772] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.772] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xa1a6, lpOverlapped=0x0) returned 1 [0070.774] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG") returned="PH01179J.JPG" [0070.775] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.775] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xa1a6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xa1a6, lpOverlapped=0x0) returned 1 [0070.776] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.776] CloseHandle (hObject=0x1cc) returned 1 [0070.778] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg.bd")) returned 1 [0070.779] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca7dec86, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x18be, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01213K.JPG", cAlternateFileName="")) returned 1 [0070.779] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.779] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH01213K.JPG") returned -1 [0070.779] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH01213K.JPG") returned -1 [0070.779] lstrcmpiA (lpString1="", lpString2="PH01213K.JPG") returned -1 [0070.779] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG") returned="PH01179J.JPG" [0070.779] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.779] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.779] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.779] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.779] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH01213K.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" [0070.779] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG", pszSpec="*.zip") returned 0 [0070.779] lstrlenA (lpString="*.zip") returned 5 [0070.779] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG", pszSpec="*.rar") returned 0 [0070.779] lstrlenA (lpString="*.rar") returned 5 [0070.779] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG", pszSpec="*.7z") returned 0 [0070.779] lstrlenA (lpString="*.7z") returned 4 [0070.779] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG", pszSpec="*.tar") returned 0 [0070.779] lstrlenA (lpString="*.tar") returned 5 [0070.779] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG", pszSpec="*.gzip") returned 0 [0070.779] lstrlenA (lpString="*.gzip") returned 6 [0070.779] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG", pszSpec="*.jpg") returned 1 [0070.779] lstrlenA (lpString="*.jpg") returned 5 [0070.779] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" [0070.780] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" [0070.780] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG." [0070.780] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.BD" [0070.780] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.780] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18be [0070.780] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca7dec86, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.780] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.780] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1862, lpOverlapped=0x0) returned 1 [0070.781] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG") returned="PH01213K.JPG" [0070.782] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.782] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1862, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1862, lpOverlapped=0x0) returned 1 [0070.782] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.782] CloseHandle (hObject=0x1cc) returned 1 [0070.783] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg.bd")) returned 1 [0070.784] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca7e3ad0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1c94, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01221K.JPG", cAlternateFileName="")) returned 1 [0070.784] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.784] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH01221K.JPG") returned -1 [0070.784] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH01221K.JPG") returned -1 [0070.784] lstrcmpiA (lpString1="", lpString2="PH01221K.JPG") returned -1 [0070.784] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG") returned="PH01213K.JPG" [0070.784] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.784] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.784] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.784] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.784] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH01221K.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" [0070.784] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG", pszSpec="*.zip") returned 0 [0070.784] lstrlenA (lpString="*.zip") returned 5 [0070.784] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG", pszSpec="*.rar") returned 0 [0070.784] lstrlenA (lpString="*.rar") returned 5 [0070.784] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG", pszSpec="*.7z") returned 0 [0070.784] lstrlenA (lpString="*.7z") returned 4 [0070.784] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG", pszSpec="*.tar") returned 0 [0070.784] lstrlenA (lpString="*.tar") returned 5 [0070.785] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG", pszSpec="*.gzip") returned 0 [0070.785] lstrlenA (lpString="*.gzip") returned 6 [0070.785] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG", pszSpec="*.jpg") returned 1 [0070.785] lstrlenA (lpString="*.jpg") returned 5 [0070.785] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" [0070.785] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" [0070.785] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG." [0070.785] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.BD" [0070.785] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.785] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c94 [0070.785] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca7e3ad0, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.785] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.785] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1c38, lpOverlapped=0x0) returned 1 [0070.787] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG") returned="PH01221K.JPG" [0070.787] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.787] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1c38, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1c38, lpOverlapped=0x0) returned 1 [0070.787] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.787] CloseHandle (hObject=0x1cc) returned 1 [0070.788] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg.bd")) returned 1 [0070.789] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85088e3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01235U.BMP", cAlternateFileName="")) returned 1 [0070.789] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.789] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH01235U.BMP") returned -1 [0070.789] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH01235U.BMP") returned -1 [0070.789] lstrcmpiA (lpString1="", lpString2="PH01235U.BMP") returned -1 [0070.789] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG") returned="PH01221K.JPG" [0070.789] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.789] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.789] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.789] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.789] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH01235U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" [0070.790] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP", pszSpec="*.zip") returned 0 [0070.790] lstrlenA (lpString="*.zip") returned 5 [0070.790] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP", pszSpec="*.rar") returned 0 [0070.790] lstrlenA (lpString="*.rar") returned 5 [0070.790] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP", pszSpec="*.7z") returned 0 [0070.790] lstrlenA (lpString="*.7z") returned 4 [0070.790] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP", pszSpec="*.tar") returned 0 [0070.790] lstrlenA (lpString="*.tar") returned 5 [0070.790] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP", pszSpec="*.gzip") returned 0 [0070.790] lstrlenA (lpString="*.gzip") returned 6 [0070.790] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP", pszSpec="*.jpg") returned 0 [0070.790] lstrlenA (lpString="*.jpg") returned 5 [0070.790] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP", pszSpec="*.jpeg") returned 0 [0070.790] lstrlenA (lpString="*.jpeg") returned 6 [0070.790] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP", pszSpec="*.psd") returned 0 [0070.790] lstrlenA (lpString="*.psd") returned 5 [0070.790] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP", pszSpec="*.cdr") returned 0 [0070.790] lstrlenA (lpString="*.cdr") returned 5 [0070.790] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP", pszSpec="*.dwg") returned 0 [0070.790] lstrlenA (lpString="*.dwg") returned 5 [0070.790] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP", pszSpec="*.max") returned 0 [0070.790] lstrlenA (lpString="*.max") returned 5 [0070.790] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP", pszSpec="*.bmp") returned 1 [0070.790] lstrlenA (lpString="*.bmp") returned 5 [0070.790] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" [0070.790] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" [0070.790] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP." [0070.790] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.BD" [0070.790] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.791] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8 [0070.791] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb85088e3, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.791] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.791] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7d5c, lpOverlapped=0x0) returned 1 [0070.818] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP") returned="PH01235U.BMP" [0070.818] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.818] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7d5c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7d5c, lpOverlapped=0x0) returned 1 [0070.819] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.819] CloseHandle (hObject=0x1cc) returned 1 [0070.821] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp.bd")) returned 1 [0070.822] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb850fdef, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01236U.BMP", cAlternateFileName="")) returned 1 [0070.822] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.822] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH01236U.BMP") returned -1 [0070.822] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH01236U.BMP") returned -1 [0070.822] lstrcmpiA (lpString1="", lpString2="PH01236U.BMP") returned -1 [0070.822] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP") returned="PH01235U.BMP" [0070.822] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.822] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.822] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.822] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.822] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH01236U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" [0070.822] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP", pszSpec="*.zip") returned 0 [0070.823] lstrlenA (lpString="*.zip") returned 5 [0070.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP", pszSpec="*.rar") returned 0 [0070.823] lstrlenA (lpString="*.rar") returned 5 [0070.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP", pszSpec="*.7z") returned 0 [0070.823] lstrlenA (lpString="*.7z") returned 4 [0070.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP", pszSpec="*.tar") returned 0 [0070.823] lstrlenA (lpString="*.tar") returned 5 [0070.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP", pszSpec="*.gzip") returned 0 [0070.823] lstrlenA (lpString="*.gzip") returned 6 [0070.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP", pszSpec="*.jpg") returned 0 [0070.823] lstrlenA (lpString="*.jpg") returned 5 [0070.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP", pszSpec="*.jpeg") returned 0 [0070.823] lstrlenA (lpString="*.jpeg") returned 6 [0070.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP", pszSpec="*.psd") returned 0 [0070.823] lstrlenA (lpString="*.psd") returned 5 [0070.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP", pszSpec="*.cdr") returned 0 [0070.823] lstrlenA (lpString="*.cdr") returned 5 [0070.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP", pszSpec="*.dwg") returned 0 [0070.823] lstrlenA (lpString="*.dwg") returned 5 [0070.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP", pszSpec="*.max") returned 0 [0070.823] lstrlenA (lpString="*.max") returned 5 [0070.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP", pszSpec="*.bmp") returned 1 [0070.823] lstrlenA (lpString="*.bmp") returned 5 [0070.823] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" [0070.823] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" [0070.823] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP." [0070.823] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.BD" [0070.823] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.824] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce0 [0070.824] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb850fdef, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.824] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.824] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7c84, lpOverlapped=0x0) returned 1 [0070.936] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP") returned="PH01236U.BMP" [0070.937] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.937] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7c84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7c84, lpOverlapped=0x0) returned 1 [0070.938] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.938] CloseHandle (hObject=0x1cc) returned 1 [0070.940] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp.bd")) returned 1 [0070.941] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca7e88b6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1764, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01239K.JPG", cAlternateFileName="")) returned 1 [0070.941] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.941] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH01239K.JPG") returned -1 [0070.941] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH01239K.JPG") returned -1 [0070.941] lstrcmpiA (lpString1="", lpString2="PH01239K.JPG") returned -1 [0070.941] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP") returned="PH01236U.BMP" [0070.941] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.941] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.941] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.942] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.942] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH01239K.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" [0070.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG", pszSpec="*.zip") returned 0 [0070.942] lstrlenA (lpString="*.zip") returned 5 [0070.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG", pszSpec="*.rar") returned 0 [0070.942] lstrlenA (lpString="*.rar") returned 5 [0070.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG", pszSpec="*.7z") returned 0 [0070.942] lstrlenA (lpString="*.7z") returned 4 [0070.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG", pszSpec="*.tar") returned 0 [0070.942] lstrlenA (lpString="*.tar") returned 5 [0070.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG", pszSpec="*.gzip") returned 0 [0070.942] lstrlenA (lpString="*.gzip") returned 6 [0070.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG", pszSpec="*.jpg") returned 1 [0070.942] lstrlenA (lpString="*.jpg") returned 5 [0070.942] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" [0070.942] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" [0070.942] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG." [0070.942] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.BD" [0070.942] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.942] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1764 [0070.942] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca7e88b6, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.943] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.943] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1708, lpOverlapped=0x0) returned 1 [0070.976] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG") returned="PH01239K.JPG" [0070.976] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.976] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1708, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1708, lpOverlapped=0x0) returned 1 [0070.977] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.977] CloseHandle (hObject=0x1cc) returned 1 [0070.980] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg.bd")) returned 1 [0070.982] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85162e6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01247U.BMP", cAlternateFileName="")) returned 1 [0070.982] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0070.982] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH01247U.BMP") returned -1 [0070.982] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH01247U.BMP") returned -1 [0070.982] lstrcmpiA (lpString1="", lpString2="PH01247U.BMP") returned -1 [0070.982] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG") returned="PH01239K.JPG" [0070.983] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0070.983] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0070.983] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0070.983] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0070.983] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH01247U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" [0070.983] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP", pszSpec="*.zip") returned 0 [0070.983] lstrlenA (lpString="*.zip") returned 5 [0070.983] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP", pszSpec="*.rar") returned 0 [0070.984] lstrlenA (lpString="*.rar") returned 5 [0070.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP", pszSpec="*.7z") returned 0 [0070.984] lstrlenA (lpString="*.7z") returned 4 [0070.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP", pszSpec="*.tar") returned 0 [0070.984] lstrlenA (lpString="*.tar") returned 5 [0070.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP", pszSpec="*.gzip") returned 0 [0070.984] lstrlenA (lpString="*.gzip") returned 6 [0070.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP", pszSpec="*.jpg") returned 0 [0070.984] lstrlenA (lpString="*.jpg") returned 5 [0070.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP", pszSpec="*.jpeg") returned 0 [0070.984] lstrlenA (lpString="*.jpeg") returned 6 [0070.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP", pszSpec="*.psd") returned 0 [0070.985] lstrlenA (lpString="*.psd") returned 5 [0070.985] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP", pszSpec="*.cdr") returned 0 [0070.985] lstrlenA (lpString="*.cdr") returned 5 [0070.985] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP", pszSpec="*.dwg") returned 0 [0070.985] lstrlenA (lpString="*.dwg") returned 5 [0070.985] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP", pszSpec="*.max") returned 0 [0070.985] lstrlenA (lpString="*.max") returned 5 [0070.985] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP", pszSpec="*.bmp") returned 1 [0070.985] lstrlenA (lpString="*.bmp") returned 5 [0070.985] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" [0070.985] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" [0070.985] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP." [0070.985] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.BD" [0070.985] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.986] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7c08 [0070.986] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb85162e6, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0070.986] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0070.986] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7bac, lpOverlapped=0x0) returned 1 [0071.049] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP") returned="PH01247U.BMP" [0071.050] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.050] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7bac, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7bac, lpOverlapped=0x0) returned 1 [0071.051] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.051] CloseHandle (hObject=0x1cc) returned 1 [0071.053] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp.bd")) returned 1 [0071.054] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca7eeae2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1e55, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01255G.GIF", cAlternateFileName="")) returned 1 [0071.055] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.055] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH01255G.GIF") returned -1 [0071.055] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH01255G.GIF") returned -1 [0071.055] lstrcmpiA (lpString1="", lpString2="PH01255G.GIF") returned -1 [0071.055] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP") returned="PH01247U.BMP" [0071.055] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.055] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.055] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.055] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.055] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH01255G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" [0071.055] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF", pszSpec="*.zip") returned 0 [0071.055] lstrlenA (lpString="*.zip") returned 5 [0071.055] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF", pszSpec="*.rar") returned 0 [0071.055] lstrlenA (lpString="*.rar") returned 5 [0071.055] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF", pszSpec="*.7z") returned 0 [0071.055] lstrlenA (lpString="*.7z") returned 4 [0071.055] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF", pszSpec="*.tar") returned 0 [0071.056] lstrlenA (lpString="*.tar") returned 5 [0071.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF", pszSpec="*.gzip") returned 0 [0071.056] lstrlenA (lpString="*.gzip") returned 6 [0071.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF", pszSpec="*.jpg") returned 0 [0071.056] lstrlenA (lpString="*.jpg") returned 5 [0071.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF", pszSpec="*.jpeg") returned 0 [0071.056] lstrlenA (lpString="*.jpeg") returned 6 [0071.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF", pszSpec="*.psd") returned 0 [0071.056] lstrlenA (lpString="*.psd") returned 5 [0071.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF", pszSpec="*.cdr") returned 0 [0071.056] lstrlenA (lpString="*.cdr") returned 5 [0071.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF", pszSpec="*.dwg") returned 0 [0071.056] lstrlenA (lpString="*.dwg") returned 5 [0071.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF", pszSpec="*.max") returned 0 [0071.056] lstrlenA (lpString="*.max") returned 5 [0071.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF", pszSpec="*.bmp") returned 0 [0071.056] lstrlenA (lpString="*.bmp") returned 5 [0071.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF", pszSpec="*.gif") returned 1 [0071.056] lstrlenA (lpString="*.gif") returned 5 [0071.056] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" [0071.056] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" [0071.056] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF." [0071.056] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.BD" [0071.056] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.057] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e55 [0071.057] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca7eeae2, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.057] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.057] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1df9, lpOverlapped=0x0) returned 1 [0071.062] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF") returned="PH01255G.GIF" [0071.062] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.063] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1df9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1df9, lpOverlapped=0x0) returned 1 [0071.063] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.063] CloseHandle (hObject=0x1cc) returned 1 [0071.064] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01255g.gif.bd")) returned 1 [0071.065] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca7f4c95, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01265U.BMP", cAlternateFileName="")) returned 1 [0071.065] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.065] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH01265U.BMP") returned -1 [0071.065] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH01265U.BMP") returned -1 [0071.065] lstrcmpiA (lpString1="", lpString2="PH01265U.BMP") returned -1 [0071.065] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF") returned="PH01255G.GIF" [0071.065] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.065] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.065] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.065] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.065] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH01265U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" [0071.065] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP", pszSpec="*.zip") returned 0 [0071.065] lstrlenA (lpString="*.zip") returned 5 [0071.065] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP", pszSpec="*.rar") returned 0 [0071.065] lstrlenA (lpString="*.rar") returned 5 [0071.065] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP", pszSpec="*.7z") returned 0 [0071.065] lstrlenA (lpString="*.7z") returned 4 [0071.065] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP", pszSpec="*.tar") returned 0 [0071.065] lstrlenA (lpString="*.tar") returned 5 [0071.065] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP", pszSpec="*.gzip") returned 0 [0071.065] lstrlenA (lpString="*.gzip") returned 6 [0071.065] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP", pszSpec="*.jpg") returned 0 [0071.066] lstrlenA (lpString="*.jpg") returned 5 [0071.066] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP", pszSpec="*.jpeg") returned 0 [0071.066] lstrlenA (lpString="*.jpeg") returned 6 [0071.066] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP", pszSpec="*.psd") returned 0 [0071.066] lstrlenA (lpString="*.psd") returned 5 [0071.066] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP", pszSpec="*.cdr") returned 0 [0071.066] lstrlenA (lpString="*.cdr") returned 5 [0071.066] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP", pszSpec="*.dwg") returned 0 [0071.066] lstrlenA (lpString="*.dwg") returned 5 [0071.066] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP", pszSpec="*.max") returned 0 [0071.066] lstrlenA (lpString="*.max") returned 5 [0071.066] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP", pszSpec="*.bmp") returned 1 [0071.066] lstrlenA (lpString="*.bmp") returned 5 [0071.066] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" [0071.066] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" [0071.066] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP." [0071.066] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.BD" [0071.066] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.066] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7c08 [0071.066] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca7f4c95, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.066] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.066] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7bac, lpOverlapped=0x0) returned 1 [0071.068] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP") returned="PH01265U.BMP" [0071.069] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.069] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7bac, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7bac, lpOverlapped=0x0) returned 1 [0071.069] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.069] CloseHandle (hObject=0x1cc) returned 1 [0071.072] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp.bd")) returned 1 [0071.074] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb851d4ee, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01332U.BMP", cAlternateFileName="")) returned 1 [0071.074] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.074] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH01332U.BMP") returned -1 [0071.074] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH01332U.BMP") returned -1 [0071.074] lstrcmpiA (lpString1="", lpString2="PH01332U.BMP") returned -1 [0071.074] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP") returned="PH01265U.BMP" [0071.074] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.074] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.074] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.075] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.075] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH01332U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" [0071.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP", pszSpec="*.zip") returned 0 [0071.075] lstrlenA (lpString="*.zip") returned 5 [0071.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP", pszSpec="*.rar") returned 0 [0071.075] lstrlenA (lpString="*.rar") returned 5 [0071.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP", pszSpec="*.7z") returned 0 [0071.075] lstrlenA (lpString="*.7z") returned 4 [0071.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP", pszSpec="*.tar") returned 0 [0071.075] lstrlenA (lpString="*.tar") returned 5 [0071.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP", pszSpec="*.gzip") returned 0 [0071.076] lstrlenA (lpString="*.gzip") returned 6 [0071.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP", pszSpec="*.jpg") returned 0 [0071.076] lstrlenA (lpString="*.jpg") returned 5 [0071.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP", pszSpec="*.jpeg") returned 0 [0071.076] lstrlenA (lpString="*.jpeg") returned 6 [0071.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP", pszSpec="*.psd") returned 0 [0071.076] lstrlenA (lpString="*.psd") returned 5 [0071.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP", pszSpec="*.cdr") returned 0 [0071.076] lstrlenA (lpString="*.cdr") returned 5 [0071.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP", pszSpec="*.dwg") returned 0 [0071.076] lstrlenA (lpString="*.dwg") returned 5 [0071.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP", pszSpec="*.max") returned 0 [0071.077] lstrlenA (lpString="*.max") returned 5 [0071.077] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP", pszSpec="*.bmp") returned 1 [0071.077] lstrlenA (lpString="*.bmp") returned 5 [0071.077] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" [0071.077] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" [0071.077] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP." [0071.077] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.BD" [0071.077] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.134] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8 [0071.135] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb851d4ee, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.135] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.135] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7d5c, lpOverlapped=0x0) returned 1 [0071.202] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP") returned="PH01332U.BMP" [0071.203] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.203] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7d5c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7d5c, lpOverlapped=0x0) returned 1 [0071.203] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.203] CloseHandle (hObject=0x1cc) returned 1 [0071.206] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp.bd")) returned 1 [0071.206] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca7f9a68, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01478U.BMP", cAlternateFileName="")) returned 1 [0071.206] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.206] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH01478U.BMP") returned -1 [0071.206] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH01478U.BMP") returned -1 [0071.207] lstrcmpiA (lpString1="", lpString2="PH01478U.BMP") returned -1 [0071.207] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP") returned="PH01332U.BMP" [0071.207] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.207] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.207] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.207] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.207] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH01478U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" [0071.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP", pszSpec="*.zip") returned 0 [0071.207] lstrlenA (lpString="*.zip") returned 5 [0071.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP", pszSpec="*.rar") returned 0 [0071.207] lstrlenA (lpString="*.rar") returned 5 [0071.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP", pszSpec="*.7z") returned 0 [0071.207] lstrlenA (lpString="*.7z") returned 4 [0071.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP", pszSpec="*.tar") returned 0 [0071.207] lstrlenA (lpString="*.tar") returned 5 [0071.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP", pszSpec="*.gzip") returned 0 [0071.207] lstrlenA (lpString="*.gzip") returned 6 [0071.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP", pszSpec="*.jpg") returned 0 [0071.207] lstrlenA (lpString="*.jpg") returned 5 [0071.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP", pszSpec="*.jpeg") returned 0 [0071.207] lstrlenA (lpString="*.jpeg") returned 6 [0071.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP", pszSpec="*.psd") returned 0 [0071.207] lstrlenA (lpString="*.psd") returned 5 [0071.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP", pszSpec="*.cdr") returned 0 [0071.207] lstrlenA (lpString="*.cdr") returned 5 [0071.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP", pszSpec="*.dwg") returned 0 [0071.207] lstrlenA (lpString="*.dwg") returned 5 [0071.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP", pszSpec="*.max") returned 0 [0071.207] lstrlenA (lpString="*.max") returned 5 [0071.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP", pszSpec="*.bmp") returned 1 [0071.207] lstrlenA (lpString="*.bmp") returned 5 [0071.208] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" [0071.208] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" [0071.208] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP." [0071.208] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.BD" [0071.208] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.208] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce0 [0071.208] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca7f9a68, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.208] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.208] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7c84, lpOverlapped=0x0) returned 1 [0071.210] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP") returned="PH01478U.BMP" [0071.210] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.211] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7c84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7c84, lpOverlapped=0x0) returned 1 [0071.211] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.211] CloseHandle (hObject=0x1cc) returned 1 [0071.213] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp.bd")) returned 1 [0071.214] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca7ffbf0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01562U.BMP", cAlternateFileName="")) returned 1 [0071.214] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.214] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH01562U.BMP") returned -1 [0071.214] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH01562U.BMP") returned -1 [0071.214] lstrcmpiA (lpString1="", lpString2="PH01562U.BMP") returned -1 [0071.214] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP") returned="PH01478U.BMP" [0071.214] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.214] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.214] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.214] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.214] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH01562U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" [0071.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP", pszSpec="*.zip") returned 0 [0071.214] lstrlenA (lpString="*.zip") returned 5 [0071.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP", pszSpec="*.rar") returned 0 [0071.214] lstrlenA (lpString="*.rar") returned 5 [0071.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP", pszSpec="*.7z") returned 0 [0071.214] lstrlenA (lpString="*.7z") returned 4 [0071.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP", pszSpec="*.tar") returned 0 [0071.214] lstrlenA (lpString="*.tar") returned 5 [0071.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP", pszSpec="*.gzip") returned 0 [0071.214] lstrlenA (lpString="*.gzip") returned 6 [0071.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP", pszSpec="*.jpg") returned 0 [0071.215] lstrlenA (lpString="*.jpg") returned 5 [0071.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP", pszSpec="*.jpeg") returned 0 [0071.215] lstrlenA (lpString="*.jpeg") returned 6 [0071.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP", pszSpec="*.psd") returned 0 [0071.215] lstrlenA (lpString="*.psd") returned 5 [0071.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP", pszSpec="*.cdr") returned 0 [0071.215] lstrlenA (lpString="*.cdr") returned 5 [0071.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP", pszSpec="*.dwg") returned 0 [0071.215] lstrlenA (lpString="*.dwg") returned 5 [0071.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP", pszSpec="*.max") returned 0 [0071.215] lstrlenA (lpString="*.max") returned 5 [0071.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP", pszSpec="*.bmp") returned 1 [0071.215] lstrlenA (lpString="*.bmp") returned 5 [0071.215] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" [0071.215] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" [0071.215] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP." [0071.215] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.BD" [0071.215] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.215] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8 [0071.215] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca7ffbf0, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.215] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.215] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7d5c, lpOverlapped=0x0) returned 1 [0071.217] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP") returned="PH01562U.BMP" [0071.218] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.218] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7d5c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7d5c, lpOverlapped=0x0) returned 1 [0071.218] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.218] CloseHandle (hObject=0x1cc) returned 1 [0071.220] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp.bd")) returned 1 [0071.221] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca805da3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01607U.BMP", cAlternateFileName="")) returned 1 [0071.272] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.272] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH01607U.BMP") returned -1 [0071.272] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH01607U.BMP") returned -1 [0071.272] lstrcmpiA (lpString1="", lpString2="PH01607U.BMP") returned -1 [0071.272] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP") returned="PH01562U.BMP" [0071.272] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.272] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.272] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.272] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.272] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH01607U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" [0071.272] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP", pszSpec="*.zip") returned 0 [0071.272] lstrlenA (lpString="*.zip") returned 5 [0071.272] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP", pszSpec="*.rar") returned 0 [0071.272] lstrlenA (lpString="*.rar") returned 5 [0071.272] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP", pszSpec="*.7z") returned 0 [0071.272] lstrlenA (lpString="*.7z") returned 4 [0071.272] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP", pszSpec="*.tar") returned 0 [0071.272] lstrlenA (lpString="*.tar") returned 5 [0071.272] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP", pszSpec="*.gzip") returned 0 [0071.272] lstrlenA (lpString="*.gzip") returned 6 [0071.272] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP", pszSpec="*.jpg") returned 0 [0071.272] lstrlenA (lpString="*.jpg") returned 5 [0071.272] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP", pszSpec="*.jpeg") returned 0 [0071.272] lstrlenA (lpString="*.jpeg") returned 6 [0071.272] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP", pszSpec="*.psd") returned 0 [0071.272] lstrlenA (lpString="*.psd") returned 5 [0071.272] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP", pszSpec="*.cdr") returned 0 [0071.273] lstrlenA (lpString="*.cdr") returned 5 [0071.273] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP", pszSpec="*.dwg") returned 0 [0071.273] lstrlenA (lpString="*.dwg") returned 5 [0071.273] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP", pszSpec="*.max") returned 0 [0071.273] lstrlenA (lpString="*.max") returned 5 [0071.273] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP", pszSpec="*.bmp") returned 1 [0071.273] lstrlenA (lpString="*.bmp") returned 5 [0071.273] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" [0071.273] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" [0071.273] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP." [0071.273] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.BD" [0071.273] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.274] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce0 [0071.274] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca805da3, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.274] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.274] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7c84, lpOverlapped=0x0) returned 1 [0071.276] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP") returned="PH01607U.BMP" [0071.277] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.277] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7c84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7c84, lpOverlapped=0x0) returned 1 [0071.277] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.277] CloseHandle (hObject=0x1cc) returned 1 [0071.279] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp.bd")) returned 1 [0071.280] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca80d2aa, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x9abe, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01931J.JPG", cAlternateFileName="")) returned 1 [0071.281] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.281] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH01931J.JPG") returned -1 [0071.281] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH01931J.JPG") returned -1 [0071.281] lstrcmpiA (lpString1="", lpString2="PH01931J.JPG") returned -1 [0071.281] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP") returned="PH01607U.BMP" [0071.281] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.281] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.281] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.281] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.281] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH01931J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" [0071.281] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG", pszSpec="*.zip") returned 0 [0071.281] lstrlenA (lpString="*.zip") returned 5 [0071.282] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG", pszSpec="*.rar") returned 0 [0071.282] lstrlenA (lpString="*.rar") returned 5 [0071.282] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG", pszSpec="*.7z") returned 0 [0071.282] lstrlenA (lpString="*.7z") returned 4 [0071.282] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG", pszSpec="*.tar") returned 0 [0071.282] lstrlenA (lpString="*.tar") returned 5 [0071.282] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG", pszSpec="*.gzip") returned 0 [0071.282] lstrlenA (lpString="*.gzip") returned 6 [0071.282] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG", pszSpec="*.jpg") returned 1 [0071.282] lstrlenA (lpString="*.jpg") returned 5 [0071.282] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" [0071.282] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" [0071.282] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG." [0071.282] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.BD" [0071.282] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.283] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9abe [0071.283] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca80d2aa, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.283] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.283] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x9a62, lpOverlapped=0x0) returned 1 [0071.288] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG") returned="PH01931J.JPG" [0071.291] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.291] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x9a62, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x9a62, lpOverlapped=0x0) returned 1 [0071.291] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.292] CloseHandle (hObject=0x1cc) returned 1 [0071.294] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg.bd")) returned 1 [0071.295] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca813472, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x451e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02028K.JPG", cAlternateFileName="")) returned 1 [0071.295] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.295] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02028K.JPG") returned -1 [0071.295] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02028K.JPG") returned -1 [0071.295] lstrcmpiA (lpString1="", lpString2="PH02028K.JPG") returned -1 [0071.295] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG") returned="PH01931J.JPG" [0071.295] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.295] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.295] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.295] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.295] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02028K.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" [0071.295] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG", pszSpec="*.zip") returned 0 [0071.295] lstrlenA (lpString="*.zip") returned 5 [0071.295] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG", pszSpec="*.rar") returned 0 [0071.295] lstrlenA (lpString="*.rar") returned 5 [0071.295] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG", pszSpec="*.7z") returned 0 [0071.295] lstrlenA (lpString="*.7z") returned 4 [0071.295] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG", pszSpec="*.tar") returned 0 [0071.295] lstrlenA (lpString="*.tar") returned 5 [0071.296] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG", pszSpec="*.gzip") returned 0 [0071.296] lstrlenA (lpString="*.gzip") returned 6 [0071.296] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG", pszSpec="*.jpg") returned 1 [0071.296] lstrlenA (lpString="*.jpg") returned 5 [0071.296] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" [0071.296] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" [0071.296] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG." [0071.296] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.BD" [0071.296] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.296] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x451e [0071.296] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca813472, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.296] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.296] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x44c2, lpOverlapped=0x0) returned 1 [0071.298] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG") returned="PH02028K.JPG" [0071.298] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.298] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x44c2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x44c2, lpOverlapped=0x0) returned 1 [0071.298] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.298] CloseHandle (hObject=0x1cc) returned 1 [0071.300] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg.bd")) returned 1 [0071.301] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca818293, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02039U.BMP", cAlternateFileName="")) returned 1 [0071.301] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.301] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02039U.BMP") returned -1 [0071.301] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02039U.BMP") returned -1 [0071.301] lstrcmpiA (lpString1="", lpString2="PH02039U.BMP") returned -1 [0071.301] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG") returned="PH02028K.JPG" [0071.301] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.301] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.301] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.301] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.301] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02039U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" [0071.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP", pszSpec="*.zip") returned 0 [0071.301] lstrlenA (lpString="*.zip") returned 5 [0071.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP", pszSpec="*.rar") returned 0 [0071.301] lstrlenA (lpString="*.rar") returned 5 [0071.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP", pszSpec="*.7z") returned 0 [0071.301] lstrlenA (lpString="*.7z") returned 4 [0071.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP", pszSpec="*.tar") returned 0 [0071.301] lstrlenA (lpString="*.tar") returned 5 [0071.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP", pszSpec="*.gzip") returned 0 [0071.301] lstrlenA (lpString="*.gzip") returned 6 [0071.302] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP", pszSpec="*.jpg") returned 0 [0071.302] lstrlenA (lpString="*.jpg") returned 5 [0071.302] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP", pszSpec="*.jpeg") returned 0 [0071.302] lstrlenA (lpString="*.jpeg") returned 6 [0071.302] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP", pszSpec="*.psd") returned 0 [0071.302] lstrlenA (lpString="*.psd") returned 5 [0071.302] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP", pszSpec="*.cdr") returned 0 [0071.302] lstrlenA (lpString="*.cdr") returned 5 [0071.302] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP", pszSpec="*.dwg") returned 0 [0071.302] lstrlenA (lpString="*.dwg") returned 5 [0071.302] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP", pszSpec="*.max") returned 0 [0071.302] lstrlenA (lpString="*.max") returned 5 [0071.302] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP", pszSpec="*.bmp") returned 1 [0071.302] lstrlenA (lpString="*.bmp") returned 5 [0071.302] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" [0071.302] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" [0071.302] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP." [0071.302] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.BD" [0071.302] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.302] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce0 [0071.302] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca818293, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.302] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.302] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7c84, lpOverlapped=0x0) returned 1 [0071.304] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP") returned="PH02039U.BMP" [0071.305] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.305] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7c84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7c84, lpOverlapped=0x0) returned 1 [0071.305] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.305] CloseHandle (hObject=0x1cc) returned 1 [0071.307] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp.bd")) returned 1 [0071.308] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca81f7cc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02040U.BMP", cAlternateFileName="")) returned 1 [0071.308] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.308] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02040U.BMP") returned -1 [0071.308] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02040U.BMP") returned -1 [0071.308] lstrcmpiA (lpString1="", lpString2="PH02040U.BMP") returned -1 [0071.308] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP") returned="PH02039U.BMP" [0071.308] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.308] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.308] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.308] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.308] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02040U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" [0071.308] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP", pszSpec="*.zip") returned 0 [0071.308] lstrlenA (lpString="*.zip") returned 5 [0071.308] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP", pszSpec="*.rar") returned 0 [0071.308] lstrlenA (lpString="*.rar") returned 5 [0071.308] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP", pszSpec="*.7z") returned 0 [0071.309] lstrlenA (lpString="*.7z") returned 4 [0071.309] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP", pszSpec="*.tar") returned 0 [0071.309] lstrlenA (lpString="*.tar") returned 5 [0071.309] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP", pszSpec="*.gzip") returned 0 [0071.309] lstrlenA (lpString="*.gzip") returned 6 [0071.309] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP", pszSpec="*.jpg") returned 0 [0071.309] lstrlenA (lpString="*.jpg") returned 5 [0071.309] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP", pszSpec="*.jpeg") returned 0 [0071.309] lstrlenA (lpString="*.jpeg") returned 6 [0071.309] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP", pszSpec="*.psd") returned 0 [0071.309] lstrlenA (lpString="*.psd") returned 5 [0071.309] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP", pszSpec="*.cdr") returned 0 [0071.309] lstrlenA (lpString="*.cdr") returned 5 [0071.309] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP", pszSpec="*.dwg") returned 0 [0071.309] lstrlenA (lpString="*.dwg") returned 5 [0071.309] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP", pszSpec="*.max") returned 0 [0071.309] lstrlenA (lpString="*.max") returned 5 [0071.309] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP", pszSpec="*.bmp") returned 1 [0071.309] lstrlenA (lpString="*.bmp") returned 5 [0071.309] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" [0071.309] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" [0071.309] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP." [0071.309] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.BD" [0071.309] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.322] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8 [0071.322] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca81f7cc, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.322] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.322] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7d5c, lpOverlapped=0x0) returned 1 [0071.324] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP") returned="PH02040U.BMP" [0071.325] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.325] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7d5c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7d5c, lpOverlapped=0x0) returned 1 [0071.325] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.326] CloseHandle (hObject=0x1cc) returned 1 [0071.328] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp.bd")) returned 1 [0071.328] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8523687, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6afc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02053J.JPG", cAlternateFileName="")) returned 1 [0071.328] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.328] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02053J.JPG") returned -1 [0071.328] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02053J.JPG") returned -1 [0071.328] lstrcmpiA (lpString1="", lpString2="PH02053J.JPG") returned -1 [0071.328] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP") returned="PH02040U.BMP" [0071.329] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.329] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.329] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.329] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.329] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02053J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" [0071.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG", pszSpec="*.zip") returned 0 [0071.329] lstrlenA (lpString="*.zip") returned 5 [0071.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG", pszSpec="*.rar") returned 0 [0071.329] lstrlenA (lpString="*.rar") returned 5 [0071.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG", pszSpec="*.7z") returned 0 [0071.329] lstrlenA (lpString="*.7z") returned 4 [0071.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG", pszSpec="*.tar") returned 0 [0071.329] lstrlenA (lpString="*.tar") returned 5 [0071.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG", pszSpec="*.gzip") returned 0 [0071.329] lstrlenA (lpString="*.gzip") returned 6 [0071.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG", pszSpec="*.jpg") returned 1 [0071.329] lstrlenA (lpString="*.jpg") returned 5 [0071.329] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" [0071.329] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" [0071.329] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG." [0071.329] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.BD" [0071.329] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.330] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6afc [0071.330] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb8523687, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.330] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.330] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x6aa0, lpOverlapped=0x0) returned 1 [0071.379] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG") returned="PH02053J.JPG" [0071.379] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.380] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x6aa0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x6aa0, lpOverlapped=0x0) returned 1 [0071.380] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.380] CloseHandle (hObject=0x1cc) returned 1 [0071.382] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg.bd")) returned 1 [0071.382] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca825970, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02058U.BMP", cAlternateFileName="")) returned 1 [0071.382] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.383] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02058U.BMP") returned -1 [0071.383] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02058U.BMP") returned -1 [0071.383] lstrcmpiA (lpString1="", lpString2="PH02058U.BMP") returned -1 [0071.383] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG") returned="PH02053J.JPG" [0071.383] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.383] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.383] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.383] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.383] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02058U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" [0071.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP", pszSpec="*.zip") returned 0 [0071.383] lstrlenA (lpString="*.zip") returned 5 [0071.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP", pszSpec="*.rar") returned 0 [0071.383] lstrlenA (lpString="*.rar") returned 5 [0071.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP", pszSpec="*.7z") returned 0 [0071.383] lstrlenA (lpString="*.7z") returned 4 [0071.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP", pszSpec="*.tar") returned 0 [0071.383] lstrlenA (lpString="*.tar") returned 5 [0071.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP", pszSpec="*.gzip") returned 0 [0071.383] lstrlenA (lpString="*.gzip") returned 6 [0071.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP", pszSpec="*.jpg") returned 0 [0071.383] lstrlenA (lpString="*.jpg") returned 5 [0071.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP", pszSpec="*.jpeg") returned 0 [0071.383] lstrlenA (lpString="*.jpeg") returned 6 [0071.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP", pszSpec="*.psd") returned 0 [0071.383] lstrlenA (lpString="*.psd") returned 5 [0071.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP", pszSpec="*.cdr") returned 0 [0071.384] lstrlenA (lpString="*.cdr") returned 5 [0071.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP", pszSpec="*.dwg") returned 0 [0071.384] lstrlenA (lpString="*.dwg") returned 5 [0071.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP", pszSpec="*.max") returned 0 [0071.384] lstrlenA (lpString="*.max") returned 5 [0071.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP", pszSpec="*.bmp") returned 1 [0071.384] lstrlenA (lpString="*.bmp") returned 5 [0071.384] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" [0071.384] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" [0071.384] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP." [0071.384] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.BD" [0071.384] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.384] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce0 [0071.384] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca825970, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.384] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.385] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7c84, lpOverlapped=0x0) returned 1 [0071.387] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP") returned="PH02058U.BMP" [0071.388] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.388] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7c84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7c84, lpOverlapped=0x0) returned 1 [0071.388] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.400] CloseHandle (hObject=0x1cc) returned 1 [0071.402] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp.bd")) returned 1 [0071.404] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85284a5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02062U.BMP", cAlternateFileName="")) returned 1 [0071.404] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.404] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02062U.BMP") returned -1 [0071.404] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02062U.BMP") returned -1 [0071.404] lstrcmpiA (lpString1="", lpString2="PH02062U.BMP") returned -1 [0071.404] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP") returned="PH02058U.BMP" [0071.404] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.404] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.404] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.405] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.405] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02062U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" [0071.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP", pszSpec="*.zip") returned 0 [0071.405] lstrlenA (lpString="*.zip") returned 5 [0071.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP", pszSpec="*.rar") returned 0 [0071.405] lstrlenA (lpString="*.rar") returned 5 [0071.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP", pszSpec="*.7z") returned 0 [0071.405] lstrlenA (lpString="*.7z") returned 4 [0071.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP", pszSpec="*.tar") returned 0 [0071.405] lstrlenA (lpString="*.tar") returned 5 [0071.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP", pszSpec="*.gzip") returned 0 [0071.405] lstrlenA (lpString="*.gzip") returned 6 [0071.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP", pszSpec="*.jpg") returned 0 [0071.406] lstrlenA (lpString="*.jpg") returned 5 [0071.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP", pszSpec="*.jpeg") returned 0 [0071.406] lstrlenA (lpString="*.jpeg") returned 6 [0071.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP", pszSpec="*.psd") returned 0 [0071.406] lstrlenA (lpString="*.psd") returned 5 [0071.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP", pszSpec="*.cdr") returned 0 [0071.406] lstrlenA (lpString="*.cdr") returned 5 [0071.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP", pszSpec="*.dwg") returned 0 [0071.406] lstrlenA (lpString="*.dwg") returned 5 [0071.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP", pszSpec="*.max") returned 0 [0071.406] lstrlenA (lpString="*.max") returned 5 [0071.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP", pszSpec="*.bmp") returned 1 [0071.407] lstrlenA (lpString="*.bmp") returned 5 [0071.407] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" [0071.407] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" [0071.407] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP." [0071.407] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.BD" [0071.407] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.408] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce0 [0071.408] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb85284a5, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.408] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.408] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7c84, lpOverlapped=0x0) returned 1 [0071.413] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP") returned="PH02062U.BMP" [0071.414] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.414] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7c84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7c84, lpOverlapped=0x0) returned 1 [0071.414] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.414] CloseHandle (hObject=0x1cc) returned 1 [0071.448] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp.bd")) returned 1 [0071.449] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb852f9c7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7297, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02069J.JPG", cAlternateFileName="")) returned 1 [0071.449] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.449] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02069J.JPG") returned -1 [0071.449] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02069J.JPG") returned -1 [0071.449] lstrcmpiA (lpString1="", lpString2="PH02069J.JPG") returned -1 [0071.449] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP") returned="PH02062U.BMP" [0071.449] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.449] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.449] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.449] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.449] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02069J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" [0071.449] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG", pszSpec="*.zip") returned 0 [0071.449] lstrlenA (lpString="*.zip") returned 5 [0071.449] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG", pszSpec="*.rar") returned 0 [0071.449] lstrlenA (lpString="*.rar") returned 5 [0071.449] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG", pszSpec="*.7z") returned 0 [0071.449] lstrlenA (lpString="*.7z") returned 4 [0071.449] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG", pszSpec="*.tar") returned 0 [0071.449] lstrlenA (lpString="*.tar") returned 5 [0071.449] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG", pszSpec="*.gzip") returned 0 [0071.449] lstrlenA (lpString="*.gzip") returned 6 [0071.449] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG", pszSpec="*.jpg") returned 1 [0071.450] lstrlenA (lpString="*.jpg") returned 5 [0071.450] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" [0071.450] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" [0071.450] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG." [0071.450] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.BD" [0071.450] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.450] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7297 [0071.450] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb852f9c7, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.450] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.450] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x723b, lpOverlapped=0x0) returned 1 [0071.452] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG") returned="PH02069J.JPG" [0071.453] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.453] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x723b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x723b, lpOverlapped=0x0) returned 1 [0071.454] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.454] CloseHandle (hObject=0x1cc) returned 1 [0071.455] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg.bd")) returned 1 [0071.456] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca82a788, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02071U.BMP", cAlternateFileName="")) returned 1 [0071.456] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.456] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02071U.BMP") returned -1 [0071.457] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02071U.BMP") returned -1 [0071.457] lstrcmpiA (lpString1="", lpString2="PH02071U.BMP") returned -1 [0071.457] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG") returned="PH02069J.JPG" [0071.457] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.457] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.457] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.457] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.457] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02071U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" [0071.457] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP", pszSpec="*.zip") returned 0 [0071.457] lstrlenA (lpString="*.zip") returned 5 [0071.457] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP", pszSpec="*.rar") returned 0 [0071.457] lstrlenA (lpString="*.rar") returned 5 [0071.457] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP", pszSpec="*.7z") returned 0 [0071.457] lstrlenA (lpString="*.7z") returned 4 [0071.457] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP", pszSpec="*.tar") returned 0 [0071.457] lstrlenA (lpString="*.tar") returned 5 [0071.457] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP", pszSpec="*.gzip") returned 0 [0071.457] lstrlenA (lpString="*.gzip") returned 6 [0071.457] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP", pszSpec="*.jpg") returned 0 [0071.457] lstrlenA (lpString="*.jpg") returned 5 [0071.457] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP", pszSpec="*.jpeg") returned 0 [0071.457] lstrlenA (lpString="*.jpeg") returned 6 [0071.458] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP", pszSpec="*.psd") returned 0 [0071.458] lstrlenA (lpString="*.psd") returned 5 [0071.458] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP", pszSpec="*.cdr") returned 0 [0071.458] lstrlenA (lpString="*.cdr") returned 5 [0071.458] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP", pszSpec="*.dwg") returned 0 [0071.458] lstrlenA (lpString="*.dwg") returned 5 [0071.458] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP", pszSpec="*.max") returned 0 [0071.458] lstrlenA (lpString="*.max") returned 5 [0071.458] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP", pszSpec="*.bmp") returned 1 [0071.458] lstrlenA (lpString="*.bmp") returned 5 [0071.458] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" [0071.458] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" [0071.458] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP." [0071.458] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.BD" [0071.458] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.458] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8 [0071.458] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca82a788, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.459] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.459] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7d5c, lpOverlapped=0x0) returned 1 [0071.461] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP") returned="PH02071U.BMP" [0071.463] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.463] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7d5c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7d5c, lpOverlapped=0x0) returned 1 [0071.463] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.463] CloseHandle (hObject=0x1cc) returned 1 [0071.465] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp.bd")) returned 1 [0071.465] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca830937, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02074U.BMP", cAlternateFileName="")) returned 1 [0071.466] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.466] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02074U.BMP") returned -1 [0071.466] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02074U.BMP") returned -1 [0071.466] lstrcmpiA (lpString1="", lpString2="PH02074U.BMP") returned -1 [0071.466] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP") returned="PH02071U.BMP" [0071.466] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.466] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.466] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.466] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.466] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02074U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" [0071.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP", pszSpec="*.zip") returned 0 [0071.466] lstrlenA (lpString="*.zip") returned 5 [0071.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP", pszSpec="*.rar") returned 0 [0071.466] lstrlenA (lpString="*.rar") returned 5 [0071.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP", pszSpec="*.7z") returned 0 [0071.466] lstrlenA (lpString="*.7z") returned 4 [0071.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP", pszSpec="*.tar") returned 0 [0071.466] lstrlenA (lpString="*.tar") returned 5 [0071.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP", pszSpec="*.gzip") returned 0 [0071.466] lstrlenA (lpString="*.gzip") returned 6 [0071.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP", pszSpec="*.jpg") returned 0 [0071.466] lstrlenA (lpString="*.jpg") returned 5 [0071.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP", pszSpec="*.jpeg") returned 0 [0071.466] lstrlenA (lpString="*.jpeg") returned 6 [0071.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP", pszSpec="*.psd") returned 0 [0071.466] lstrlenA (lpString="*.psd") returned 5 [0071.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP", pszSpec="*.cdr") returned 0 [0071.466] lstrlenA (lpString="*.cdr") returned 5 [0071.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP", pszSpec="*.dwg") returned 0 [0071.466] lstrlenA (lpString="*.dwg") returned 5 [0071.467] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP", pszSpec="*.max") returned 0 [0071.467] lstrlenA (lpString="*.max") returned 5 [0071.467] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP", pszSpec="*.bmp") returned 1 [0071.467] lstrlenA (lpString="*.bmp") returned 5 [0071.467] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" [0071.467] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" [0071.467] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP." [0071.467] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.BD" [0071.467] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.467] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce0 [0071.467] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca830937, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.467] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.467] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7c84, lpOverlapped=0x0) returned 1 [0071.469] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP") returned="PH02074U.BMP" [0071.470] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.470] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7c84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7c84, lpOverlapped=0x0) returned 1 [0071.470] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.470] CloseHandle (hObject=0x1cc) returned 1 [0071.472] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp.bd")) returned 1 [0071.473] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8538268, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02208U.BMP", cAlternateFileName="")) returned 1 [0071.473] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.473] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02208U.BMP") returned -1 [0071.473] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02208U.BMP") returned -1 [0071.473] lstrcmpiA (lpString1="", lpString2="PH02208U.BMP") returned -1 [0071.473] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP") returned="PH02074U.BMP" [0071.473] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.473] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.473] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.473] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.473] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02208U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" [0071.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP", pszSpec="*.zip") returned 0 [0071.473] lstrlenA (lpString="*.zip") returned 5 [0071.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP", pszSpec="*.rar") returned 0 [0071.473] lstrlenA (lpString="*.rar") returned 5 [0071.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP", pszSpec="*.7z") returned 0 [0071.473] lstrlenA (lpString="*.7z") returned 4 [0071.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP", pszSpec="*.tar") returned 0 [0071.473] lstrlenA (lpString="*.tar") returned 5 [0071.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP", pszSpec="*.gzip") returned 0 [0071.473] lstrlenA (lpString="*.gzip") returned 6 [0071.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP", pszSpec="*.jpg") returned 0 [0071.473] lstrlenA (lpString="*.jpg") returned 5 [0071.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP", pszSpec="*.jpeg") returned 0 [0071.473] lstrlenA (lpString="*.jpeg") returned 6 [0071.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP", pszSpec="*.psd") returned 0 [0071.473] lstrlenA (lpString="*.psd") returned 5 [0071.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP", pszSpec="*.cdr") returned 0 [0071.474] lstrlenA (lpString="*.cdr") returned 5 [0071.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP", pszSpec="*.dwg") returned 0 [0071.474] lstrlenA (lpString="*.dwg") returned 5 [0071.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP", pszSpec="*.max") returned 0 [0071.474] lstrlenA (lpString="*.max") returned 5 [0071.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP", pszSpec="*.bmp") returned 1 [0071.474] lstrlenA (lpString="*.bmp") returned 5 [0071.474] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" [0071.474] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" [0071.474] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP." [0071.474] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.BD" [0071.474] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.516] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce0 [0071.516] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb8538268, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.516] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.516] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7c84, lpOverlapped=0x0) returned 1 [0071.518] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP") returned="PH02208U.BMP" [0071.519] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.519] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7c84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7c84, lpOverlapped=0x0) returned 1 [0071.520] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.520] CloseHandle (hObject=0x1cc) returned 1 [0071.522] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp.bd")) returned 1 [0071.523] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb853e502, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02223U.BMP", cAlternateFileName="")) returned 1 [0071.523] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.523] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02223U.BMP") returned -1 [0071.523] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02223U.BMP") returned -1 [0071.523] lstrcmpiA (lpString1="", lpString2="PH02223U.BMP") returned -1 [0071.523] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP") returned="PH02208U.BMP" [0071.523] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.523] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.523] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.523] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.523] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02223U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" [0071.523] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP", pszSpec="*.zip") returned 0 [0071.523] lstrlenA (lpString="*.zip") returned 5 [0071.523] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP", pszSpec="*.rar") returned 0 [0071.523] lstrlenA (lpString="*.rar") returned 5 [0071.524] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP", pszSpec="*.7z") returned 0 [0071.524] lstrlenA (lpString="*.7z") returned 4 [0071.524] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP", pszSpec="*.tar") returned 0 [0071.524] lstrlenA (lpString="*.tar") returned 5 [0071.524] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP", pszSpec="*.gzip") returned 0 [0071.524] lstrlenA (lpString="*.gzip") returned 6 [0071.524] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP", pszSpec="*.jpg") returned 0 [0071.524] lstrlenA (lpString="*.jpg") returned 5 [0071.524] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP", pszSpec="*.jpeg") returned 0 [0071.524] lstrlenA (lpString="*.jpeg") returned 6 [0071.524] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP", pszSpec="*.psd") returned 0 [0071.524] lstrlenA (lpString="*.psd") returned 5 [0071.524] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP", pszSpec="*.cdr") returned 0 [0071.524] lstrlenA (lpString="*.cdr") returned 5 [0071.524] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP", pszSpec="*.dwg") returned 0 [0071.524] lstrlenA (lpString="*.dwg") returned 5 [0071.524] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP", pszSpec="*.max") returned 0 [0071.524] lstrlenA (lpString="*.max") returned 5 [0071.524] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP", pszSpec="*.bmp") returned 1 [0071.524] lstrlenA (lpString="*.bmp") returned 5 [0071.525] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" [0071.525] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" [0071.525] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP." [0071.525] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.BD" [0071.525] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.525] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8 [0071.525] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb853e502, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.525] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.525] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7d5c, lpOverlapped=0x0) returned 1 [0071.527] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP") returned="PH02223U.BMP" [0071.528] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.528] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7d5c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7d5c, lpOverlapped=0x0) returned 1 [0071.528] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.528] CloseHandle (hObject=0x1cc) returned 1 [0071.530] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp.bd")) returned 1 [0071.530] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8543257, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02291U.BMP", cAlternateFileName="")) returned 1 [0071.530] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.530] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02291U.BMP") returned -1 [0071.530] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02291U.BMP") returned -1 [0071.530] lstrcmpiA (lpString1="", lpString2="PH02291U.BMP") returned -1 [0071.531] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP") returned="PH02223U.BMP" [0071.531] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.531] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.531] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.531] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.531] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02291U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" [0071.531] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP", pszSpec="*.zip") returned 0 [0071.531] lstrlenA (lpString="*.zip") returned 5 [0071.531] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP", pszSpec="*.rar") returned 0 [0071.531] lstrlenA (lpString="*.rar") returned 5 [0071.531] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP", pszSpec="*.7z") returned 0 [0071.531] lstrlenA (lpString="*.7z") returned 4 [0071.531] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP", pszSpec="*.tar") returned 0 [0071.531] lstrlenA (lpString="*.tar") returned 5 [0071.531] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP", pszSpec="*.gzip") returned 0 [0071.531] lstrlenA (lpString="*.gzip") returned 6 [0071.531] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP", pszSpec="*.jpg") returned 0 [0071.531] lstrlenA (lpString="*.jpg") returned 5 [0071.531] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP", pszSpec="*.jpeg") returned 0 [0071.531] lstrlenA (lpString="*.jpeg") returned 6 [0071.531] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP", pszSpec="*.psd") returned 0 [0071.531] lstrlenA (lpString="*.psd") returned 5 [0071.531] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP", pszSpec="*.cdr") returned 0 [0071.531] lstrlenA (lpString="*.cdr") returned 5 [0071.531] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP", pszSpec="*.dwg") returned 0 [0071.531] lstrlenA (lpString="*.dwg") returned 5 [0071.531] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP", pszSpec="*.max") returned 0 [0071.531] lstrlenA (lpString="*.max") returned 5 [0071.531] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP", pszSpec="*.bmp") returned 1 [0071.531] lstrlenA (lpString="*.bmp") returned 5 [0071.531] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" [0071.531] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" [0071.532] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP." [0071.532] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.BD" [0071.532] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.532] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8 [0071.532] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb8543257, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.532] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.532] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7d5c, lpOverlapped=0x0) returned 1 [0071.534] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP") returned="PH02291U.BMP" [0071.534] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.535] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7d5c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7d5c, lpOverlapped=0x0) returned 1 [0071.535] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.535] CloseHandle (hObject=0x1cc) returned 1 [0071.537] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp.bd")) returned 1 [0071.538] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca837eb8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02398U.BMP", cAlternateFileName="")) returned 1 [0071.539] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.539] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02398U.BMP") returned -1 [0071.539] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02398U.BMP") returned -1 [0071.539] lstrcmpiA (lpString1="", lpString2="PH02398U.BMP") returned -1 [0071.539] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP") returned="PH02291U.BMP" [0071.539] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.539] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.539] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.539] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.539] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02398U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" [0071.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP", pszSpec="*.zip") returned 0 [0071.539] lstrlenA (lpString="*.zip") returned 5 [0071.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP", pszSpec="*.rar") returned 0 [0071.539] lstrlenA (lpString="*.rar") returned 5 [0071.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP", pszSpec="*.7z") returned 0 [0071.540] lstrlenA (lpString="*.7z") returned 4 [0071.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP", pszSpec="*.tar") returned 0 [0071.540] lstrlenA (lpString="*.tar") returned 5 [0071.552] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP", pszSpec="*.gzip") returned 0 [0071.552] lstrlenA (lpString="*.gzip") returned 6 [0071.552] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP", pszSpec="*.jpg") returned 0 [0071.552] lstrlenA (lpString="*.jpg") returned 5 [0071.552] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP", pszSpec="*.jpeg") returned 0 [0071.553] lstrlenA (lpString="*.jpeg") returned 6 [0071.553] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP", pszSpec="*.psd") returned 0 [0071.553] lstrlenA (lpString="*.psd") returned 5 [0071.553] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP", pszSpec="*.cdr") returned 0 [0071.553] lstrlenA (lpString="*.cdr") returned 5 [0071.553] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP", pszSpec="*.dwg") returned 0 [0071.553] lstrlenA (lpString="*.dwg") returned 5 [0071.553] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP", pszSpec="*.max") returned 0 [0071.553] lstrlenA (lpString="*.max") returned 5 [0071.553] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP", pszSpec="*.bmp") returned 1 [0071.553] lstrlenA (lpString="*.bmp") returned 5 [0071.553] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" [0071.553] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" [0071.553] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP." [0071.553] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.BD" [0071.553] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.554] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce0 [0071.555] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca837eb8, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.555] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.555] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7c84, lpOverlapped=0x0) returned 1 [0071.557] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP") returned="PH02398U.BMP" [0071.557] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.557] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7c84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7c84, lpOverlapped=0x0) returned 1 [0071.558] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.558] CloseHandle (hObject=0x1cc) returned 1 [0071.559] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp.bd")) returned 1 [0071.560] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca83e02d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xdd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02412K.JPG", cAlternateFileName="")) returned 1 [0071.560] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.560] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02412K.JPG") returned -1 [0071.560] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02412K.JPG") returned -1 [0071.560] lstrcmpiA (lpString1="", lpString2="PH02412K.JPG") returned -1 [0071.560] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP") returned="PH02398U.BMP" [0071.560] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.560] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.560] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.560] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.561] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02412K.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" [0071.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG", pszSpec="*.zip") returned 0 [0071.561] lstrlenA (lpString="*.zip") returned 5 [0071.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG", pszSpec="*.rar") returned 0 [0071.561] lstrlenA (lpString="*.rar") returned 5 [0071.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG", pszSpec="*.7z") returned 0 [0071.561] lstrlenA (lpString="*.7z") returned 4 [0071.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG", pszSpec="*.tar") returned 0 [0071.561] lstrlenA (lpString="*.tar") returned 5 [0071.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG", pszSpec="*.gzip") returned 0 [0071.561] lstrlenA (lpString="*.gzip") returned 6 [0071.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG", pszSpec="*.jpg") returned 1 [0071.561] lstrlenA (lpString="*.jpg") returned 5 [0071.561] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" [0071.561] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" [0071.561] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG." [0071.561] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.BD" [0071.561] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.561] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd5 [0071.562] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca83e02d, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.562] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.562] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xd79, lpOverlapped=0x0) returned 1 [0071.567] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG") returned="PH02412K.JPG" [0071.567] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.567] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xd79, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xd79, lpOverlapped=0x0) returned 1 [0071.567] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.567] CloseHandle (hObject=0x1cc) returned 1 [0071.568] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg.bd")) returned 1 [0071.569] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8549589, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02417U.BMP", cAlternateFileName="")) returned 1 [0071.569] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.569] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02417U.BMP") returned -1 [0071.569] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02417U.BMP") returned -1 [0071.569] lstrcmpiA (lpString1="", lpString2="PH02417U.BMP") returned -1 [0071.569] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG") returned="PH02412K.JPG" [0071.569] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.569] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.569] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.569] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.570] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02417U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" [0071.570] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP", pszSpec="*.zip") returned 0 [0071.570] lstrlenA (lpString="*.zip") returned 5 [0071.570] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP", pszSpec="*.rar") returned 0 [0071.570] lstrlenA (lpString="*.rar") returned 5 [0071.570] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP", pszSpec="*.7z") returned 0 [0071.570] lstrlenA (lpString="*.7z") returned 4 [0071.570] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP", pszSpec="*.tar") returned 0 [0071.570] lstrlenA (lpString="*.tar") returned 5 [0071.570] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP", pszSpec="*.gzip") returned 0 [0071.570] lstrlenA (lpString="*.gzip") returned 6 [0071.570] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP", pszSpec="*.jpg") returned 0 [0071.570] lstrlenA (lpString="*.jpg") returned 5 [0071.570] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP", pszSpec="*.jpeg") returned 0 [0071.570] lstrlenA (lpString="*.jpeg") returned 6 [0071.570] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP", pszSpec="*.psd") returned 0 [0071.570] lstrlenA (lpString="*.psd") returned 5 [0071.570] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP", pszSpec="*.cdr") returned 0 [0071.570] lstrlenA (lpString="*.cdr") returned 5 [0071.570] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP", pszSpec="*.dwg") returned 0 [0071.570] lstrlenA (lpString="*.dwg") returned 5 [0071.570] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP", pszSpec="*.max") returned 0 [0071.570] lstrlenA (lpString="*.max") returned 5 [0071.570] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP", pszSpec="*.bmp") returned 1 [0071.570] lstrlenA (lpString="*.bmp") returned 5 [0071.570] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" [0071.570] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" [0071.571] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP." [0071.571] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.BD" [0071.571] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.571] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce0 [0071.571] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb8549589, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.571] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.571] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7c84, lpOverlapped=0x0) returned 1 [0071.573] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP") returned="PH02417U.BMP" [0071.574] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.574] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7c84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7c84, lpOverlapped=0x0) returned 1 [0071.574] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.574] CloseHandle (hObject=0x1cc) returned 1 [0071.576] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp.bd")) returned 1 [0071.576] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca844209, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02466U.BMP", cAlternateFileName="")) returned 1 [0071.576] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.576] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02466U.BMP") returned -1 [0071.576] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02466U.BMP") returned -1 [0071.576] lstrcmpiA (lpString1="", lpString2="PH02466U.BMP") returned -1 [0071.576] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP") returned="PH02417U.BMP" [0071.576] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.576] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.577] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.577] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.577] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02466U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" [0071.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP", pszSpec="*.zip") returned 0 [0071.577] lstrlenA (lpString="*.zip") returned 5 [0071.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP", pszSpec="*.rar") returned 0 [0071.577] lstrlenA (lpString="*.rar") returned 5 [0071.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP", pszSpec="*.7z") returned 0 [0071.577] lstrlenA (lpString="*.7z") returned 4 [0071.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP", pszSpec="*.tar") returned 0 [0071.577] lstrlenA (lpString="*.tar") returned 5 [0071.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP", pszSpec="*.gzip") returned 0 [0071.577] lstrlenA (lpString="*.gzip") returned 6 [0071.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP", pszSpec="*.jpg") returned 0 [0071.577] lstrlenA (lpString="*.jpg") returned 5 [0071.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP", pszSpec="*.jpeg") returned 0 [0071.577] lstrlenA (lpString="*.jpeg") returned 6 [0071.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP", pszSpec="*.psd") returned 0 [0071.577] lstrlenA (lpString="*.psd") returned 5 [0071.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP", pszSpec="*.cdr") returned 0 [0071.577] lstrlenA (lpString="*.cdr") returned 5 [0071.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP", pszSpec="*.dwg") returned 0 [0071.577] lstrlenA (lpString="*.dwg") returned 5 [0071.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP", pszSpec="*.max") returned 0 [0071.577] lstrlenA (lpString="*.max") returned 5 [0071.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP", pszSpec="*.bmp") returned 1 [0071.577] lstrlenA (lpString="*.bmp") returned 5 [0071.577] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" [0071.578] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" [0071.578] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP." [0071.578] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.BD" [0071.578] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.578] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7c08 [0071.578] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca844209, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.578] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.578] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7bac, lpOverlapped=0x0) returned 1 [0071.580] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP") returned="PH02466U.BMP" [0071.581] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.581] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7bac, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7bac, lpOverlapped=0x0) returned 1 [0071.581] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.581] CloseHandle (hObject=0x1cc) returned 1 [0071.583] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp.bd")) returned 1 [0071.583] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca848fb2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x48fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02470U.BMP", cAlternateFileName="")) returned 1 [0071.584] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.584] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02470U.BMP") returned -1 [0071.584] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02470U.BMP") returned -1 [0071.584] lstrcmpiA (lpString1="", lpString2="PH02470U.BMP") returned -1 [0071.584] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP") returned="PH02466U.BMP" [0071.584] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.584] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.584] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.584] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.584] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02470U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" [0071.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP", pszSpec="*.zip") returned 0 [0071.584] lstrlenA (lpString="*.zip") returned 5 [0071.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP", pszSpec="*.rar") returned 0 [0071.584] lstrlenA (lpString="*.rar") returned 5 [0071.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP", pszSpec="*.7z") returned 0 [0071.584] lstrlenA (lpString="*.7z") returned 4 [0071.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP", pszSpec="*.tar") returned 0 [0071.584] lstrlenA (lpString="*.tar") returned 5 [0071.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP", pszSpec="*.gzip") returned 0 [0071.584] lstrlenA (lpString="*.gzip") returned 6 [0071.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP", pszSpec="*.jpg") returned 0 [0071.584] lstrlenA (lpString="*.jpg") returned 5 [0071.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP", pszSpec="*.jpeg") returned 0 [0071.585] lstrlenA (lpString="*.jpeg") returned 6 [0071.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP", pszSpec="*.psd") returned 0 [0071.585] lstrlenA (lpString="*.psd") returned 5 [0071.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP", pszSpec="*.cdr") returned 0 [0071.585] lstrlenA (lpString="*.cdr") returned 5 [0071.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP", pszSpec="*.dwg") returned 0 [0071.585] lstrlenA (lpString="*.dwg") returned 5 [0071.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP", pszSpec="*.max") returned 0 [0071.585] lstrlenA (lpString="*.max") returned 5 [0071.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP", pszSpec="*.bmp") returned 1 [0071.585] lstrlenA (lpString="*.bmp") returned 5 [0071.585] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" [0071.585] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" [0071.585] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP." [0071.585] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.BD" [0071.585] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.585] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x48fc [0071.586] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca848fb2, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.586] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.586] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x48a0, lpOverlapped=0x0) returned 1 [0071.588] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP") returned="PH02470U.BMP" [0071.589] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.589] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x48a0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x48a0, lpOverlapped=0x0) returned 1 [0071.589] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.589] CloseHandle (hObject=0x1cc) returned 1 [0071.591] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp.bd")) returned 1 [0071.592] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb854f58b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02503U.BMP", cAlternateFileName="")) returned 1 [0071.592] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.592] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02503U.BMP") returned -1 [0071.592] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02503U.BMP") returned -1 [0071.592] lstrcmpiA (lpString1="", lpString2="PH02503U.BMP") returned -1 [0071.592] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP") returned="PH02470U.BMP" [0071.592] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.592] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.592] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.592] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.592] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02503U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" [0071.592] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP", pszSpec="*.zip") returned 0 [0071.592] lstrlenA (lpString="*.zip") returned 5 [0071.592] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP", pszSpec="*.rar") returned 0 [0071.592] lstrlenA (lpString="*.rar") returned 5 [0071.592] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP", pszSpec="*.7z") returned 0 [0071.592] lstrlenA (lpString="*.7z") returned 4 [0071.592] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP", pszSpec="*.tar") returned 0 [0071.592] lstrlenA (lpString="*.tar") returned 5 [0071.592] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP", pszSpec="*.gzip") returned 0 [0071.592] lstrlenA (lpString="*.gzip") returned 6 [0071.592] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP", pszSpec="*.jpg") returned 0 [0071.592] lstrlenA (lpString="*.jpg") returned 5 [0071.592] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP", pszSpec="*.jpeg") returned 0 [0071.593] lstrlenA (lpString="*.jpeg") returned 6 [0071.593] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP", pszSpec="*.psd") returned 0 [0071.593] lstrlenA (lpString="*.psd") returned 5 [0071.593] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP", pszSpec="*.cdr") returned 0 [0071.593] lstrlenA (lpString="*.cdr") returned 5 [0071.593] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP", pszSpec="*.dwg") returned 0 [0071.593] lstrlenA (lpString="*.dwg") returned 5 [0071.593] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP", pszSpec="*.max") returned 0 [0071.593] lstrlenA (lpString="*.max") returned 5 [0071.593] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP", pszSpec="*.bmp") returned 1 [0071.593] lstrlenA (lpString="*.bmp") returned 5 [0071.593] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" [0071.593] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" [0071.593] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP." [0071.593] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.BD" [0071.593] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.594] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce0 [0071.594] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb854f58b, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.594] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.594] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7c84, lpOverlapped=0x0) returned 1 [0071.597] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP") returned="PH02503U.BMP" [0071.598] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.598] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7c84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7c84, lpOverlapped=0x0) returned 1 [0071.598] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.598] CloseHandle (hObject=0x1cc) returned 1 [0071.600] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp.bd")) returned 1 [0071.601] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca84f195, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8499, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02567J.JPG", cAlternateFileName="")) returned 1 [0071.601] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.601] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02567J.JPG") returned -1 [0071.601] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02567J.JPG") returned -1 [0071.601] lstrcmpiA (lpString1="", lpString2="PH02567J.JPG") returned -1 [0071.601] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP") returned="PH02503U.BMP" [0071.601] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.601] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.601] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.601] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.601] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02567J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" [0071.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG", pszSpec="*.zip") returned 0 [0071.601] lstrlenA (lpString="*.zip") returned 5 [0071.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG", pszSpec="*.rar") returned 0 [0071.601] lstrlenA (lpString="*.rar") returned 5 [0071.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG", pszSpec="*.7z") returned 0 [0071.601] lstrlenA (lpString="*.7z") returned 4 [0071.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG", pszSpec="*.tar") returned 0 [0071.601] lstrlenA (lpString="*.tar") returned 5 [0071.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG", pszSpec="*.gzip") returned 0 [0071.601] lstrlenA (lpString="*.gzip") returned 6 [0071.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG", pszSpec="*.jpg") returned 1 [0071.601] lstrlenA (lpString="*.jpg") returned 5 [0071.601] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" [0071.601] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" [0071.601] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG." [0071.601] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.BD" [0071.601] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.603] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8499 [0071.603] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca84f195, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.603] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.603] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x843d, lpOverlapped=0x0) returned 1 [0071.605] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG") returned="PH02567J.JPG" [0071.606] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.606] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x843d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x843d, lpOverlapped=0x0) returned 1 [0071.607] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.607] CloseHandle (hObject=0x1cc) returned 1 [0071.619] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg.bd")) returned 1 [0071.620] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85543b6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x639b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02736G.GIF", cAlternateFileName="")) returned 1 [0071.620] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.620] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02736G.GIF") returned -1 [0071.620] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02736G.GIF") returned -1 [0071.620] lstrcmpiA (lpString1="", lpString2="PH02736G.GIF") returned -1 [0071.620] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG") returned="PH02567J.JPG" [0071.620] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.620] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.620] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.620] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.620] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02736G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" [0071.620] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF", pszSpec="*.zip") returned 0 [0071.620] lstrlenA (lpString="*.zip") returned 5 [0071.620] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF", pszSpec="*.rar") returned 0 [0071.620] lstrlenA (lpString="*.rar") returned 5 [0071.621] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF", pszSpec="*.7z") returned 0 [0071.621] lstrlenA (lpString="*.7z") returned 4 [0071.621] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF", pszSpec="*.tar") returned 0 [0071.621] lstrlenA (lpString="*.tar") returned 5 [0071.621] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF", pszSpec="*.gzip") returned 0 [0071.621] lstrlenA (lpString="*.gzip") returned 6 [0071.621] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF", pszSpec="*.jpg") returned 0 [0071.621] lstrlenA (lpString="*.jpg") returned 5 [0071.621] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF", pszSpec="*.jpeg") returned 0 [0071.621] lstrlenA (lpString="*.jpeg") returned 6 [0071.621] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF", pszSpec="*.psd") returned 0 [0071.621] lstrlenA (lpString="*.psd") returned 5 [0071.621] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF", pszSpec="*.cdr") returned 0 [0071.621] lstrlenA (lpString="*.cdr") returned 5 [0071.621] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF", pszSpec="*.dwg") returned 0 [0071.621] lstrlenA (lpString="*.dwg") returned 5 [0071.621] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF", pszSpec="*.max") returned 0 [0071.621] lstrlenA (lpString="*.max") returned 5 [0071.621] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF", pszSpec="*.bmp") returned 0 [0071.621] lstrlenA (lpString="*.bmp") returned 5 [0071.621] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF", pszSpec="*.gif") returned 1 [0071.621] lstrlenA (lpString="*.gif") returned 5 [0071.621] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" [0071.621] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" [0071.621] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF." [0071.621] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.BD" [0071.621] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.622] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x639b [0071.622] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb85543b6, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.622] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.622] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x633f, lpOverlapped=0x0) returned 1 [0071.624] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF") returned="PH02736G.GIF" [0071.625] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.625] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x633f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x633f, lpOverlapped=0x0) returned 1 [0071.625] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.625] CloseHandle (hObject=0x1cc) returned 1 [0071.628] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02736g.gif.bd")) returned 1 [0071.629] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb855b8e9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02736U.BMP", cAlternateFileName="")) returned 1 [0071.629] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.629] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02736U.BMP") returned -1 [0071.629] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02736U.BMP") returned -1 [0071.629] lstrcmpiA (lpString1="", lpString2="PH02736U.BMP") returned -1 [0071.629] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF") returned="PH02736G.GIF" [0071.629] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.629] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.629] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.629] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.629] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02736U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" [0071.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP", pszSpec="*.zip") returned 0 [0071.630] lstrlenA (lpString="*.zip") returned 5 [0071.630] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP", pszSpec="*.rar") returned 0 [0071.630] lstrlenA (lpString="*.rar") returned 5 [0071.630] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP", pszSpec="*.7z") returned 0 [0071.630] lstrlenA (lpString="*.7z") returned 4 [0071.630] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP", pszSpec="*.tar") returned 0 [0071.630] lstrlenA (lpString="*.tar") returned 5 [0071.630] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP", pszSpec="*.gzip") returned 0 [0071.630] lstrlenA (lpString="*.gzip") returned 6 [0071.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP", pszSpec="*.jpg") returned 0 [0071.631] lstrlenA (lpString="*.jpg") returned 5 [0071.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP", pszSpec="*.jpeg") returned 0 [0071.631] lstrlenA (lpString="*.jpeg") returned 6 [0071.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP", pszSpec="*.psd") returned 0 [0071.631] lstrlenA (lpString="*.psd") returned 5 [0071.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP", pszSpec="*.cdr") returned 0 [0071.631] lstrlenA (lpString="*.cdr") returned 5 [0071.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP", pszSpec="*.dwg") returned 0 [0071.631] lstrlenA (lpString="*.dwg") returned 5 [0071.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP", pszSpec="*.max") returned 0 [0071.631] lstrlenA (lpString="*.max") returned 5 [0071.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP", pszSpec="*.bmp") returned 1 [0071.631] lstrlenA (lpString="*.bmp") returned 5 [0071.631] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" [0071.631] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" [0071.631] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP." [0071.631] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.BD" [0071.631] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.631] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7e90 [0071.631] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb855b8e9, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.631] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.632] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7e34, lpOverlapped=0x0) returned 1 [0071.635] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP") returned="PH02736U.BMP" [0071.636] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.636] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7e34, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7e34, lpOverlapped=0x0) returned 1 [0071.636] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.636] CloseHandle (hObject=0x1cc) returned 1 [0071.649] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp.bd")) returned 1 [0071.650] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca855334, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8118, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02738U.BMP", cAlternateFileName="")) returned 1 [0071.650] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.650] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02738U.BMP") returned -1 [0071.650] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02738U.BMP") returned -1 [0071.650] lstrcmpiA (lpString1="", lpString2="PH02738U.BMP") returned -1 [0071.650] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP") returned="PH02736U.BMP" [0071.651] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.651] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.651] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.651] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.651] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02738U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" [0071.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP", pszSpec="*.zip") returned 0 [0071.651] lstrlenA (lpString="*.zip") returned 5 [0071.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP", pszSpec="*.rar") returned 0 [0071.651] lstrlenA (lpString="*.rar") returned 5 [0071.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP", pszSpec="*.7z") returned 0 [0071.651] lstrlenA (lpString="*.7z") returned 4 [0071.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP", pszSpec="*.tar") returned 0 [0071.651] lstrlenA (lpString="*.tar") returned 5 [0071.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP", pszSpec="*.gzip") returned 0 [0071.651] lstrlenA (lpString="*.gzip") returned 6 [0071.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP", pszSpec="*.jpg") returned 0 [0071.651] lstrlenA (lpString="*.jpg") returned 5 [0071.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP", pszSpec="*.jpeg") returned 0 [0071.651] lstrlenA (lpString="*.jpeg") returned 6 [0071.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP", pszSpec="*.psd") returned 0 [0071.651] lstrlenA (lpString="*.psd") returned 5 [0071.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP", pszSpec="*.cdr") returned 0 [0071.652] lstrlenA (lpString="*.cdr") returned 5 [0071.652] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP", pszSpec="*.dwg") returned 0 [0071.652] lstrlenA (lpString="*.dwg") returned 5 [0071.652] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP", pszSpec="*.max") returned 0 [0071.652] lstrlenA (lpString="*.max") returned 5 [0071.652] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP", pszSpec="*.bmp") returned 1 [0071.652] lstrlenA (lpString="*.bmp") returned 5 [0071.652] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" [0071.652] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" [0071.652] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP." [0071.652] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.BD" [0071.652] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.652] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8118 [0071.652] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca855334, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.653] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.653] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x80bc, lpOverlapped=0x0) returned 1 [0071.658] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP") returned="PH02738U.BMP" [0071.659] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.659] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x80bc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x80bc, lpOverlapped=0x0) returned 1 [0071.660] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.660] CloseHandle (hObject=0x1cc) returned 1 [0071.662] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp.bd")) returned 1 [0071.663] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8562e11, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5f2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02740G.GIF", cAlternateFileName="")) returned 1 [0071.663] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.663] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02740G.GIF") returned -1 [0071.663] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02740G.GIF") returned -1 [0071.663] lstrcmpiA (lpString1="", lpString2="PH02740G.GIF") returned -1 [0071.663] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP") returned="PH02738U.BMP" [0071.663] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.663] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.663] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.663] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.663] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02740G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" [0071.663] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF", pszSpec="*.zip") returned 0 [0071.663] lstrlenA (lpString="*.zip") returned 5 [0071.663] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF", pszSpec="*.rar") returned 0 [0071.663] lstrlenA (lpString="*.rar") returned 5 [0071.663] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF", pszSpec="*.7z") returned 0 [0071.663] lstrlenA (lpString="*.7z") returned 4 [0071.663] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF", pszSpec="*.tar") returned 0 [0071.663] lstrlenA (lpString="*.tar") returned 5 [0071.663] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF", pszSpec="*.gzip") returned 0 [0071.663] lstrlenA (lpString="*.gzip") returned 6 [0071.663] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF", pszSpec="*.jpg") returned 0 [0071.663] lstrlenA (lpString="*.jpg") returned 5 [0071.663] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF", pszSpec="*.jpeg") returned 0 [0071.663] lstrlenA (lpString="*.jpeg") returned 6 [0071.663] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF", pszSpec="*.psd") returned 0 [0071.663] lstrlenA (lpString="*.psd") returned 5 [0071.663] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF", pszSpec="*.cdr") returned 0 [0071.663] lstrlenA (lpString="*.cdr") returned 5 [0071.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF", pszSpec="*.dwg") returned 0 [0071.664] lstrlenA (lpString="*.dwg") returned 5 [0071.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF", pszSpec="*.max") returned 0 [0071.664] lstrlenA (lpString="*.max") returned 5 [0071.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF", pszSpec="*.bmp") returned 0 [0071.664] lstrlenA (lpString="*.bmp") returned 5 [0071.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF", pszSpec="*.gif") returned 1 [0071.664] lstrlenA (lpString="*.gif") returned 5 [0071.664] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" [0071.664] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" [0071.664] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF." [0071.664] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.BD" [0071.664] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.664] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5f2b [0071.664] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb8562e11, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.664] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.664] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x5ecf, lpOverlapped=0x0) returned 1 [0071.680] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF") returned="PH02740G.GIF" [0071.681] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.681] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x5ecf, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x5ecf, lpOverlapped=0x0) returned 1 [0071.681] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.681] CloseHandle (hObject=0x1cc) returned 1 [0071.683] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02740g.gif.bd")) returned 1 [0071.684] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca85a15d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02740U.BMP", cAlternateFileName="")) returned 1 [0071.684] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.684] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02740U.BMP") returned -1 [0071.684] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02740U.BMP") returned -1 [0071.684] lstrcmpiA (lpString1="", lpString2="PH02740U.BMP") returned -1 [0071.684] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF") returned="PH02740G.GIF" [0071.684] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.684] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.684] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.684] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.684] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02740U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" [0071.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP", pszSpec="*.zip") returned 0 [0071.684] lstrlenA (lpString="*.zip") returned 5 [0071.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP", pszSpec="*.rar") returned 0 [0071.684] lstrlenA (lpString="*.rar") returned 5 [0071.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP", pszSpec="*.7z") returned 0 [0071.684] lstrlenA (lpString="*.7z") returned 4 [0071.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP", pszSpec="*.tar") returned 0 [0071.684] lstrlenA (lpString="*.tar") returned 5 [0071.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP", pszSpec="*.gzip") returned 0 [0071.684] lstrlenA (lpString="*.gzip") returned 6 [0071.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP", pszSpec="*.jpg") returned 0 [0071.684] lstrlenA (lpString="*.jpg") returned 5 [0071.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP", pszSpec="*.jpeg") returned 0 [0071.684] lstrlenA (lpString="*.jpeg") returned 6 [0071.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP", pszSpec="*.psd") returned 0 [0071.684] lstrlenA (lpString="*.psd") returned 5 [0071.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP", pszSpec="*.cdr") returned 0 [0071.684] lstrlenA (lpString="*.cdr") returned 5 [0071.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP", pszSpec="*.dwg") returned 0 [0071.685] lstrlenA (lpString="*.dwg") returned 5 [0071.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP", pszSpec="*.max") returned 0 [0071.685] lstrlenA (lpString="*.max") returned 5 [0071.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP", pszSpec="*.bmp") returned 1 [0071.685] lstrlenA (lpString="*.bmp") returned 5 [0071.685] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" [0071.685] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" [0071.685] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP." [0071.685] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.BD" [0071.685] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.685] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7f68 [0071.685] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca85a15d, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.685] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.685] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7f0c, lpOverlapped=0x0) returned 1 [0071.687] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP") returned="PH02740U.BMP" [0071.688] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.688] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7f0c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7f0c, lpOverlapped=0x0) returned 1 [0071.688] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.688] CloseHandle (hObject=0x1cc) returned 1 [0071.690] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp.bd")) returned 1 [0071.690] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb856a351, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x50a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02742G.GIF", cAlternateFileName="")) returned 1 [0071.690] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.690] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02742G.GIF") returned -1 [0071.690] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02742G.GIF") returned -1 [0071.693] lstrcmpiA (lpString1="", lpString2="PH02742G.GIF") returned -1 [0071.693] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP") returned="PH02740U.BMP" [0071.693] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.693] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.693] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.693] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.693] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02742G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" [0071.693] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF", pszSpec="*.zip") returned 0 [0071.693] lstrlenA (lpString="*.zip") returned 5 [0071.693] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF", pszSpec="*.rar") returned 0 [0071.693] lstrlenA (lpString="*.rar") returned 5 [0071.693] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF", pszSpec="*.7z") returned 0 [0071.693] lstrlenA (lpString="*.7z") returned 4 [0071.693] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF", pszSpec="*.tar") returned 0 [0071.693] lstrlenA (lpString="*.tar") returned 5 [0071.693] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF", pszSpec="*.gzip") returned 0 [0071.693] lstrlenA (lpString="*.gzip") returned 6 [0071.693] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF", pszSpec="*.jpg") returned 0 [0071.693] lstrlenA (lpString="*.jpg") returned 5 [0071.693] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF", pszSpec="*.jpeg") returned 0 [0071.693] lstrlenA (lpString="*.jpeg") returned 6 [0071.693] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF", pszSpec="*.psd") returned 0 [0071.694] lstrlenA (lpString="*.psd") returned 5 [0071.694] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF", pszSpec="*.cdr") returned 0 [0071.694] lstrlenA (lpString="*.cdr") returned 5 [0071.694] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF", pszSpec="*.dwg") returned 0 [0071.694] lstrlenA (lpString="*.dwg") returned 5 [0071.694] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF", pszSpec="*.max") returned 0 [0071.694] lstrlenA (lpString="*.max") returned 5 [0071.694] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF", pszSpec="*.bmp") returned 0 [0071.694] lstrlenA (lpString="*.bmp") returned 5 [0071.694] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF", pszSpec="*.gif") returned 1 [0071.694] lstrlenA (lpString="*.gif") returned 5 [0071.694] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" [0071.694] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" [0071.694] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF." [0071.694] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.BD" [0071.694] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.695] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50a5 [0071.695] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb856a351, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.695] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.695] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x5049, lpOverlapped=0x0) returned 1 [0071.697] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF") returned="PH02742G.GIF" [0071.697] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.697] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x5049, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x5049, lpOverlapped=0x0) returned 1 [0071.697] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.697] CloseHandle (hObject=0x1cc) returned 1 [0071.699] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02742g.gif.bd")) returned 1 [0071.700] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85718aa, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02742U.BMP", cAlternateFileName="")) returned 1 [0071.700] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.700] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02742U.BMP") returned -1 [0071.700] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02742U.BMP") returned -1 [0071.700] lstrcmpiA (lpString1="", lpString2="PH02742U.BMP") returned -1 [0071.700] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF") returned="PH02742G.GIF" [0071.700] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.700] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.700] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.700] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.700] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02742U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" [0071.700] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP", pszSpec="*.zip") returned 0 [0071.700] lstrlenA (lpString="*.zip") returned 5 [0071.700] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP", pszSpec="*.rar") returned 0 [0071.700] lstrlenA (lpString="*.rar") returned 5 [0071.700] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP", pszSpec="*.7z") returned 0 [0071.700] lstrlenA (lpString="*.7z") returned 4 [0071.700] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP", pszSpec="*.tar") returned 0 [0071.700] lstrlenA (lpString="*.tar") returned 5 [0071.700] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP", pszSpec="*.gzip") returned 0 [0071.701] lstrlenA (lpString="*.gzip") returned 6 [0071.701] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP", pszSpec="*.jpg") returned 0 [0071.701] lstrlenA (lpString="*.jpg") returned 5 [0071.701] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP", pszSpec="*.jpeg") returned 0 [0071.701] lstrlenA (lpString="*.jpeg") returned 6 [0071.701] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP", pszSpec="*.psd") returned 0 [0071.701] lstrlenA (lpString="*.psd") returned 5 [0071.701] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP", pszSpec="*.cdr") returned 0 [0071.701] lstrlenA (lpString="*.cdr") returned 5 [0071.701] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP", pszSpec="*.dwg") returned 0 [0071.701] lstrlenA (lpString="*.dwg") returned 5 [0071.701] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP", pszSpec="*.max") returned 0 [0071.701] lstrlenA (lpString="*.max") returned 5 [0071.701] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP", pszSpec="*.bmp") returned 1 [0071.701] lstrlenA (lpString="*.bmp") returned 5 [0071.701] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" [0071.701] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" [0071.701] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP." [0071.701] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.BD" [0071.701] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.701] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce0 [0071.701] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb85718aa, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.701] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.702] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7c84, lpOverlapped=0x0) returned 1 [0071.705] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP") returned="PH02742U.BMP" [0071.706] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.706] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7c84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7c84, lpOverlapped=0x0) returned 1 [0071.706] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.706] CloseHandle (hObject=0x1cc) returned 1 [0071.708] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp.bd")) returned 1 [0071.709] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca86164f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02743G.GIF", cAlternateFileName="")) returned 1 [0071.709] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.709] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02743G.GIF") returned -1 [0071.709] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02743G.GIF") returned -1 [0071.709] lstrcmpiA (lpString1="", lpString2="PH02743G.GIF") returned -1 [0071.709] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP") returned="PH02742U.BMP" [0071.709] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.709] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.709] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.709] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.709] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02743G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" [0071.709] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF", pszSpec="*.zip") returned 0 [0071.709] lstrlenA (lpString="*.zip") returned 5 [0071.709] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF", pszSpec="*.rar") returned 0 [0071.709] lstrlenA (lpString="*.rar") returned 5 [0071.709] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF", pszSpec="*.7z") returned 0 [0071.709] lstrlenA (lpString="*.7z") returned 4 [0071.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF", pszSpec="*.tar") returned 0 [0071.710] lstrlenA (lpString="*.tar") returned 5 [0071.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF", pszSpec="*.gzip") returned 0 [0071.710] lstrlenA (lpString="*.gzip") returned 6 [0071.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF", pszSpec="*.jpg") returned 0 [0071.710] lstrlenA (lpString="*.jpg") returned 5 [0071.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF", pszSpec="*.jpeg") returned 0 [0071.710] lstrlenA (lpString="*.jpeg") returned 6 [0071.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF", pszSpec="*.psd") returned 0 [0071.710] lstrlenA (lpString="*.psd") returned 5 [0071.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF", pszSpec="*.cdr") returned 0 [0071.710] lstrlenA (lpString="*.cdr") returned 5 [0071.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF", pszSpec="*.dwg") returned 0 [0071.710] lstrlenA (lpString="*.dwg") returned 5 [0071.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF", pszSpec="*.max") returned 0 [0071.710] lstrlenA (lpString="*.max") returned 5 [0071.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF", pszSpec="*.bmp") returned 0 [0071.710] lstrlenA (lpString="*.bmp") returned 5 [0071.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF", pszSpec="*.gif") returned 1 [0071.710] lstrlenA (lpString="*.gif") returned 5 [0071.710] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" [0071.710] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" [0071.710] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF." [0071.710] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.BD" [0071.710] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.711] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6d86 [0071.711] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca86164f, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.711] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.711] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x6d2a, lpOverlapped=0x0) returned 1 [0071.712] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF") returned="PH02743G.GIF" [0071.713] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.713] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x6d2a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x6d2a, lpOverlapped=0x0) returned 1 [0071.713] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.713] CloseHandle (hObject=0x1cc) returned 1 [0071.715] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02743g.gif.bd")) returned 1 [0071.716] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca868b97, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5e7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02746G.GIF", cAlternateFileName="")) returned 1 [0071.716] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.716] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02746G.GIF") returned -1 [0071.716] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02746G.GIF") returned -1 [0071.716] lstrcmpiA (lpString1="", lpString2="PH02746G.GIF") returned -1 [0071.716] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF") returned="PH02743G.GIF" [0071.716] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.716] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.716] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.717] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.717] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02746G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" [0071.717] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF", pszSpec="*.zip") returned 0 [0071.717] lstrlenA (lpString="*.zip") returned 5 [0071.717] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF", pszSpec="*.rar") returned 0 [0071.717] lstrlenA (lpString="*.rar") returned 5 [0071.717] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF", pszSpec="*.7z") returned 0 [0071.717] lstrlenA (lpString="*.7z") returned 4 [0071.717] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF", pszSpec="*.tar") returned 0 [0071.717] lstrlenA (lpString="*.tar") returned 5 [0071.717] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF", pszSpec="*.gzip") returned 0 [0071.717] lstrlenA (lpString="*.gzip") returned 6 [0071.717] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF", pszSpec="*.jpg") returned 0 [0071.717] lstrlenA (lpString="*.jpg") returned 5 [0071.717] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF", pszSpec="*.jpeg") returned 0 [0071.717] lstrlenA (lpString="*.jpeg") returned 6 [0071.717] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF", pszSpec="*.psd") returned 0 [0071.717] lstrlenA (lpString="*.psd") returned 5 [0071.717] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF", pszSpec="*.cdr") returned 0 [0071.717] lstrlenA (lpString="*.cdr") returned 5 [0071.717] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF", pszSpec="*.dwg") returned 0 [0071.717] lstrlenA (lpString="*.dwg") returned 5 [0071.717] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF", pszSpec="*.max") returned 0 [0071.717] lstrlenA (lpString="*.max") returned 5 [0071.717] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF", pszSpec="*.bmp") returned 0 [0071.717] lstrlenA (lpString="*.bmp") returned 5 [0071.717] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF", pszSpec="*.gif") returned 1 [0071.717] lstrlenA (lpString="*.gif") returned 5 [0071.717] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" [0071.718] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" [0071.718] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF." [0071.718] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.BD" [0071.718] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.719] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5e7b [0071.720] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca868b97, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.720] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.720] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x5e1f, lpOverlapped=0x0) returned 1 [0071.721] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF") returned="PH02746G.GIF" [0071.722] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.722] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x5e1f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x5e1f, lpOverlapped=0x0) returned 1 [0071.723] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.723] CloseHandle (hObject=0x1cc) returned 1 [0071.724] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02746g.gif.bd")) returned 1 [0071.725] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca86d9e6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7d84, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02746U.BMP", cAlternateFileName="")) returned 1 [0071.725] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.725] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02746U.BMP") returned -1 [0071.725] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02746U.BMP") returned -1 [0071.725] lstrcmpiA (lpString1="", lpString2="PH02746U.BMP") returned -1 [0071.725] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF") returned="PH02746G.GIF" [0071.725] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.725] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.725] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.725] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.726] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02746U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" [0071.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", pszSpec="*.zip") returned 0 [0071.726] lstrlenA (lpString="*.zip") returned 5 [0071.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", pszSpec="*.rar") returned 0 [0071.726] lstrlenA (lpString="*.rar") returned 5 [0071.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", pszSpec="*.7z") returned 0 [0071.726] lstrlenA (lpString="*.7z") returned 4 [0071.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", pszSpec="*.tar") returned 0 [0071.726] lstrlenA (lpString="*.tar") returned 5 [0071.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", pszSpec="*.gzip") returned 0 [0071.726] lstrlenA (lpString="*.gzip") returned 6 [0071.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", pszSpec="*.jpg") returned 0 [0071.726] lstrlenA (lpString="*.jpg") returned 5 [0071.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", pszSpec="*.jpeg") returned 0 [0071.726] lstrlenA (lpString="*.jpeg") returned 6 [0071.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", pszSpec="*.psd") returned 0 [0071.726] lstrlenA (lpString="*.psd") returned 5 [0071.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", pszSpec="*.cdr") returned 0 [0071.726] lstrlenA (lpString="*.cdr") returned 5 [0071.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", pszSpec="*.dwg") returned 0 [0071.726] lstrlenA (lpString="*.dwg") returned 5 [0071.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", pszSpec="*.max") returned 0 [0071.726] lstrlenA (lpString="*.max") returned 5 [0071.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", pszSpec="*.bmp") returned 1 [0071.726] lstrlenA (lpString="*.bmp") returned 5 [0071.726] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" [0071.726] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" [0071.726] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP." [0071.726] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.BD" [0071.726] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.727] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7d84 [0071.727] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca86d9e6, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.727] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.727] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7d28, lpOverlapped=0x0) returned 1 [0071.730] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP") returned="PH02746U.BMP" [0071.731] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.731] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7d28, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7d28, lpOverlapped=0x0) returned 1 [0071.732] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.732] CloseHandle (hObject=0x1cc) returned 1 [0071.733] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp.bd")) returned 1 [0071.734] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca8727c8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6090, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02748G.GIF", cAlternateFileName="")) returned 1 [0071.734] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.734] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02748G.GIF") returned -1 [0071.734] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02748G.GIF") returned -1 [0071.734] lstrcmpiA (lpString1="", lpString2="PH02748G.GIF") returned -1 [0071.734] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP") returned="PH02746U.BMP" [0071.734] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.734] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.734] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.734] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.734] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02748G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" [0071.734] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", pszSpec="*.zip") returned 0 [0071.734] lstrlenA (lpString="*.zip") returned 5 [0071.734] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", pszSpec="*.rar") returned 0 [0071.734] lstrlenA (lpString="*.rar") returned 5 [0071.734] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", pszSpec="*.7z") returned 0 [0071.734] lstrlenA (lpString="*.7z") returned 4 [0071.734] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", pszSpec="*.tar") returned 0 [0071.734] lstrlenA (lpString="*.tar") returned 5 [0071.734] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", pszSpec="*.gzip") returned 0 [0071.735] lstrlenA (lpString="*.gzip") returned 6 [0071.735] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", pszSpec="*.jpg") returned 0 [0071.735] lstrlenA (lpString="*.jpg") returned 5 [0071.735] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", pszSpec="*.jpeg") returned 0 [0071.735] lstrlenA (lpString="*.jpeg") returned 6 [0071.735] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", pszSpec="*.psd") returned 0 [0071.735] lstrlenA (lpString="*.psd") returned 5 [0071.735] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", pszSpec="*.cdr") returned 0 [0071.735] lstrlenA (lpString="*.cdr") returned 5 [0071.735] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", pszSpec="*.dwg") returned 0 [0071.735] lstrlenA (lpString="*.dwg") returned 5 [0071.735] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", pszSpec="*.max") returned 0 [0071.735] lstrlenA (lpString="*.max") returned 5 [0071.735] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", pszSpec="*.bmp") returned 0 [0071.735] lstrlenA (lpString="*.bmp") returned 5 [0071.735] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", pszSpec="*.gif") returned 1 [0071.735] lstrlenA (lpString="*.gif") returned 5 [0071.735] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" [0071.735] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" [0071.735] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF." [0071.735] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.BD" [0071.735] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.735] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6090 [0071.735] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca8727c8, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.736] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.736] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x6034, lpOverlapped=0x0) returned 1 [0071.737] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF") returned="PH02748G.GIF" [0071.738] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.738] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x6034, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x6034, lpOverlapped=0x0) returned 1 [0071.738] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.738] CloseHandle (hObject=0x1cc) returned 1 [0071.740] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02748g.gif.bd")) returned 1 [0071.740] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca8789a0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02748U.BMP", cAlternateFileName="")) returned 1 [0071.740] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.740] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02748U.BMP") returned -1 [0071.740] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02748U.BMP") returned -1 [0071.740] lstrcmpiA (lpString1="", lpString2="PH02748U.BMP") returned -1 [0071.741] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF") returned="PH02748G.GIF" [0071.741] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.741] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.741] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.741] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.741] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02748U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" [0071.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", pszSpec="*.zip") returned 0 [0071.741] lstrlenA (lpString="*.zip") returned 5 [0071.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", pszSpec="*.rar") returned 0 [0071.741] lstrlenA (lpString="*.rar") returned 5 [0071.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", pszSpec="*.7z") returned 0 [0071.741] lstrlenA (lpString="*.7z") returned 4 [0071.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", pszSpec="*.tar") returned 0 [0071.741] lstrlenA (lpString="*.tar") returned 5 [0071.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", pszSpec="*.gzip") returned 0 [0071.741] lstrlenA (lpString="*.gzip") returned 6 [0071.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", pszSpec="*.jpg") returned 0 [0071.741] lstrlenA (lpString="*.jpg") returned 5 [0071.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", pszSpec="*.jpeg") returned 0 [0071.741] lstrlenA (lpString="*.jpeg") returned 6 [0071.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", pszSpec="*.psd") returned 0 [0071.741] lstrlenA (lpString="*.psd") returned 5 [0071.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", pszSpec="*.cdr") returned 0 [0071.741] lstrlenA (lpString="*.cdr") returned 5 [0071.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", pszSpec="*.dwg") returned 0 [0071.741] lstrlenA (lpString="*.dwg") returned 5 [0071.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", pszSpec="*.max") returned 0 [0071.741] lstrlenA (lpString="*.max") returned 5 [0071.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", pszSpec="*.bmp") returned 1 [0071.742] lstrlenA (lpString="*.bmp") returned 5 [0071.742] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" [0071.742] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" [0071.742] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP." [0071.742] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.BD" [0071.742] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.742] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7e90 [0071.742] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca8789a0, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.742] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.742] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7e34, lpOverlapped=0x0) returned 1 [0071.795] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP") returned="PH02748U.BMP" [0071.795] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.796] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7e34, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7e34, lpOverlapped=0x0) returned 1 [0071.796] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.796] CloseHandle (hObject=0x1cc) returned 1 [0071.798] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp.bd")) returned 1 [0071.799] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca87eb56, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8795, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02749G.GIF", cAlternateFileName="")) returned 1 [0071.799] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0071.799] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02749G.GIF") returned -1 [0071.799] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02749G.GIF") returned -1 [0071.799] lstrcmpiA (lpString1="", lpString2="PH02749G.GIF") returned -1 [0071.799] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP") returned="PH02748U.BMP" [0071.799] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0071.799] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0071.799] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0071.799] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0071.800] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02749G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" [0071.800] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", pszSpec="*.zip") returned 0 [0071.800] lstrlenA (lpString="*.zip") returned 5 [0071.800] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", pszSpec="*.rar") returned 0 [0071.800] lstrlenA (lpString="*.rar") returned 5 [0071.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", pszSpec="*.7z") returned 0 [0071.802] lstrlenA (lpString="*.7z") returned 4 [0071.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", pszSpec="*.tar") returned 0 [0071.802] lstrlenA (lpString="*.tar") returned 5 [0071.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", pszSpec="*.gzip") returned 0 [0071.802] lstrlenA (lpString="*.gzip") returned 6 [0071.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", pszSpec="*.jpg") returned 0 [0071.802] lstrlenA (lpString="*.jpg") returned 5 [0071.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", pszSpec="*.jpeg") returned 0 [0071.802] lstrlenA (lpString="*.jpeg") returned 6 [0071.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", pszSpec="*.psd") returned 0 [0071.802] lstrlenA (lpString="*.psd") returned 5 [0071.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", pszSpec="*.cdr") returned 0 [0071.802] lstrlenA (lpString="*.cdr") returned 5 [0071.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", pszSpec="*.dwg") returned 0 [0071.802] lstrlenA (lpString="*.dwg") returned 5 [0071.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", pszSpec="*.max") returned 0 [0071.802] lstrlenA (lpString="*.max") returned 5 [0071.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", pszSpec="*.bmp") returned 0 [0071.802] lstrlenA (lpString="*.bmp") returned 5 [0071.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", pszSpec="*.gif") returned 1 [0071.802] lstrlenA (lpString="*.gif") returned 5 [0071.802] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" [0071.802] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" [0071.802] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF." [0071.802] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.BD" [0071.803] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.804] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8795 [0071.804] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca87eb56, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0071.804] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.804] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x8739, lpOverlapped=0x0) returned 1 [0071.890] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF") returned="PH02749G.GIF" [0071.891] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0071.891] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x8739, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x8739, lpOverlapped=0x0) returned 1 [0071.891] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0071.892] CloseHandle (hObject=0x1cc) returned 1 [0072.197] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02749g.gif.bd")) returned 1 [0072.198] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca883945, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8118, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02749U.BMP", cAlternateFileName="")) returned 1 [0072.200] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.200] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02749U.BMP") returned -1 [0072.200] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02749U.BMP") returned -1 [0072.200] lstrcmpiA (lpString1="", lpString2="PH02749U.BMP") returned -1 [0072.200] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF") returned="PH02749G.GIF" [0072.200] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.200] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.200] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.200] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.200] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02749U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" [0072.200] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP", pszSpec="*.zip") returned 0 [0072.200] lstrlenA (lpString="*.zip") returned 5 [0072.200] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP", pszSpec="*.rar") returned 0 [0072.200] lstrlenA (lpString="*.rar") returned 5 [0072.200] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP", pszSpec="*.7z") returned 0 [0072.200] lstrlenA (lpString="*.7z") returned 4 [0072.200] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP", pszSpec="*.tar") returned 0 [0072.200] lstrlenA (lpString="*.tar") returned 5 [0072.200] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP", pszSpec="*.gzip") returned 0 [0072.200] lstrlenA (lpString="*.gzip") returned 6 [0072.200] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP", pszSpec="*.jpg") returned 0 [0072.200] lstrlenA (lpString="*.jpg") returned 5 [0072.200] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP", pszSpec="*.jpeg") returned 0 [0072.201] lstrlenA (lpString="*.jpeg") returned 6 [0072.201] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP", pszSpec="*.psd") returned 0 [0072.201] lstrlenA (lpString="*.psd") returned 5 [0072.201] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP", pszSpec="*.cdr") returned 0 [0072.201] lstrlenA (lpString="*.cdr") returned 5 [0072.201] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP", pszSpec="*.dwg") returned 0 [0072.201] lstrlenA (lpString="*.dwg") returned 5 [0072.201] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP", pszSpec="*.max") returned 0 [0072.201] lstrlenA (lpString="*.max") returned 5 [0072.201] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP", pszSpec="*.bmp") returned 1 [0072.201] lstrlenA (lpString="*.bmp") returned 5 [0072.201] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" [0072.201] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" [0072.201] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP." [0072.201] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.BD" [0072.201] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0072.202] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8118 [0072.202] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca883945, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0072.202] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.202] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x80bc, lpOverlapped=0x0) returned 1 [0072.206] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP") returned="PH02749U.BMP" [0072.207] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.207] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x80bc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x80bc, lpOverlapped=0x0) returned 1 [0072.207] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0072.207] CloseHandle (hObject=0x1cc) returned 1 [0072.209] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp.bd")) returned 1 [0072.210] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8577a23, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x64c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02750G.GIF", cAlternateFileName="")) returned 1 [0072.210] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.210] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02750G.GIF") returned -1 [0072.210] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02750G.GIF") returned -1 [0072.210] lstrcmpiA (lpString1="", lpString2="PH02750G.GIF") returned -1 [0072.210] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP") returned="PH02749U.BMP" [0072.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.210] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.210] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.210] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.211] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02750G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" [0072.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF", pszSpec="*.zip") returned 0 [0072.211] lstrlenA (lpString="*.zip") returned 5 [0072.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF", pszSpec="*.rar") returned 0 [0072.211] lstrlenA (lpString="*.rar") returned 5 [0072.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF", pszSpec="*.7z") returned 0 [0072.211] lstrlenA (lpString="*.7z") returned 4 [0072.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF", pszSpec="*.tar") returned 0 [0072.211] lstrlenA (lpString="*.tar") returned 5 [0072.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF", pszSpec="*.gzip") returned 0 [0072.211] lstrlenA (lpString="*.gzip") returned 6 [0072.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF", pszSpec="*.jpg") returned 0 [0072.211] lstrlenA (lpString="*.jpg") returned 5 [0072.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF", pszSpec="*.jpeg") returned 0 [0072.211] lstrlenA (lpString="*.jpeg") returned 6 [0072.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF", pszSpec="*.psd") returned 0 [0072.211] lstrlenA (lpString="*.psd") returned 5 [0072.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF", pszSpec="*.cdr") returned 0 [0072.211] lstrlenA (lpString="*.cdr") returned 5 [0072.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF", pszSpec="*.dwg") returned 0 [0072.211] lstrlenA (lpString="*.dwg") returned 5 [0072.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF", pszSpec="*.max") returned 0 [0072.211] lstrlenA (lpString="*.max") returned 5 [0072.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF", pszSpec="*.bmp") returned 0 [0072.211] lstrlenA (lpString="*.bmp") returned 5 [0072.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF", pszSpec="*.gif") returned 1 [0072.211] lstrlenA (lpString="*.gif") returned 5 [0072.211] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" [0072.211] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" [0072.211] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF." [0072.211] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.BD" [0072.211] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0072.212] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x64c7 [0072.212] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb8577a23, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0072.212] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.212] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x646b, lpOverlapped=0x0) returned 1 [0072.215] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF") returned="PH02750G.GIF" [0072.216] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.216] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x646b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x646b, lpOverlapped=0x0) returned 1 [0072.216] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0072.216] CloseHandle (hObject=0x1cc) returned 1 [0072.218] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02750g.gif.bd")) returned 1 [0072.218] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb857dc93, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16f40, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02750U.BMP", cAlternateFileName="")) returned 1 [0072.218] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.218] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02750U.BMP") returned -1 [0072.218] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02750U.BMP") returned -1 [0072.218] lstrcmpiA (lpString1="", lpString2="PH02750U.BMP") returned -1 [0072.218] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF") returned="PH02750G.GIF" [0072.219] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.219] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.219] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.219] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.219] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02750U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" [0072.219] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP", pszSpec="*.zip") returned 0 [0072.219] lstrlenA (lpString="*.zip") returned 5 [0072.219] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP", pszSpec="*.rar") returned 0 [0072.219] lstrlenA (lpString="*.rar") returned 5 [0072.219] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP", pszSpec="*.7z") returned 0 [0072.219] lstrlenA (lpString="*.7z") returned 4 [0072.219] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP", pszSpec="*.tar") returned 0 [0072.219] lstrlenA (lpString="*.tar") returned 5 [0072.219] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP", pszSpec="*.gzip") returned 0 [0072.219] lstrlenA (lpString="*.gzip") returned 6 [0072.219] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP", pszSpec="*.jpg") returned 0 [0072.219] lstrlenA (lpString="*.jpg") returned 5 [0072.219] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP", pszSpec="*.jpeg") returned 0 [0072.219] lstrlenA (lpString="*.jpeg") returned 6 [0072.219] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP", pszSpec="*.psd") returned 0 [0072.219] lstrlenA (lpString="*.psd") returned 5 [0072.219] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP", pszSpec="*.cdr") returned 0 [0072.219] lstrlenA (lpString="*.cdr") returned 5 [0072.219] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP", pszSpec="*.dwg") returned 0 [0072.219] lstrlenA (lpString="*.dwg") returned 5 [0072.219] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP", pszSpec="*.max") returned 0 [0072.219] lstrlenA (lpString="*.max") returned 5 [0072.219] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP", pszSpec="*.bmp") returned 1 [0072.219] lstrlenA (lpString="*.bmp") returned 5 [0072.219] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" [0072.219] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" [0072.220] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP." [0072.220] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.BD" [0072.220] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0072.220] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16f40 [0072.220] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb857dc93, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0072.220] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.220] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x16ee4, lpOverlapped=0x0) returned 1 [0072.223] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP") returned="PH02750U.BMP" [0072.225] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.225] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x16ee4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x16ee4, lpOverlapped=0x0) returned 1 [0072.226] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0072.226] CloseHandle (hObject=0x1cc) returned 1 [0072.228] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp.bd")) returned 1 [0072.229] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca88ae5f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xc382, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02752G.GIF", cAlternateFileName="")) returned 1 [0072.229] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.229] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02752G.GIF") returned -1 [0072.229] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02752G.GIF") returned -1 [0072.229] lstrcmpiA (lpString1="", lpString2="PH02752G.GIF") returned -1 [0072.229] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP") returned="PH02750U.BMP" [0072.229] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.229] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.229] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.229] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.229] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02752G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" [0072.229] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF", pszSpec="*.zip") returned 0 [0072.229] lstrlenA (lpString="*.zip") returned 5 [0072.230] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF", pszSpec="*.rar") returned 0 [0072.230] lstrlenA (lpString="*.rar") returned 5 [0072.230] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF", pszSpec="*.7z") returned 0 [0072.230] lstrlenA (lpString="*.7z") returned 4 [0072.230] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF", pszSpec="*.tar") returned 0 [0072.230] lstrlenA (lpString="*.tar") returned 5 [0072.230] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF", pszSpec="*.gzip") returned 0 [0072.230] lstrlenA (lpString="*.gzip") returned 6 [0072.230] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF", pszSpec="*.jpg") returned 0 [0072.230] lstrlenA (lpString="*.jpg") returned 5 [0072.230] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF", pszSpec="*.jpeg") returned 0 [0072.230] lstrlenA (lpString="*.jpeg") returned 6 [0072.230] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF", pszSpec="*.psd") returned 0 [0072.230] lstrlenA (lpString="*.psd") returned 5 [0072.230] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF", pszSpec="*.cdr") returned 0 [0072.230] lstrlenA (lpString="*.cdr") returned 5 [0072.230] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF", pszSpec="*.dwg") returned 0 [0072.230] lstrlenA (lpString="*.dwg") returned 5 [0072.230] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF", pszSpec="*.max") returned 0 [0072.230] lstrlenA (lpString="*.max") returned 5 [0072.230] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF", pszSpec="*.bmp") returned 0 [0072.230] lstrlenA (lpString="*.bmp") returned 5 [0072.230] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF", pszSpec="*.gif") returned 1 [0072.230] lstrlenA (lpString="*.gif") returned 5 [0072.230] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" [0072.230] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" [0072.230] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF." [0072.230] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.BD" [0072.230] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0072.231] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc382 [0072.231] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca88ae5f, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0072.231] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.231] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xc326, lpOverlapped=0x0) returned 1 [0072.233] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF") returned="PH02752G.GIF" [0072.236] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.236] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xc326, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xc326, lpOverlapped=0x0) returned 1 [0072.237] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0072.237] CloseHandle (hObject=0x1cc) returned 1 [0072.351] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02752g.gif.bd")) returned 1 [0072.352] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca88fc95, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02752U.BMP", cAlternateFileName="")) returned 1 [0072.352] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.352] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02752U.BMP") returned -1 [0072.352] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02752U.BMP") returned -1 [0072.352] lstrcmpiA (lpString1="", lpString2="PH02752U.BMP") returned -1 [0072.352] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF") returned="PH02752G.GIF" [0072.352] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.352] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.352] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.352] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.353] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02752U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" [0072.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP", pszSpec="*.zip") returned 0 [0072.353] lstrlenA (lpString="*.zip") returned 5 [0072.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP", pszSpec="*.rar") returned 0 [0072.353] lstrlenA (lpString="*.rar") returned 5 [0072.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP", pszSpec="*.7z") returned 0 [0072.353] lstrlenA (lpString="*.7z") returned 4 [0072.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP", pszSpec="*.tar") returned 0 [0072.353] lstrlenA (lpString="*.tar") returned 5 [0072.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP", pszSpec="*.gzip") returned 0 [0072.353] lstrlenA (lpString="*.gzip") returned 6 [0072.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP", pszSpec="*.jpg") returned 0 [0072.353] lstrlenA (lpString="*.jpg") returned 5 [0072.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP", pszSpec="*.jpeg") returned 0 [0072.353] lstrlenA (lpString="*.jpeg") returned 6 [0072.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP", pszSpec="*.psd") returned 0 [0072.353] lstrlenA (lpString="*.psd") returned 5 [0072.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP", pszSpec="*.cdr") returned 0 [0072.353] lstrlenA (lpString="*.cdr") returned 5 [0072.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP", pszSpec="*.dwg") returned 0 [0072.353] lstrlenA (lpString="*.dwg") returned 5 [0072.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP", pszSpec="*.max") returned 0 [0072.353] lstrlenA (lpString="*.max") returned 5 [0072.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP", pszSpec="*.bmp") returned 1 [0072.353] lstrlenA (lpString="*.bmp") returned 5 [0072.354] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" [0072.354] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" [0072.354] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP." [0072.354] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.BD" [0072.354] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0072.354] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7c08 [0072.354] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca88fc95, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0072.354] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.354] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7bac, lpOverlapped=0x0) returned 1 [0072.360] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP") returned="PH02752U.BMP" [0072.361] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.361] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7bac, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7bac, lpOverlapped=0x0) returned 1 [0072.361] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0072.361] CloseHandle (hObject=0x1cc) returned 1 [0072.363] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp.bd")) returned 1 [0072.364] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8588b9f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1a6b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02753U.BMP", cAlternateFileName="")) returned 1 [0072.364] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.366] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02753U.BMP") returned -1 [0072.366] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02753U.BMP") returned -1 [0072.366] lstrcmpiA (lpString1="", lpString2="PH02753U.BMP") returned -1 [0072.366] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP") returned="PH02752U.BMP" [0072.366] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.366] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.366] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.366] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.367] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02753U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" [0072.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP", pszSpec="*.zip") returned 0 [0072.367] lstrlenA (lpString="*.zip") returned 5 [0072.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP", pszSpec="*.rar") returned 0 [0072.367] lstrlenA (lpString="*.rar") returned 5 [0072.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP", pszSpec="*.7z") returned 0 [0072.367] lstrlenA (lpString="*.7z") returned 4 [0072.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP", pszSpec="*.tar") returned 0 [0072.367] lstrlenA (lpString="*.tar") returned 5 [0072.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP", pszSpec="*.gzip") returned 0 [0072.367] lstrlenA (lpString="*.gzip") returned 6 [0072.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP", pszSpec="*.jpg") returned 0 [0072.367] lstrlenA (lpString="*.jpg") returned 5 [0072.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP", pszSpec="*.jpeg") returned 0 [0072.367] lstrlenA (lpString="*.jpeg") returned 6 [0072.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP", pszSpec="*.psd") returned 0 [0072.367] lstrlenA (lpString="*.psd") returned 5 [0072.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP", pszSpec="*.cdr") returned 0 [0072.367] lstrlenA (lpString="*.cdr") returned 5 [0072.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP", pszSpec="*.dwg") returned 0 [0072.367] lstrlenA (lpString="*.dwg") returned 5 [0072.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP", pszSpec="*.max") returned 0 [0072.367] lstrlenA (lpString="*.max") returned 5 [0072.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP", pszSpec="*.bmp") returned 1 [0072.367] lstrlenA (lpString="*.bmp") returned 5 [0072.367] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" [0072.367] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" [0072.367] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP." [0072.367] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.BD" [0072.367] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0072.370] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a6b8 [0072.370] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb8588b9f, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0072.370] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.370] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1a65c, lpOverlapped=0x0) returned 1 [0072.372] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP") returned="PH02753U.BMP" [0072.374] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.374] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1a65c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1a65c, lpOverlapped=0x0) returned 1 [0072.375] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0072.375] CloseHandle (hObject=0x1cc) returned 1 [0072.379] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp.bd")) returned 1 [0072.381] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8591427, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1a7d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02754U.BMP", cAlternateFileName="")) returned 1 [0072.381] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.381] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02754U.BMP") returned -1 [0072.381] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02754U.BMP") returned -1 [0072.381] lstrcmpiA (lpString1="", lpString2="PH02754U.BMP") returned -1 [0072.381] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP") returned="PH02753U.BMP" [0072.382] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.382] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.382] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.382] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.382] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02754U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" [0072.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP", pszSpec="*.zip") returned 0 [0072.382] lstrlenA (lpString="*.zip") returned 5 [0072.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP", pszSpec="*.rar") returned 0 [0072.382] lstrlenA (lpString="*.rar") returned 5 [0072.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP", pszSpec="*.7z") returned 0 [0072.382] lstrlenA (lpString="*.7z") returned 4 [0072.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP", pszSpec="*.tar") returned 0 [0072.382] lstrlenA (lpString="*.tar") returned 5 [0072.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP", pszSpec="*.gzip") returned 0 [0072.382] lstrlenA (lpString="*.gzip") returned 6 [0072.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP", pszSpec="*.jpg") returned 0 [0072.382] lstrlenA (lpString="*.jpg") returned 5 [0072.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP", pszSpec="*.jpeg") returned 0 [0072.382] lstrlenA (lpString="*.jpeg") returned 6 [0072.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP", pszSpec="*.psd") returned 0 [0072.382] lstrlenA (lpString="*.psd") returned 5 [0072.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP", pszSpec="*.cdr") returned 0 [0072.382] lstrlenA (lpString="*.cdr") returned 5 [0072.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP", pszSpec="*.dwg") returned 0 [0072.382] lstrlenA (lpString="*.dwg") returned 5 [0072.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP", pszSpec="*.max") returned 0 [0072.382] lstrlenA (lpString="*.max") returned 5 [0072.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP", pszSpec="*.bmp") returned 1 [0072.382] lstrlenA (lpString="*.bmp") returned 5 [0072.382] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" [0072.382] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" [0072.383] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP." [0072.383] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.BD" [0072.383] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0072.383] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a7d8 [0072.383] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb8591427, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0072.383] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.383] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1a77c, lpOverlapped=0x0) returned 1 [0072.432] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP") returned="PH02754U.BMP" [0072.437] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.437] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1a77c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1a77c, lpOverlapped=0x0) returned 1 [0072.437] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0072.438] CloseHandle (hObject=0x1cc) returned 1 [0072.443] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp.bd")) returned 1 [0072.444] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8598974, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1a7d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02755U.BMP", cAlternateFileName="")) returned 1 [0072.444] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.444] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02755U.BMP") returned -1 [0072.444] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02755U.BMP") returned -1 [0072.444] lstrcmpiA (lpString1="", lpString2="PH02755U.BMP") returned -1 [0072.444] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP") returned="PH02754U.BMP" [0072.444] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.444] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.445] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.445] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.445] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02755U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" [0072.445] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP", pszSpec="*.zip") returned 0 [0072.445] lstrlenA (lpString="*.zip") returned 5 [0072.445] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP", pszSpec="*.rar") returned 0 [0072.445] lstrlenA (lpString="*.rar") returned 5 [0072.445] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP", pszSpec="*.7z") returned 0 [0072.445] lstrlenA (lpString="*.7z") returned 4 [0072.445] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP", pszSpec="*.tar") returned 0 [0072.445] lstrlenA (lpString="*.tar") returned 5 [0072.445] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP", pszSpec="*.gzip") returned 0 [0072.445] lstrlenA (lpString="*.gzip") returned 6 [0072.445] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP", pszSpec="*.jpg") returned 0 [0072.445] lstrlenA (lpString="*.jpg") returned 5 [0072.445] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP", pszSpec="*.jpeg") returned 0 [0072.445] lstrlenA (lpString="*.jpeg") returned 6 [0072.445] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP", pszSpec="*.psd") returned 0 [0072.445] lstrlenA (lpString="*.psd") returned 5 [0072.445] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP", pszSpec="*.cdr") returned 0 [0072.445] lstrlenA (lpString="*.cdr") returned 5 [0072.445] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP", pszSpec="*.dwg") returned 0 [0072.445] lstrlenA (lpString="*.dwg") returned 5 [0072.445] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP", pszSpec="*.max") returned 0 [0072.445] lstrlenA (lpString="*.max") returned 5 [0072.446] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP", pszSpec="*.bmp") returned 1 [0072.446] lstrlenA (lpString="*.bmp") returned 5 [0072.446] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" [0072.446] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" [0072.446] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP." [0072.446] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.BD" [0072.446] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0072.446] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a7d8 [0072.446] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb8598974, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0072.446] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.446] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1a77c, lpOverlapped=0x0) returned 1 [0072.494] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP") returned="PH02755U.BMP" [0072.497] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.497] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1a77c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1a77c, lpOverlapped=0x0) returned 1 [0072.497] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0072.497] CloseHandle (hObject=0x1cc) returned 1 [0072.498] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp.bd")) returned 1 [0072.498] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85a3938, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x30408, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02756U.BMP", cAlternateFileName="")) returned 1 [0072.498] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.498] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02756U.BMP") returned -1 [0072.498] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02756U.BMP") returned -1 [0072.498] lstrcmpiA (lpString1="", lpString2="PH02756U.BMP") returned -1 [0072.498] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP") returned="PH02755U.BMP" [0072.498] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.499] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.499] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.499] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.499] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02756U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" [0072.499] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP", pszSpec="*.zip") returned 0 [0072.499] lstrlenA (lpString="*.zip") returned 5 [0072.499] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP", pszSpec="*.rar") returned 0 [0072.499] lstrlenA (lpString="*.rar") returned 5 [0072.499] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP", pszSpec="*.7z") returned 0 [0072.499] lstrlenA (lpString="*.7z") returned 4 [0072.499] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP", pszSpec="*.tar") returned 0 [0072.499] lstrlenA (lpString="*.tar") returned 5 [0072.499] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP", pszSpec="*.gzip") returned 0 [0072.499] lstrlenA (lpString="*.gzip") returned 6 [0072.499] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP", pszSpec="*.jpg") returned 0 [0072.499] lstrlenA (lpString="*.jpg") returned 5 [0072.499] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP", pszSpec="*.jpeg") returned 0 [0072.499] lstrlenA (lpString="*.jpeg") returned 6 [0072.499] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP", pszSpec="*.psd") returned 0 [0072.499] lstrlenA (lpString="*.psd") returned 5 [0072.499] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP", pszSpec="*.cdr") returned 0 [0072.499] lstrlenA (lpString="*.cdr") returned 5 [0072.499] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP", pszSpec="*.dwg") returned 0 [0072.499] lstrlenA (lpString="*.dwg") returned 5 [0072.499] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP", pszSpec="*.max") returned 0 [0072.499] lstrlenA (lpString="*.max") returned 5 [0072.499] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP", pszSpec="*.bmp") returned 1 [0072.499] lstrlenA (lpString="*.bmp") returned 5 [0072.499] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" [0072.499] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" [0072.500] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP." [0072.500] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.BD" [0072.500] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0072.500] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x30408 [0072.500] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb85a3938, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0072.500] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.500] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x303ac, lpOverlapped=0x0) returned 1 [0072.504] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP") returned="PH02756U.BMP" [0072.509] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.509] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x303ac, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x303ac, lpOverlapped=0x0) returned 1 [0072.510] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0072.510] CloseHandle (hObject=0x1cc) returned 1 [0072.510] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp.bd")) returned 1 [0072.511] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85b1051, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x30408, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02757U.BMP", cAlternateFileName="")) returned 1 [0072.511] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.511] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02757U.BMP") returned -1 [0072.511] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02757U.BMP") returned -1 [0072.511] lstrcmpiA (lpString1="", lpString2="PH02757U.BMP") returned -1 [0072.511] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP") returned="PH02756U.BMP" [0072.511] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.511] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.511] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.511] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.511] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02757U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" [0072.511] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP", pszSpec="*.zip") returned 0 [0072.511] lstrlenA (lpString="*.zip") returned 5 [0072.511] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP", pszSpec="*.rar") returned 0 [0072.511] lstrlenA (lpString="*.rar") returned 5 [0072.511] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP", pszSpec="*.7z") returned 0 [0072.511] lstrlenA (lpString="*.7z") returned 4 [0072.511] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP", pszSpec="*.tar") returned 0 [0072.511] lstrlenA (lpString="*.tar") returned 5 [0072.511] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP", pszSpec="*.gzip") returned 0 [0072.511] lstrlenA (lpString="*.gzip") returned 6 [0072.511] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP", pszSpec="*.jpg") returned 0 [0072.511] lstrlenA (lpString="*.jpg") returned 5 [0072.511] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP", pszSpec="*.jpeg") returned 0 [0072.511] lstrlenA (lpString="*.jpeg") returned 6 [0072.511] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP", pszSpec="*.psd") returned 0 [0072.512] lstrlenA (lpString="*.psd") returned 5 [0072.512] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP", pszSpec="*.cdr") returned 0 [0072.512] lstrlenA (lpString="*.cdr") returned 5 [0072.512] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP", pszSpec="*.dwg") returned 0 [0072.512] lstrlenA (lpString="*.dwg") returned 5 [0072.512] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP", pszSpec="*.max") returned 0 [0072.512] lstrlenA (lpString="*.max") returned 5 [0072.512] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP", pszSpec="*.bmp") returned 1 [0072.512] lstrlenA (lpString="*.bmp") returned 5 [0072.512] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" [0072.512] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" [0072.512] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP." [0072.512] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.BD" [0072.512] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0072.513] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x30408 [0072.513] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb85b1051, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0072.513] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.513] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x303ac, lpOverlapped=0x0) returned 1 [0072.579] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP") returned="PH02757U.BMP" [0072.586] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.586] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x303ac, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x303ac, lpOverlapped=0x0) returned 1 [0072.587] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0072.587] CloseHandle (hObject=0x1cc) returned 1 [0072.587] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp.bd")) returned 1 [0072.588] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85b992b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x307f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02758U.BMP", cAlternateFileName="")) returned 1 [0072.588] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.588] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02758U.BMP") returned -1 [0072.588] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02758U.BMP") returned -1 [0072.588] lstrcmpiA (lpString1="", lpString2="PH02758U.BMP") returned -1 [0072.588] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP") returned="PH02757U.BMP" [0072.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.588] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.588] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.588] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.588] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02758U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" [0072.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP", pszSpec="*.zip") returned 0 [0072.588] lstrlenA (lpString="*.zip") returned 5 [0072.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP", pszSpec="*.rar") returned 0 [0072.588] lstrlenA (lpString="*.rar") returned 5 [0072.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP", pszSpec="*.7z") returned 0 [0072.588] lstrlenA (lpString="*.7z") returned 4 [0072.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP", pszSpec="*.tar") returned 0 [0072.588] lstrlenA (lpString="*.tar") returned 5 [0072.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP", pszSpec="*.gzip") returned 0 [0072.588] lstrlenA (lpString="*.gzip") returned 6 [0072.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP", pszSpec="*.jpg") returned 0 [0072.588] lstrlenA (lpString="*.jpg") returned 5 [0072.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP", pszSpec="*.jpeg") returned 0 [0072.588] lstrlenA (lpString="*.jpeg") returned 6 [0072.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP", pszSpec="*.psd") returned 0 [0072.588] lstrlenA (lpString="*.psd") returned 5 [0072.589] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP", pszSpec="*.cdr") returned 0 [0072.589] lstrlenA (lpString="*.cdr") returned 5 [0072.589] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP", pszSpec="*.dwg") returned 0 [0072.589] lstrlenA (lpString="*.dwg") returned 5 [0072.589] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP", pszSpec="*.max") returned 0 [0072.589] lstrlenA (lpString="*.max") returned 5 [0072.589] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP", pszSpec="*.bmp") returned 1 [0072.589] lstrlenA (lpString="*.bmp") returned 5 [0072.589] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" [0072.589] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" [0072.589] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP." [0072.589] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.BD" [0072.589] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0072.589] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x307f8 [0072.589] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb85b992b, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0072.589] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.589] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x3079c, lpOverlapped=0x0) returned 1 [0072.707] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP") returned="PH02758U.BMP" [0072.712] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.712] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x3079c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x3079c, lpOverlapped=0x0) returned 1 [0072.716] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0072.717] CloseHandle (hObject=0x1cc) returned 1 [0072.717] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp.bd")) returned 1 [0072.717] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca8971f1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa0d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02759J.JPG", cAlternateFileName="")) returned 1 [0072.718] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.718] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02759J.JPG") returned -1 [0072.718] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02759J.JPG") returned -1 [0072.718] lstrcmpiA (lpString1="", lpString2="PH02759J.JPG") returned -1 [0072.718] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP") returned="PH02758U.BMP" [0072.718] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.718] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.718] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.718] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.718] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02759J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" [0072.718] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG", pszSpec="*.zip") returned 0 [0072.718] lstrlenA (lpString="*.zip") returned 5 [0072.718] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG", pszSpec="*.rar") returned 0 [0072.718] lstrlenA (lpString="*.rar") returned 5 [0072.718] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG", pszSpec="*.7z") returned 0 [0072.718] lstrlenA (lpString="*.7z") returned 4 [0072.718] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG", pszSpec="*.tar") returned 0 [0072.718] lstrlenA (lpString="*.tar") returned 5 [0072.718] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG", pszSpec="*.gzip") returned 0 [0072.718] lstrlenA (lpString="*.gzip") returned 6 [0072.718] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG", pszSpec="*.jpg") returned 1 [0072.718] lstrlenA (lpString="*.jpg") returned 5 [0072.718] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" [0072.718] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" [0072.719] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG." [0072.719] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.BD" [0072.719] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0072.721] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa0d2 [0072.721] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca8971f1, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0072.721] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.721] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xa076, lpOverlapped=0x0) returned 1 [0072.725] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG") returned="PH02759J.JPG" [0072.726] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.726] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xa076, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xa076, lpOverlapped=0x0) returned 1 [0072.726] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0072.727] CloseHandle (hObject=0x1cc) returned 1 [0072.727] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg.bd")) returned 1 [0072.727] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca89e75c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xc5d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02810J.JPG", cAlternateFileName="")) returned 1 [0072.727] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.727] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02810J.JPG") returned -1 [0072.727] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02810J.JPG") returned -1 [0072.727] lstrcmpiA (lpString1="", lpString2="PH02810J.JPG") returned -1 [0072.727] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG") returned="PH02759J.JPG" [0072.727] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.728] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.728] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.728] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.728] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02810J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" [0072.728] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG", pszSpec="*.zip") returned 0 [0072.728] lstrlenA (lpString="*.zip") returned 5 [0072.728] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG", pszSpec="*.rar") returned 0 [0072.728] lstrlenA (lpString="*.rar") returned 5 [0072.728] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG", pszSpec="*.7z") returned 0 [0072.728] lstrlenA (lpString="*.7z") returned 4 [0072.728] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG", pszSpec="*.tar") returned 0 [0072.728] lstrlenA (lpString="*.tar") returned 5 [0072.728] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG", pszSpec="*.gzip") returned 0 [0072.728] lstrlenA (lpString="*.gzip") returned 6 [0072.728] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG", pszSpec="*.jpg") returned 1 [0072.728] lstrlenA (lpString="*.jpg") returned 5 [0072.728] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" [0072.728] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" [0072.728] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG." [0072.728] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.BD" [0072.728] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0072.728] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc5d7 [0072.729] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca89e75c, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0072.729] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.729] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xc57b, lpOverlapped=0x0) returned 1 [0072.734] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG") returned="PH02810J.JPG" [0072.736] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.736] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xc57b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xc57b, lpOverlapped=0x0) returned 1 [0072.736] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0072.736] CloseHandle (hObject=0x1cc) returned 1 [0072.736] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg.bd")) returned 1 [0072.737] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca8a4909, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xf438, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02829J.JPG", cAlternateFileName="")) returned 1 [0072.737] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.737] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02829J.JPG") returned -1 [0072.737] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02829J.JPG") returned -1 [0072.737] lstrcmpiA (lpString1="", lpString2="PH02829J.JPG") returned -1 [0072.737] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG") returned="PH02810J.JPG" [0072.737] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.737] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.737] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.737] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.737] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02829J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" [0072.737] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG", pszSpec="*.zip") returned 0 [0072.737] lstrlenA (lpString="*.zip") returned 5 [0072.737] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG", pszSpec="*.rar") returned 0 [0072.737] lstrlenA (lpString="*.rar") returned 5 [0072.737] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG", pszSpec="*.7z") returned 0 [0072.737] lstrlenA (lpString="*.7z") returned 4 [0072.737] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG", pszSpec="*.tar") returned 0 [0072.737] lstrlenA (lpString="*.tar") returned 5 [0072.738] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG", pszSpec="*.gzip") returned 0 [0072.738] lstrlenA (lpString="*.gzip") returned 6 [0072.738] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG", pszSpec="*.jpg") returned 1 [0072.738] lstrlenA (lpString="*.jpg") returned 5 [0072.738] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" [0072.738] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" [0072.738] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG." [0072.738] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.BD" [0072.738] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0072.739] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf438 [0072.739] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca8a4909, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0072.739] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.739] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xf3dc, lpOverlapped=0x0) returned 1 [0072.742] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG") returned="PH02829J.JPG" [0072.744] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.744] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xf3dc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xf3dc, lpOverlapped=0x0) returned 1 [0072.744] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0072.744] CloseHandle (hObject=0x1cc) returned 1 [0072.744] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg.bd")) returned 1 [0072.745] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca8a974f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x30f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02845G.GIF", cAlternateFileName="")) returned 1 [0072.745] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.745] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02845G.GIF") returned -1 [0072.745] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02845G.GIF") returned -1 [0072.745] lstrcmpiA (lpString1="", lpString2="PH02845G.GIF") returned -1 [0072.745] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG") returned="PH02829J.JPG" [0072.745] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.745] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.745] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.745] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.745] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02845G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" [0072.745] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF", pszSpec="*.zip") returned 0 [0072.745] lstrlenA (lpString="*.zip") returned 5 [0072.745] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF", pszSpec="*.rar") returned 0 [0072.745] lstrlenA (lpString="*.rar") returned 5 [0072.745] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF", pszSpec="*.7z") returned 0 [0072.746] lstrlenA (lpString="*.7z") returned 4 [0072.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF", pszSpec="*.tar") returned 0 [0072.746] lstrlenA (lpString="*.tar") returned 5 [0072.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF", pszSpec="*.gzip") returned 0 [0072.746] lstrlenA (lpString="*.gzip") returned 6 [0072.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF", pszSpec="*.jpg") returned 0 [0072.746] lstrlenA (lpString="*.jpg") returned 5 [0072.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF", pszSpec="*.jpeg") returned 0 [0072.746] lstrlenA (lpString="*.jpeg") returned 6 [0072.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF", pszSpec="*.psd") returned 0 [0072.746] lstrlenA (lpString="*.psd") returned 5 [0072.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF", pszSpec="*.cdr") returned 0 [0072.746] lstrlenA (lpString="*.cdr") returned 5 [0072.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF", pszSpec="*.dwg") returned 0 [0072.746] lstrlenA (lpString="*.dwg") returned 5 [0072.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF", pszSpec="*.max") returned 0 [0072.746] lstrlenA (lpString="*.max") returned 5 [0072.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF", pszSpec="*.bmp") returned 0 [0072.746] lstrlenA (lpString="*.bmp") returned 5 [0072.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF", pszSpec="*.gif") returned 1 [0072.746] lstrlenA (lpString="*.gif") returned 5 [0072.746] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" [0072.746] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" [0072.746] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF." [0072.746] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.BD" [0072.746] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0072.746] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x30f2 [0072.747] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca8a974f, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0072.747] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.747] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x3096, lpOverlapped=0x0) returned 1 [0072.779] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF") returned="PH02845G.GIF" [0072.780] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.780] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x3096, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x3096, lpOverlapped=0x0) returned 1 [0072.780] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0072.780] CloseHandle (hObject=0x1cc) returned 1 [0072.780] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02845g.gif.bd")) returned 1 [0072.781] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca8b0c17, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3c45, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02897J.JPG", cAlternateFileName="")) returned 1 [0072.781] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.781] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH02897J.JPG") returned -1 [0072.781] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH02897J.JPG") returned -1 [0072.781] lstrcmpiA (lpString1="", lpString2="PH02897J.JPG") returned -1 [0072.781] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF") returned="PH02845G.GIF" [0072.781] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.781] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.781] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.781] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.781] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH02897J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" [0072.781] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG", pszSpec="*.zip") returned 0 [0072.781] lstrlenA (lpString="*.zip") returned 5 [0072.781] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG", pszSpec="*.rar") returned 0 [0072.781] lstrlenA (lpString="*.rar") returned 5 [0072.781] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG", pszSpec="*.7z") returned 0 [0072.781] lstrlenA (lpString="*.7z") returned 4 [0072.782] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG", pszSpec="*.tar") returned 0 [0072.782] lstrlenA (lpString="*.tar") returned 5 [0072.782] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG", pszSpec="*.gzip") returned 0 [0072.782] lstrlenA (lpString="*.gzip") returned 6 [0072.782] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG", pszSpec="*.jpg") returned 1 [0072.782] lstrlenA (lpString="*.jpg") returned 5 [0072.782] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" [0072.782] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" [0072.782] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG." [0072.782] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.BD" [0072.782] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0072.783] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c45 [0072.783] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca8b0c17, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0072.783] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.783] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x3be9, lpOverlapped=0x0) returned 1 [0072.785] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG") returned="PH02897J.JPG" [0072.785] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.785] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x3be9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x3be9, lpOverlapped=0x0) returned 1 [0072.785] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0072.786] CloseHandle (hObject=0x1cc) returned 1 [0072.786] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg.bd")) returned 1 [0072.786] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85c0dde, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3c76, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03011U.BMP", cAlternateFileName="")) returned 1 [0072.786] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.786] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH03011U.BMP") returned -1 [0072.786] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH03011U.BMP") returned -1 [0072.786] lstrcmpiA (lpString1="", lpString2="PH03011U.BMP") returned -1 [0072.786] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG") returned="PH02897J.JPG" [0072.786] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.786] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.786] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.786] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.787] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH03011U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" [0072.787] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP", pszSpec="*.zip") returned 0 [0072.787] lstrlenA (lpString="*.zip") returned 5 [0072.787] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP", pszSpec="*.rar") returned 0 [0072.787] lstrlenA (lpString="*.rar") returned 5 [0072.787] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP", pszSpec="*.7z") returned 0 [0072.787] lstrlenA (lpString="*.7z") returned 4 [0072.787] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP", pszSpec="*.tar") returned 0 [0072.787] lstrlenA (lpString="*.tar") returned 5 [0072.787] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP", pszSpec="*.gzip") returned 0 [0072.787] lstrlenA (lpString="*.gzip") returned 6 [0072.787] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP", pszSpec="*.jpg") returned 0 [0072.787] lstrlenA (lpString="*.jpg") returned 5 [0072.787] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP", pszSpec="*.jpeg") returned 0 [0072.787] lstrlenA (lpString="*.jpeg") returned 6 [0072.787] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP", pszSpec="*.psd") returned 0 [0072.787] lstrlenA (lpString="*.psd") returned 5 [0072.787] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP", pszSpec="*.cdr") returned 0 [0072.787] lstrlenA (lpString="*.cdr") returned 5 [0072.787] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP", pszSpec="*.dwg") returned 0 [0072.787] lstrlenA (lpString="*.dwg") returned 5 [0072.787] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP", pszSpec="*.max") returned 0 [0072.787] lstrlenA (lpString="*.max") returned 5 [0072.787] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP", pszSpec="*.bmp") returned 1 [0072.787] lstrlenA (lpString="*.bmp") returned 5 [0072.787] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" [0072.787] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" [0072.787] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP." [0072.787] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.BD" [0072.787] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0072.788] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c76 [0072.788] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb85c0dde, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0072.788] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.788] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x3c1a, lpOverlapped=0x0) returned 1 [0072.789] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP") returned="PH03011U.BMP" [0072.790] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.790] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x3c1a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x3c1a, lpOverlapped=0x0) returned 1 [0072.790] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0072.790] CloseHandle (hObject=0x1cc) returned 1 [0072.790] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp.bd")) returned 1 [0072.791] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85c5c6f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1016, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03012U.BMP", cAlternateFileName="")) returned 1 [0072.791] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.791] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH03012U.BMP") returned -1 [0072.791] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH03012U.BMP") returned -1 [0072.791] lstrcmpiA (lpString1="", lpString2="PH03012U.BMP") returned -1 [0072.791] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP") returned="PH03011U.BMP" [0072.791] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.791] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.791] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.791] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.791] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH03012U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" [0072.791] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP", pszSpec="*.zip") returned 0 [0072.791] lstrlenA (lpString="*.zip") returned 5 [0072.791] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP", pszSpec="*.rar") returned 0 [0072.791] lstrlenA (lpString="*.rar") returned 5 [0072.792] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP", pszSpec="*.7z") returned 0 [0072.792] lstrlenA (lpString="*.7z") returned 4 [0072.792] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP", pszSpec="*.tar") returned 0 [0072.792] lstrlenA (lpString="*.tar") returned 5 [0072.792] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP", pszSpec="*.gzip") returned 0 [0072.792] lstrlenA (lpString="*.gzip") returned 6 [0072.792] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP", pszSpec="*.jpg") returned 0 [0072.792] lstrlenA (lpString="*.jpg") returned 5 [0072.792] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP", pszSpec="*.jpeg") returned 0 [0072.792] lstrlenA (lpString="*.jpeg") returned 6 [0072.792] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP", pszSpec="*.psd") returned 0 [0072.792] lstrlenA (lpString="*.psd") returned 5 [0072.792] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP", pszSpec="*.cdr") returned 0 [0072.792] lstrlenA (lpString="*.cdr") returned 5 [0072.792] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP", pszSpec="*.dwg") returned 0 [0072.792] lstrlenA (lpString="*.dwg") returned 5 [0072.792] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP", pszSpec="*.max") returned 0 [0072.792] lstrlenA (lpString="*.max") returned 5 [0072.792] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP", pszSpec="*.bmp") returned 1 [0072.792] lstrlenA (lpString="*.bmp") returned 5 [0072.792] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" [0072.792] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" [0072.792] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP." [0072.792] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.BD" [0072.792] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0072.792] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1016 [0072.793] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb85c5c6f, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0072.793] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.793] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xfba, lpOverlapped=0x0) returned 1 [0072.827] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP") returned="PH03012U.BMP" [0072.827] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.827] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xfba, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xfba, lpOverlapped=0x0) returned 1 [0072.827] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0072.827] CloseHandle (hObject=0x1cc) returned 1 [0072.827] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp.bd")) returned 1 [0072.828] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca8b4712, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x49d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03014_.GIF", cAlternateFileName="")) returned 1 [0072.828] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.838] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH03014_.GIF") returned -1 [0072.838] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH03014_.GIF") returned -1 [0072.838] lstrcmpiA (lpString1="", lpString2="PH03014_.GIF") returned -1 [0072.838] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP") returned="PH03012U.BMP" [0072.838] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.838] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.838] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.838] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.838] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH03014_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" [0072.838] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF", pszSpec="*.zip") returned 0 [0072.838] lstrlenA (lpString="*.zip") returned 5 [0072.838] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF", pszSpec="*.rar") returned 0 [0072.838] lstrlenA (lpString="*.rar") returned 5 [0072.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF", pszSpec="*.7z") returned 0 [0072.839] lstrlenA (lpString="*.7z") returned 4 [0072.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF", pszSpec="*.tar") returned 0 [0072.839] lstrlenA (lpString="*.tar") returned 5 [0072.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF", pszSpec="*.gzip") returned 0 [0072.839] lstrlenA (lpString="*.gzip") returned 6 [0072.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF", pszSpec="*.jpg") returned 0 [0072.839] lstrlenA (lpString="*.jpg") returned 5 [0072.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF", pszSpec="*.jpeg") returned 0 [0072.839] lstrlenA (lpString="*.jpeg") returned 6 [0072.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF", pszSpec="*.psd") returned 0 [0072.839] lstrlenA (lpString="*.psd") returned 5 [0072.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF", pszSpec="*.cdr") returned 0 [0072.839] lstrlenA (lpString="*.cdr") returned 5 [0072.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF", pszSpec="*.dwg") returned 0 [0072.839] lstrlenA (lpString="*.dwg") returned 5 [0072.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF", pszSpec="*.max") returned 0 [0072.839] lstrlenA (lpString="*.max") returned 5 [0072.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF", pszSpec="*.bmp") returned 0 [0072.839] lstrlenA (lpString="*.bmp") returned 5 [0072.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF", pszSpec="*.gif") returned 1 [0072.839] lstrlenA (lpString="*.gif") returned 5 [0072.839] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" [0072.839] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" [0072.839] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF." [0072.839] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.BD" [0072.840] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0072.840] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x49d2 [0072.840] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca8b4712, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0072.840] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.840] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x4976, lpOverlapped=0x0) returned 1 [0072.842] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF") returned="PH03014_.GIF" [0072.843] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.843] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x4976, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x4976, lpOverlapped=0x0) returned 1 [0072.843] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0072.843] CloseHandle (hObject=0x1cc) returned 1 [0072.843] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03014_.gif.bd")) returned 1 [0072.844] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85cbe2f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x78af, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03041I.JPG", cAlternateFileName="")) returned 1 [0072.844] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.844] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH03041I.JPG") returned -1 [0072.844] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH03041I.JPG") returned -1 [0072.844] lstrcmpiA (lpString1="", lpString2="PH03041I.JPG") returned -1 [0072.844] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF") returned="PH03014_.GIF" [0072.844] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.844] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.844] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.844] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.844] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH03041I.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" [0072.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG", pszSpec="*.zip") returned 0 [0072.844] lstrlenA (lpString="*.zip") returned 5 [0072.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG", pszSpec="*.rar") returned 0 [0072.844] lstrlenA (lpString="*.rar") returned 5 [0072.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG", pszSpec="*.7z") returned 0 [0072.844] lstrlenA (lpString="*.7z") returned 4 [0072.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG", pszSpec="*.tar") returned 0 [0072.844] lstrlenA (lpString="*.tar") returned 5 [0072.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG", pszSpec="*.gzip") returned 0 [0072.844] lstrlenA (lpString="*.gzip") returned 6 [0072.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG", pszSpec="*.jpg") returned 1 [0072.844] lstrlenA (lpString="*.jpg") returned 5 [0072.845] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" [0072.845] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" [0072.845] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG." [0072.845] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.BD" [0072.845] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0072.846] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x78af [0072.846] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb85cbe2f, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0072.846] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.846] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x7853, lpOverlapped=0x0) returned 1 [0072.885] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG") returned="PH03041I.JPG" [0072.886] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.886] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x7853, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x7853, lpOverlapped=0x0) returned 1 [0072.886] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0072.886] CloseHandle (hObject=0x1cc) returned 1 [0072.886] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg.bd")) returned 1 [0072.887] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca8bbc1a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7450, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03143I.JPG", cAlternateFileName="")) returned 1 [0072.887] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.887] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH03143I.JPG") returned -1 [0072.887] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH03143I.JPG") returned -1 [0072.887] lstrcmpiA (lpString1="", lpString2="PH03143I.JPG") returned -1 [0072.887] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG") returned="PH03041I.JPG" [0072.887] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.887] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.887] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.887] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.887] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH03143I.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" [0072.887] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG", pszSpec="*.zip") returned 0 [0072.887] lstrlenA (lpString="*.zip") returned 5 [0072.887] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG", pszSpec="*.rar") returned 0 [0072.887] lstrlenA (lpString="*.rar") returned 5 [0072.888] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG", pszSpec="*.7z") returned 0 [0072.888] lstrlenA (lpString="*.7z") returned 4 [0072.888] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG", pszSpec="*.tar") returned 0 [0072.888] lstrlenA (lpString="*.tar") returned 5 [0072.888] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG", pszSpec="*.gzip") returned 0 [0072.888] lstrlenA (lpString="*.gzip") returned 6 [0072.888] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG", pszSpec="*.jpg") returned 1 [0072.888] lstrlenA (lpString="*.jpg") returned 5 [0072.888] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" [0072.888] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" [0072.888] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG." [0072.888] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.BD" [0072.888] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0072.888] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7450 [0072.888] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca8bbc1a, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0072.888] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.888] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x73f4, lpOverlapped=0x0) returned 1 [0072.892] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG") returned="PH03143I.JPG" [0072.893] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.893] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x73f4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x73f4, lpOverlapped=0x0) returned 1 [0072.893] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0072.893] CloseHandle (hObject=0x1cc) returned 1 [0072.893] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg.bd")) returned 1 [0072.896] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca8c0a10, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa343, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03205I.JPG", cAlternateFileName="")) returned 1 [0072.896] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.896] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH03205I.JPG") returned -1 [0072.896] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH03205I.JPG") returned -1 [0072.896] lstrcmpiA (lpString1="", lpString2="PH03205I.JPG") returned -1 [0072.896] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG") returned="PH03143I.JPG" [0072.896] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.896] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.896] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.896] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.896] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH03205I.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" [0072.897] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG", pszSpec="*.zip") returned 0 [0072.897] lstrlenA (lpString="*.zip") returned 5 [0072.897] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG", pszSpec="*.rar") returned 0 [0072.897] lstrlenA (lpString="*.rar") returned 5 [0072.897] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG", pszSpec="*.7z") returned 0 [0072.897] lstrlenA (lpString="*.7z") returned 4 [0072.897] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG", pszSpec="*.tar") returned 0 [0072.897] lstrlenA (lpString="*.tar") returned 5 [0072.897] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG", pszSpec="*.gzip") returned 0 [0072.897] lstrlenA (lpString="*.gzip") returned 6 [0072.897] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG", pszSpec="*.jpg") returned 1 [0072.897] lstrlenA (lpString="*.jpg") returned 5 [0072.897] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" [0072.897] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" [0072.897] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG." [0072.897] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.BD" [0072.897] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0072.897] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa343 [0072.897] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xca8c0a10, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0072.898] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.898] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xa2e7, lpOverlapped=0x0) returned 1 [0072.904] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG") returned="PH03205I.JPG" [0072.906] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.906] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xa2e7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xa2e7, lpOverlapped=0x0) returned 1 [0072.906] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0072.906] CloseHandle (hObject=0x1cc) returned 1 [0072.906] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg.bd")) returned 1 [0072.907] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85d1fb8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa445, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03224I.JPG", cAlternateFileName="")) returned 1 [0072.907] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.907] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH03224I.JPG") returned -1 [0072.907] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH03224I.JPG") returned -1 [0072.907] lstrcmpiA (lpString1="", lpString2="PH03224I.JPG") returned -1 [0072.907] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG") returned="PH03205I.JPG" [0072.907] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.907] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.907] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.907] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.907] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH03224I.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" [0072.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG", pszSpec="*.zip") returned 0 [0072.907] lstrlenA (lpString="*.zip") returned 5 [0072.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG", pszSpec="*.rar") returned 0 [0072.908] lstrlenA (lpString="*.rar") returned 5 [0072.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG", pszSpec="*.7z") returned 0 [0072.908] lstrlenA (lpString="*.7z") returned 4 [0072.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG", pszSpec="*.tar") returned 0 [0072.908] lstrlenA (lpString="*.tar") returned 5 [0072.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG", pszSpec="*.gzip") returned 0 [0072.908] lstrlenA (lpString="*.gzip") returned 6 [0072.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG", pszSpec="*.jpg") returned 1 [0072.908] lstrlenA (lpString="*.jpg") returned 5 [0072.908] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" [0072.908] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" [0072.908] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG." [0072.908] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.BD" [0072.908] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0072.908] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa445 [0072.908] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb85d1fb8, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0072.908] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.908] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xa3e9, lpOverlapped=0x0) returned 1 [0072.947] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG") returned="PH03224I.JPG" [0072.949] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.949] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xa3e9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xa3e9, lpOverlapped=0x0) returned 1 [0072.949] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0072.949] CloseHandle (hObject=0x1cc) returned 1 [0072.949] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg.bd")) returned 1 [0072.950] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85d8128, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2ba2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03379I.JPG", cAlternateFileName="")) returned 1 [0072.950] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.950] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH03379I.JPG") returned -1 [0072.950] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH03379I.JPG") returned -1 [0072.950] lstrcmpiA (lpString1="", lpString2="PH03379I.JPG") returned -1 [0072.950] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG") returned="PH03224I.JPG" [0072.950] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.950] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.950] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.950] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.951] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH03379I.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" [0072.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG", pszSpec="*.zip") returned 0 [0072.951] lstrlenA (lpString="*.zip") returned 5 [0072.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG", pszSpec="*.rar") returned 0 [0072.951] lstrlenA (lpString="*.rar") returned 5 [0072.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG", pszSpec="*.7z") returned 0 [0072.951] lstrlenA (lpString="*.7z") returned 4 [0072.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG", pszSpec="*.tar") returned 0 [0072.951] lstrlenA (lpString="*.tar") returned 5 [0072.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG", pszSpec="*.gzip") returned 0 [0072.951] lstrlenA (lpString="*.gzip") returned 6 [0072.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG", pszSpec="*.jpg") returned 1 [0072.951] lstrlenA (lpString="*.jpg") returned 5 [0072.951] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" [0072.951] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" [0072.951] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG." [0072.951] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.BD" [0072.951] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0072.951] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ba2 [0072.951] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb85d8128, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0072.952] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.952] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x2b46, lpOverlapped=0x0) returned 1 [0072.955] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG") returned="PH03379I.JPG" [0072.955] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.955] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x2b46, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x2b46, lpOverlapped=0x0) returned 1 [0072.955] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0072.956] CloseHandle (hObject=0x1cc) returned 1 [0072.956] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg.bd")) returned 1 [0072.956] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85dcf40, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x321f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03380I.JPG", cAlternateFileName="")) returned 1 [0072.957] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.957] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH03380I.JPG") returned -1 [0072.957] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH03380I.JPG") returned -1 [0072.957] lstrcmpiA (lpString1="", lpString2="PH03380I.JPG") returned -1 [0072.957] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG") returned="PH03379I.JPG" [0072.957] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.957] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.957] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.957] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.957] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH03380I.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" [0072.957] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG", pszSpec="*.zip") returned 0 [0072.957] lstrlenA (lpString="*.zip") returned 5 [0072.957] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG", pszSpec="*.rar") returned 0 [0072.957] lstrlenA (lpString="*.rar") returned 5 [0072.957] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG", pszSpec="*.7z") returned 0 [0072.957] lstrlenA (lpString="*.7z") returned 4 [0072.957] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG", pszSpec="*.tar") returned 0 [0072.957] lstrlenA (lpString="*.tar") returned 5 [0072.957] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG", pszSpec="*.gzip") returned 0 [0072.957] lstrlenA (lpString="*.gzip") returned 6 [0072.957] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG", pszSpec="*.jpg") returned 1 [0072.957] lstrlenA (lpString="*.jpg") returned 5 [0072.957] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" [0072.957] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" [0072.957] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG." [0072.957] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.BD" [0072.958] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0072.958] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x321f [0072.958] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb85dcf40, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0072.958] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.958] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x31c3, lpOverlapped=0x0) returned 1 [0072.963] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG") returned="PH03380I.JPG" [0072.964] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.964] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x31c3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x31c3, lpOverlapped=0x0) returned 1 [0072.964] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0072.964] CloseHandle (hObject=0x1cc) returned 1 [0072.964] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg.bd")) returned 1 [0072.965] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85e6b9c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xbdae, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03425I.JPG", cAlternateFileName="")) returned 1 [0072.965] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.965] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PH03425I.JPG") returned -1 [0072.965] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PH03425I.JPG") returned -1 [0072.965] lstrcmpiA (lpString1="", lpString2="PH03425I.JPG") returned -1 [0072.965] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG") returned="PH03380I.JPG" [0072.966] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.966] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.966] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.966] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.966] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PH03425I.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" [0072.966] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG", pszSpec="*.zip") returned 0 [0072.966] lstrlenA (lpString="*.zip") returned 5 [0072.966] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG", pszSpec="*.rar") returned 0 [0072.966] lstrlenA (lpString="*.rar") returned 5 [0072.966] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG", pszSpec="*.7z") returned 0 [0072.966] lstrlenA (lpString="*.7z") returned 4 [0072.966] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG", pszSpec="*.tar") returned 0 [0072.966] lstrlenA (lpString="*.tar") returned 5 [0072.966] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG", pszSpec="*.gzip") returned 0 [0072.966] lstrlenA (lpString="*.gzip") returned 6 [0072.966] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG", pszSpec="*.jpg") returned 1 [0072.966] lstrlenA (lpString="*.jpg") returned 5 [0072.966] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" [0072.966] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" [0072.966] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG." [0072.967] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.BD" [0072.967] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0072.970] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbdae [0072.970] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb85e6b9c, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0072.970] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.970] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xbd52, lpOverlapped=0x0) returned 1 [0072.974] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG") returned="PH03425I.JPG" [0072.976] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0072.976] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xbd52, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xbd52, lpOverlapped=0x0) returned 1 [0072.976] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0072.976] CloseHandle (hObject=0x1cc) returned 1 [0072.976] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg.bd")) returned 1 [0072.977] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4f3e00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb89de563, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8d4f3e00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xef6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRRT.WMF", cAlternateFileName="")) returned 1 [0072.977] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.977] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PRRT.WMF") returned -1 [0072.977] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PRRT.WMF") returned -1 [0072.977] lstrcmpiA (lpString1="", lpString2="PRRT.WMF") returned -1 [0072.977] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG") returned="PH03425I.JPG" [0072.977] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.978] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.978] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.978] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.978] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PRRT.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" [0072.978] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.zip") returned 0 [0072.978] lstrlenA (lpString="*.zip") returned 5 [0072.978] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.rar") returned 0 [0072.978] lstrlenA (lpString="*.rar") returned 5 [0072.978] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.7z") returned 0 [0072.978] lstrlenA (lpString="*.7z") returned 4 [0072.978] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.tar") returned 0 [0072.978] lstrlenA (lpString="*.tar") returned 5 [0072.978] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.gzip") returned 0 [0072.978] lstrlenA (lpString="*.gzip") returned 6 [0072.978] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.jpg") returned 0 [0072.978] lstrlenA (lpString="*.jpg") returned 5 [0072.978] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.jpeg") returned 0 [0072.978] lstrlenA (lpString="*.jpeg") returned 6 [0072.978] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.psd") returned 0 [0072.978] lstrlenA (lpString="*.psd") returned 5 [0072.978] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.cdr") returned 0 [0072.978] lstrlenA (lpString="*.cdr") returned 5 [0072.978] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.dwg") returned 0 [0072.979] lstrlenA (lpString="*.dwg") returned 5 [0072.979] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.max") returned 0 [0072.979] lstrlenA (lpString="*.max") returned 5 [0072.979] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.bmp") returned 0 [0072.979] lstrlenA (lpString="*.bmp") returned 5 [0072.979] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.gif") returned 0 [0072.979] lstrlenA (lpString="*.gif") returned 5 [0072.979] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.png") returned 0 [0072.979] lstrlenA (lpString="*.png") returned 5 [0072.979] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.doc") returned 0 [0072.979] lstrlenA (lpString="*.doc") returned 5 [0072.979] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.docx") returned 0 [0072.979] lstrlenA (lpString="*.docx") returned 6 [0072.979] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.xls") returned 0 [0072.979] lstrlenA (lpString="*.xls") returned 5 [0072.979] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.xlsx") returned 0 [0072.979] lstrlenA (lpString="*.xlsx") returned 6 [0072.979] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.ppt") returned 0 [0072.979] lstrlenA (lpString="*.ppt") returned 5 [0072.979] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.pptx") returned 0 [0072.979] lstrlenA (lpString="*.pptx") returned 6 [0072.979] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.txt") returned 0 [0072.979] lstrlenA (lpString="*.txt") returned 5 [0072.979] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.pdf") returned 0 [0072.979] lstrlenA (lpString="*.pdf") returned 5 [0072.980] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.djvu") returned 0 [0072.980] lstrlenA (lpString="*.djvu") returned 6 [0072.980] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.htm") returned 0 [0072.980] lstrlenA (lpString="*.htm") returned 5 [0072.980] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.html") returned 0 [0072.980] lstrlenA (lpString="*.html") returned 6 [0072.980] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.mdb") returned 0 [0072.980] lstrlenA (lpString="*.mdb") returned 5 [0072.980] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.cer") returned 0 [0072.980] lstrlenA (lpString="*.cer") returned 5 [0072.980] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.p12") returned 0 [0072.980] lstrlenA (lpString="*.p12") returned 5 [0072.980] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.pfx") returned 0 [0072.980] lstrlenA (lpString="*.pfx") returned 5 [0072.980] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.kwm") returned 0 [0072.980] lstrlenA (lpString="*.kwm") returned 5 [0072.980] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.pwm") returned 0 [0072.980] lstrlenA (lpString="*.pwm") returned 5 [0072.980] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.1cd") returned 0 [0072.980] lstrlenA (lpString="*.1cd") returned 5 [0072.980] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.md") returned 0 [0072.980] lstrlenA (lpString="*.md") returned 4 [0072.980] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.mdf") returned 0 [0072.980] lstrlenA (lpString="*.mdf") returned 5 [0072.981] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.dbf") returned 0 [0072.981] lstrlenA (lpString="*.dbf") returned 5 [0072.981] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.odt") returned 0 [0072.981] lstrlenA (lpString="*.odt") returned 5 [0072.981] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.vob") returned 0 [0072.981] lstrlenA (lpString="*.vob") returned 5 [0072.981] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.ifo") returned 0 [0072.981] lstrlenA (lpString="*.ifo") returned 5 [0072.981] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.lnk") returned 0 [0072.981] lstrlenA (lpString="*.lnk") returned 5 [0072.981] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.torrent") returned 0 [0072.981] lstrlenA (lpString="*.torrent") returned 9 [0072.981] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.mov") returned 0 [0072.981] lstrlenA (lpString="*.mov") returned 5 [0072.981] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.m2v") returned 0 [0072.981] lstrlenA (lpString="*.m2v") returned 5 [0072.981] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.3gp") returned 0 [0072.981] lstrlenA (lpString="*.3gp") returned 5 [0072.981] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.mpeg") returned 0 [0072.981] lstrlenA (lpString="*.mpeg") returned 6 [0072.981] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.mpg") returned 0 [0072.981] lstrlenA (lpString="*.mpg") returned 5 [0072.981] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.flv") returned 0 [0072.981] lstrlenA (lpString="*.flv") returned 5 [0072.982] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.avi") returned 0 [0072.982] lstrlenA (lpString="*.avi") returned 5 [0072.982] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.mp4") returned 0 [0072.982] lstrlenA (lpString="*.mp4") returned 5 [0072.982] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.wmv") returned 0 [0072.982] lstrlenA (lpString="*.wmv") returned 5 [0072.982] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.divx") returned 0 [0072.982] lstrlenA (lpString="*.divx") returned 6 [0072.982] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.mkv") returned 0 [0072.982] lstrlenA (lpString="*.mkv") returned 5 [0072.982] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.mp3") returned 0 [0072.982] lstrlenA (lpString="*.mp3") returned 5 [0072.982] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.wav") returned 0 [0072.982] lstrlenA (lpString="*.wav") returned 5 [0072.982] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.flac") returned 0 [0072.982] lstrlenA (lpString="*.flac") returned 6 [0072.982] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.ape") returned 0 [0072.982] lstrlenA (lpString="*.ape") returned 5 [0072.982] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.wma") returned 0 [0072.982] lstrlenA (lpString="*.wma") returned 5 [0072.982] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.ac3") returned 0 [0072.982] lstrlenA (lpString="*.ac3") returned 5 [0072.982] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4f3e00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcaa4605d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8d4f3e00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7aac, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRRTINST.WMF", cAlternateFileName="")) returned 1 [0072.982] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.982] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PRRTINST.WMF") returned -1 [0072.983] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PRRTINST.WMF") returned -1 [0072.983] lstrcmpiA (lpString1="", lpString2="PRRTINST.WMF") returned -1 [0072.983] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF") returned="PRRT.WMF" [0072.983] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.983] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.983] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.983] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.983] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PRRTINST.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" [0072.983] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.zip") returned 0 [0072.983] lstrlenA (lpString="*.zip") returned 5 [0072.983] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.rar") returned 0 [0072.983] lstrlenA (lpString="*.rar") returned 5 [0072.983] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.7z") returned 0 [0072.983] lstrlenA (lpString="*.7z") returned 4 [0072.983] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.tar") returned 0 [0072.983] lstrlenA (lpString="*.tar") returned 5 [0072.983] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.gzip") returned 0 [0072.983] lstrlenA (lpString="*.gzip") returned 6 [0072.983] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.jpg") returned 0 [0072.983] lstrlenA (lpString="*.jpg") returned 5 [0072.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.jpeg") returned 0 [0072.984] lstrlenA (lpString="*.jpeg") returned 6 [0072.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.psd") returned 0 [0072.984] lstrlenA (lpString="*.psd") returned 5 [0072.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.cdr") returned 0 [0072.984] lstrlenA (lpString="*.cdr") returned 5 [0072.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.dwg") returned 0 [0072.984] lstrlenA (lpString="*.dwg") returned 5 [0072.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.max") returned 0 [0072.984] lstrlenA (lpString="*.max") returned 5 [0072.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.bmp") returned 0 [0072.984] lstrlenA (lpString="*.bmp") returned 5 [0072.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.gif") returned 0 [0072.984] lstrlenA (lpString="*.gif") returned 5 [0072.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.png") returned 0 [0072.984] lstrlenA (lpString="*.png") returned 5 [0072.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.doc") returned 0 [0072.984] lstrlenA (lpString="*.doc") returned 5 [0072.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.docx") returned 0 [0072.984] lstrlenA (lpString="*.docx") returned 6 [0072.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.xls") returned 0 [0072.984] lstrlenA (lpString="*.xls") returned 5 [0072.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.xlsx") returned 0 [0072.985] lstrlenA (lpString="*.xlsx") returned 6 [0072.985] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.ppt") returned 0 [0072.985] lstrlenA (lpString="*.ppt") returned 5 [0072.985] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.pptx") returned 0 [0072.985] lstrlenA (lpString="*.pptx") returned 6 [0072.985] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.txt") returned 0 [0072.985] lstrlenA (lpString="*.txt") returned 5 [0072.985] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.pdf") returned 0 [0072.985] lstrlenA (lpString="*.pdf") returned 5 [0072.985] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.djvu") returned 0 [0072.985] lstrlenA (lpString="*.djvu") returned 6 [0072.985] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.htm") returned 0 [0072.985] lstrlenA (lpString="*.htm") returned 5 [0072.985] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.html") returned 0 [0072.985] lstrlenA (lpString="*.html") returned 6 [0072.985] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.mdb") returned 0 [0072.985] lstrlenA (lpString="*.mdb") returned 5 [0072.985] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.cer") returned 0 [0072.985] lstrlenA (lpString="*.cer") returned 5 [0072.985] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.p12") returned 0 [0072.985] lstrlenA (lpString="*.p12") returned 5 [0072.985] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.pfx") returned 0 [0072.985] lstrlenA (lpString="*.pfx") returned 5 [0072.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.kwm") returned 0 [0072.986] lstrlenA (lpString="*.kwm") returned 5 [0072.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.pwm") returned 0 [0072.986] lstrlenA (lpString="*.pwm") returned 5 [0072.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.1cd") returned 0 [0072.986] lstrlenA (lpString="*.1cd") returned 5 [0072.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.md") returned 0 [0072.986] lstrlenA (lpString="*.md") returned 4 [0072.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.mdf") returned 0 [0072.986] lstrlenA (lpString="*.mdf") returned 5 [0072.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.dbf") returned 0 [0072.986] lstrlenA (lpString="*.dbf") returned 5 [0072.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.odt") returned 0 [0072.986] lstrlenA (lpString="*.odt") returned 5 [0072.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.vob") returned 0 [0072.986] lstrlenA (lpString="*.vob") returned 5 [0072.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.ifo") returned 0 [0072.986] lstrlenA (lpString="*.ifo") returned 5 [0072.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.lnk") returned 0 [0072.986] lstrlenA (lpString="*.lnk") returned 5 [0072.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.torrent") returned 0 [0072.986] lstrlenA (lpString="*.torrent") returned 9 [0072.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.mov") returned 0 [0072.986] lstrlenA (lpString="*.mov") returned 5 [0072.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.m2v") returned 0 [0072.986] lstrlenA (lpString="*.m2v") returned 5 [0072.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.3gp") returned 0 [0072.987] lstrlenA (lpString="*.3gp") returned 5 [0072.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.mpeg") returned 0 [0072.987] lstrlenA (lpString="*.mpeg") returned 6 [0072.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.mpg") returned 0 [0072.987] lstrlenA (lpString="*.mpg") returned 5 [0072.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.flv") returned 0 [0072.987] lstrlenA (lpString="*.flv") returned 5 [0072.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.avi") returned 0 [0072.987] lstrlenA (lpString="*.avi") returned 5 [0072.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.mp4") returned 0 [0072.987] lstrlenA (lpString="*.mp4") returned 5 [0072.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.wmv") returned 0 [0072.987] lstrlenA (lpString="*.wmv") returned 5 [0072.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.divx") returned 0 [0072.987] lstrlenA (lpString="*.divx") returned 6 [0072.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.mkv") returned 0 [0072.987] lstrlenA (lpString="*.mkv") returned 5 [0072.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.mp3") returned 0 [0072.987] lstrlenA (lpString="*.mp3") returned 5 [0072.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.wav") returned 0 [0072.987] lstrlenA (lpString="*.wav") returned 5 [0072.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.flac") returned 0 [0072.987] lstrlenA (lpString="*.flac") returned 6 [0072.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.ape") returned 0 [0072.988] lstrlenA (lpString="*.ape") returned 5 [0072.988] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.wma") returned 0 [0072.988] lstrlenA (lpString="*.wma") returned 5 [0072.988] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.ac3") returned 0 [0072.988] lstrlenA (lpString="*.ac3") returned 5 [0072.988] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcaa4fc70, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRETRO.WMF", cAlternateFileName="")) returned 1 [0072.988] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.988] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PSRETRO.WMF") returned -1 [0072.988] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PSRETRO.WMF") returned -1 [0072.988] lstrcmpiA (lpString1="", lpString2="PSRETRO.WMF") returned -1 [0072.988] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF") returned="PRRTINST.WMF" [0072.988] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.988] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.988] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.988] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.988] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PSRETRO.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" [0072.988] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.zip") returned 0 [0072.988] lstrlenA (lpString="*.zip") returned 5 [0072.988] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.rar") returned 0 [0072.988] lstrlenA (lpString="*.rar") returned 5 [0072.988] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.7z") returned 0 [0072.988] lstrlenA (lpString="*.7z") returned 4 [0072.989] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.tar") returned 0 [0072.989] lstrlenA (lpString="*.tar") returned 5 [0072.989] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.gzip") returned 0 [0072.989] lstrlenA (lpString="*.gzip") returned 6 [0072.989] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.jpg") returned 0 [0072.989] lstrlenA (lpString="*.jpg") returned 5 [0072.989] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.jpeg") returned 0 [0072.989] lstrlenA (lpString="*.jpeg") returned 6 [0072.989] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.psd") returned 0 [0072.994] lstrlenA (lpString="*.psd") returned 5 [0072.994] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.cdr") returned 0 [0072.994] lstrlenA (lpString="*.cdr") returned 5 [0072.994] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.dwg") returned 0 [0072.994] lstrlenA (lpString="*.dwg") returned 5 [0072.994] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.max") returned 0 [0072.994] lstrlenA (lpString="*.max") returned 5 [0072.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.bmp") returned 0 [0072.995] lstrlenA (lpString="*.bmp") returned 5 [0072.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.gif") returned 0 [0072.995] lstrlenA (lpString="*.gif") returned 5 [0072.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.png") returned 0 [0072.995] lstrlenA (lpString="*.png") returned 5 [0072.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.doc") returned 0 [0072.995] lstrlenA (lpString="*.doc") returned 5 [0072.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.docx") returned 0 [0072.995] lstrlenA (lpString="*.docx") returned 6 [0072.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.xls") returned 0 [0072.995] lstrlenA (lpString="*.xls") returned 5 [0072.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.xlsx") returned 0 [0072.995] lstrlenA (lpString="*.xlsx") returned 6 [0072.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.ppt") returned 0 [0072.995] lstrlenA (lpString="*.ppt") returned 5 [0072.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.pptx") returned 0 [0072.995] lstrlenA (lpString="*.pptx") returned 6 [0072.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.txt") returned 0 [0072.995] lstrlenA (lpString="*.txt") returned 5 [0072.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.pdf") returned 0 [0072.995] lstrlenA (lpString="*.pdf") returned 5 [0072.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.djvu") returned 0 [0072.995] lstrlenA (lpString="*.djvu") returned 6 [0072.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.htm") returned 0 [0072.995] lstrlenA (lpString="*.htm") returned 5 [0072.996] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.html") returned 0 [0072.996] lstrlenA (lpString="*.html") returned 6 [0072.996] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.mdb") returned 0 [0072.996] lstrlenA (lpString="*.mdb") returned 5 [0072.996] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.cer") returned 0 [0072.996] lstrlenA (lpString="*.cer") returned 5 [0072.996] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.p12") returned 0 [0072.996] lstrlenA (lpString="*.p12") returned 5 [0072.996] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.pfx") returned 0 [0072.996] lstrlenA (lpString="*.pfx") returned 5 [0072.996] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.kwm") returned 0 [0072.996] lstrlenA (lpString="*.kwm") returned 5 [0072.996] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.pwm") returned 0 [0072.996] lstrlenA (lpString="*.pwm") returned 5 [0072.996] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.1cd") returned 0 [0072.996] lstrlenA (lpString="*.1cd") returned 5 [0072.996] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.md") returned 0 [0072.996] lstrlenA (lpString="*.md") returned 4 [0072.996] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.mdf") returned 0 [0072.996] lstrlenA (lpString="*.mdf") returned 5 [0072.996] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.dbf") returned 0 [0072.996] lstrlenA (lpString="*.dbf") returned 5 [0072.996] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.odt") returned 0 [0072.996] lstrlenA (lpString="*.odt") returned 5 [0072.996] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.vob") returned 0 [0072.996] lstrlenA (lpString="*.vob") returned 5 [0072.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.ifo") returned 0 [0072.997] lstrlenA (lpString="*.ifo") returned 5 [0072.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.lnk") returned 0 [0072.997] lstrlenA (lpString="*.lnk") returned 5 [0072.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.torrent") returned 0 [0072.997] lstrlenA (lpString="*.torrent") returned 9 [0072.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.mov") returned 0 [0072.997] lstrlenA (lpString="*.mov") returned 5 [0072.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.m2v") returned 0 [0072.997] lstrlenA (lpString="*.m2v") returned 5 [0072.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.3gp") returned 0 [0072.997] lstrlenA (lpString="*.3gp") returned 5 [0072.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.mpeg") returned 0 [0072.997] lstrlenA (lpString="*.mpeg") returned 6 [0072.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.mpg") returned 0 [0072.997] lstrlenA (lpString="*.mpg") returned 5 [0072.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.flv") returned 0 [0072.997] lstrlenA (lpString="*.flv") returned 5 [0072.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.avi") returned 0 [0072.997] lstrlenA (lpString="*.avi") returned 5 [0072.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.mp4") returned 0 [0072.997] lstrlenA (lpString="*.mp4") returned 5 [0072.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.wmv") returned 0 [0072.997] lstrlenA (lpString="*.wmv") returned 5 [0072.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.divx") returned 0 [0072.997] lstrlenA (lpString="*.divx") returned 6 [0072.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.mkv") returned 0 [0072.998] lstrlenA (lpString="*.mkv") returned 5 [0072.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.mp3") returned 0 [0072.998] lstrlenA (lpString="*.mp3") returned 5 [0072.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.wav") returned 0 [0072.998] lstrlenA (lpString="*.wav") returned 5 [0072.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.flac") returned 0 [0072.998] lstrlenA (lpString="*.flac") returned 6 [0072.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.ape") returned 0 [0072.998] lstrlenA (lpString="*.ape") returned 5 [0072.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.wma") returned 0 [0072.998] lstrlenA (lpString="*.wma") returned 5 [0072.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.ac3") returned 0 [0072.998] lstrlenA (lpString="*.ac3") returned 5 [0072.998] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb89f6beb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSSKETLG.WMF", cAlternateFileName="")) returned 1 [0072.998] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0072.998] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PSSKETLG.WMF") returned -1 [0072.998] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PSSKETLG.WMF") returned -1 [0072.998] lstrcmpiA (lpString1="", lpString2="PSSKETLG.WMF") returned -1 [0072.998] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF") returned="PSRETRO.WMF" [0072.998] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0072.998] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0072.998] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0072.998] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0072.999] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PSSKETLG.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" [0072.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.zip") returned 0 [0072.999] lstrlenA (lpString="*.zip") returned 5 [0072.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.rar") returned 0 [0072.999] lstrlenA (lpString="*.rar") returned 5 [0072.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.7z") returned 0 [0072.999] lstrlenA (lpString="*.7z") returned 4 [0072.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.tar") returned 0 [0072.999] lstrlenA (lpString="*.tar") returned 5 [0072.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.gzip") returned 0 [0072.999] lstrlenA (lpString="*.gzip") returned 6 [0072.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.jpg") returned 0 [0072.999] lstrlenA (lpString="*.jpg") returned 5 [0072.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.jpeg") returned 0 [0072.999] lstrlenA (lpString="*.jpeg") returned 6 [0072.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.psd") returned 0 [0072.999] lstrlenA (lpString="*.psd") returned 5 [0072.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.cdr") returned 0 [0072.999] lstrlenA (lpString="*.cdr") returned 5 [0072.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.dwg") returned 0 [0072.999] lstrlenA (lpString="*.dwg") returned 5 [0072.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.max") returned 0 [0072.999] lstrlenA (lpString="*.max") returned 5 [0072.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.bmp") returned 0 [0072.999] lstrlenA (lpString="*.bmp") returned 5 [0073.000] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.gif") returned 0 [0073.000] lstrlenA (lpString="*.gif") returned 5 [0073.000] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.png") returned 0 [0073.000] lstrlenA (lpString="*.png") returned 5 [0073.000] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.doc") returned 0 [0073.000] lstrlenA (lpString="*.doc") returned 5 [0073.000] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.docx") returned 0 [0073.000] lstrlenA (lpString="*.docx") returned 6 [0073.000] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.xls") returned 0 [0073.000] lstrlenA (lpString="*.xls") returned 5 [0073.000] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.xlsx") returned 0 [0073.000] lstrlenA (lpString="*.xlsx") returned 6 [0073.000] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.ppt") returned 0 [0073.000] lstrlenA (lpString="*.ppt") returned 5 [0073.000] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.pptx") returned 0 [0073.000] lstrlenA (lpString="*.pptx") returned 6 [0073.000] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.txt") returned 0 [0073.000] lstrlenA (lpString="*.txt") returned 5 [0073.000] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.pdf") returned 0 [0073.000] lstrlenA (lpString="*.pdf") returned 5 [0073.000] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.djvu") returned 0 [0073.000] lstrlenA (lpString="*.djvu") returned 6 [0073.000] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.htm") returned 0 [0073.000] lstrlenA (lpString="*.htm") returned 5 [0073.000] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.html") returned 0 [0073.000] lstrlenA (lpString="*.html") returned 6 [0073.000] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.mdb") returned 0 [0073.001] lstrlenA (lpString="*.mdb") returned 5 [0073.001] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.cer") returned 0 [0073.001] lstrlenA (lpString="*.cer") returned 5 [0073.001] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.p12") returned 0 [0073.001] lstrlenA (lpString="*.p12") returned 5 [0073.001] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.pfx") returned 0 [0073.001] lstrlenA (lpString="*.pfx") returned 5 [0073.001] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.kwm") returned 0 [0073.001] lstrlenA (lpString="*.kwm") returned 5 [0073.001] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.pwm") returned 0 [0073.001] lstrlenA (lpString="*.pwm") returned 5 [0073.001] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.1cd") returned 0 [0073.001] lstrlenA (lpString="*.1cd") returned 5 [0073.001] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.md") returned 0 [0073.001] lstrlenA (lpString="*.md") returned 4 [0073.001] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.mdf") returned 0 [0073.001] lstrlenA (lpString="*.mdf") returned 5 [0073.001] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.dbf") returned 0 [0073.001] lstrlenA (lpString="*.dbf") returned 5 [0073.001] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.odt") returned 0 [0073.001] lstrlenA (lpString="*.odt") returned 5 [0073.001] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.vob") returned 0 [0073.001] lstrlenA (lpString="*.vob") returned 5 [0073.001] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.ifo") returned 0 [0073.001] lstrlenA (lpString="*.ifo") returned 5 [0073.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.lnk") returned 0 [0073.002] lstrlenA (lpString="*.lnk") returned 5 [0073.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.torrent") returned 0 [0073.002] lstrlenA (lpString="*.torrent") returned 9 [0073.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.mov") returned 0 [0073.002] lstrlenA (lpString="*.mov") returned 5 [0073.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.m2v") returned 0 [0073.002] lstrlenA (lpString="*.m2v") returned 5 [0073.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.3gp") returned 0 [0073.002] lstrlenA (lpString="*.3gp") returned 5 [0073.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.mpeg") returned 0 [0073.002] lstrlenA (lpString="*.mpeg") returned 6 [0073.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.mpg") returned 0 [0073.002] lstrlenA (lpString="*.mpg") returned 5 [0073.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.flv") returned 0 [0073.002] lstrlenA (lpString="*.flv") returned 5 [0073.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.avi") returned 0 [0073.002] lstrlenA (lpString="*.avi") returned 5 [0073.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.mp4") returned 0 [0073.002] lstrlenA (lpString="*.mp4") returned 5 [0073.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.wmv") returned 0 [0073.002] lstrlenA (lpString="*.wmv") returned 5 [0073.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.divx") returned 0 [0073.002] lstrlenA (lpString="*.divx") returned 6 [0073.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.mkv") returned 0 [0073.002] lstrlenA (lpString="*.mkv") returned 5 [0073.003] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.mp3") returned 0 [0073.003] lstrlenA (lpString="*.mp3") returned 5 [0073.003] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.wav") returned 0 [0073.003] lstrlenA (lpString="*.wav") returned 5 [0073.003] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.flac") returned 0 [0073.003] lstrlenA (lpString="*.flac") returned 6 [0073.003] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.ape") returned 0 [0073.003] lstrlenA (lpString="*.ape") returned 5 [0073.003] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.wma") returned 0 [0073.003] lstrlenA (lpString="*.wma") returned 5 [0073.003] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.ac3") returned 0 [0073.003] lstrlenA (lpString="*.ac3") returned 5 [0073.003] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcaa586ca, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x776, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSSKETSM.WMF", cAlternateFileName="")) returned 1 [0073.003] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.003] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PSSKETSM.WMF") returned -1 [0073.003] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PSSKETSM.WMF") returned -1 [0073.003] lstrcmpiA (lpString1="", lpString2="PSSKETSM.WMF") returned -1 [0073.003] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF") returned="PSSKETLG.WMF" [0073.003] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.003] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.004] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.004] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.004] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PSSKETSM.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" [0073.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF", pszSpec="*.zip") returned 0 [0073.004] lstrlenA (lpString="*.zip") returned 5 [0073.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF", pszSpec="*.rar") returned 0 [0073.004] lstrlenA (lpString="*.rar") returned 5 [0073.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF", pszSpec="*.7z") returned 0 [0073.004] lstrlenA (lpString="*.7z") returned 4 [0073.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF", pszSpec="*.tar") returned 0 [0073.004] lstrlenA (lpString="*.tar") returned 5 [0073.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF", pszSpec="*.gzip") returned 0 [0073.004] lstrlenA (lpString="*.gzip") returned 6 [0073.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF", pszSpec="*.jpg") returned 0 [0073.004] lstrlenA (lpString="*.jpg") returned 5 [0073.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF", pszSpec="*.jpeg") returned 0 [0073.004] lstrlenA (lpString="*.jpeg") returned 6 [0073.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF", pszSpec="*.psd") returned 0 [0073.004] lstrlenA (lpString="*.psd") returned 5 [0073.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF", pszSpec="*.cdr") returned 0 [0073.004] lstrlenA (lpString="*.cdr") returned 5 [0073.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF", pszSpec="*.dwg") returned 0 [0073.005] lstrlenA (lpString="*.dwg") returned 5 [0073.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF", pszSpec="*.max") returned 0 [0073.005] lstrlenA (lpString="*.max") returned 5 [0073.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF", pszSpec="*.bmp") returned 0 [0073.005] lstrlenA (lpString="*.bmp") returned 5 [0073.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF", pszSpec="*.gif") returned 0 [0073.005] lstrlenA (lpString="*.gif") returned 5 [0073.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF", pszSpec="*.png") returned 0 [0073.005] lstrlenA (lpString="*.png") returned 5 [0073.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF", pszSpec="*.doc") returned 0 [0073.005] lstrlenA (lpString="*.doc") returned 5 [0073.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF", pszSpec="*.docx") returned 0 [0073.005] lstrlenA (lpString="*.docx") returned 6 [0073.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF", pszSpec="*.xls") returned 0 [0073.005] lstrlenA (lpString="*.xls") returned 5 [0073.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF", pszSpec="*.xlsx") returned 0 [0073.005] lstrlenA (lpString="*.xlsx") returned 6 [0073.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF", pszSpec="*.ppt") returned 0 [0073.005] lstrlenA (lpString="*.ppt") returned 5 [0073.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF", pszSpec="*.pptx") returned 0 [0073.005] lstrlenA (lpString="*.pptx") returned 6 [0073.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF", pszSpec="*.txt") returned 0 [0073.005] lstrlenA (lpString="*.txt") returned 5 [0073.006] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb89fbad2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb12, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSWAVY.WMF", cAlternateFileName="")) returned 1 [0073.006] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.006] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PSWAVY.WMF") returned -1 [0073.006] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PSWAVY.WMF") returned -1 [0073.006] lstrcmpiA (lpString1="", lpString2="PSWAVY.WMF") returned -1 [0073.006] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF") returned="PSSKETSM.WMF" [0073.006] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.006] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.006] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.006] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.006] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="PSWAVY.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" [0073.006] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcaaf2228, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="RE00006_.WMF", cAlternateFileName="")) returned 1 [0073.007] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.007] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RE00006_.WMF") returned -1 [0073.007] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RE00006_.WMF") returned -1 [0073.007] lstrcmpiA (lpString1="", lpString2="RE00006_.WMF") returned -1 [0073.007] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF") returned="PSWAVY.WMF" [0073.007] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.007] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.007] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.007] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.007] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="RE00006_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" [0073.007] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4f3e00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcaafe575, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8d4f3e00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd16, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECYCLE.WMF", cAlternateFileName="")) returned 1 [0073.007] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.007] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RECYCLE.WMF") returned -1 [0073.007] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RECYCLE.WMF") returned -1 [0073.007] lstrcmpiA (lpString1="", lpString2="RECYCLE.WMF") returned -1 [0073.007] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF") returned="RE00006_.WMF" [0073.007] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.007] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.007] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.007] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.008] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="RECYCLE.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" [0073.008] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcabb3002, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x175f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ROAD_01.MID", cAlternateFileName="")) returned 1 [0073.009] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.009] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ROAD_01.MID") returned -1 [0073.009] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ROAD_01.MID") returned -1 [0073.009] lstrcmpiA (lpString1="", lpString2="ROAD_01.MID") returned -1 [0073.009] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF") returned="RECYCLE.WMF" [0073.009] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.009] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.010] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.010] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.010] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="ROAD_01.MID" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" [0073.010] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb125928, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x278a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAFRI_01.MID", cAlternateFileName="")) returned 1 [0073.010] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.010] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SAFRI_01.MID") returned -1 [0073.010] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SAFRI_01.MID") returned -1 [0073.010] lstrcmpiA (lpString1="", lpString2="SAFRI_01.MID") returned -1 [0073.010] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned="ROAD_01.MID" [0073.010] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.010] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.010] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.010] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.010] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SAFRI_01.MID" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" [0073.010] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb148f38, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x13c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHOL_02.MID", cAlternateFileName="")) returned 1 [0073.010] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.011] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHOL_02.MID") returned -1 [0073.011] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHOL_02.MID") returned -1 [0073.011] lstrcmpiA (lpString1="", lpString2="SCHOL_02.MID") returned -1 [0073.011] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned="SAFRI_01.MID" [0073.011] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.011] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.011] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.011] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.011] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SCHOL_02.MID" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" [0073.011] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb91d9e55, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x18f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHOW_01.MID", cAlternateFileName="")) returned 1 [0073.011] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.011] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SHOW_01.MID") returned -1 [0073.011] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SHOW_01.MID") returned -1 [0073.011] lstrcmpiA (lpString1="", lpString2="SHOW_01.MID") returned -1 [0073.011] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned="SCHOL_02.MID" [0073.011] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.011] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.011] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.011] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.012] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SHOW_01.MID" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" [0073.012] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb922cd1b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2a0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00256_.WMF", cAlternateFileName="")) returned 1 [0073.012] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.012] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SL00256_.WMF") returned -1 [0073.012] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SL00256_.WMF") returned -1 [0073.012] lstrcmpiA (lpString1="", lpString2="SL00256_.WMF") returned -1 [0073.012] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned="SHOW_01.MID" [0073.012] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.012] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.012] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.012] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.012] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SL00256_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" [0073.012] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb212680, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7ca4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00260_.WMF", cAlternateFileName="")) returned 1 [0073.012] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.012] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SL00260_.WMF") returned -1 [0073.012] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SL00260_.WMF") returned -1 [0073.013] lstrcmpiA (lpString1="", lpString2="SL00260_.WMF") returned -1 [0073.013] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF") returned="SL00256_.WMF" [0073.013] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.013] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.013] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.013] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.013] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SL00260_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" [0073.013] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb2173fb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xf5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00268_.WMF", cAlternateFileName="")) returned 1 [0073.013] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.013] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SL00268_.WMF") returned -1 [0073.013] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SL00268_.WMF") returned -1 [0073.013] lstrcmpiA (lpString1="", lpString2="SL00268_.WMF") returned -1 [0073.013] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF") returned="SL00260_.WMF" [0073.013] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.013] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.013] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.013] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.013] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SL00268_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" [0073.014] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9232e8e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1dac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00286_.WMF", cAlternateFileName="")) returned 1 [0073.014] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.014] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SL00286_.WMF") returned -1 [0073.014] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SL00286_.WMF") returned -1 [0073.014] lstrcmpiA (lpString1="", lpString2="SL00286_.WMF") returned -1 [0073.014] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF") returned="SL00268_.WMF" [0073.014] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.014] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.014] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.014] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.014] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SL00286_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" [0073.014] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb21c369, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1268, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00298_.WMF", cAlternateFileName="")) returned 1 [0073.014] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.014] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SL00298_.WMF") returned -1 [0073.014] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SL00298_.WMF") returned -1 [0073.014] lstrcmpiA (lpString1="", lpString2="SL00298_.WMF") returned -1 [0073.014] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF") returned="SL00286_.WMF" [0073.014] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.015] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.015] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.015] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.015] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SL00298_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" [0073.015] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb923691e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x20e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00308_.WMF", cAlternateFileName="")) returned 1 [0073.015] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.015] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SL00308_.WMF") returned -1 [0073.015] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SL00308_.WMF") returned -1 [0073.015] lstrcmpiA (lpString1="", lpString2="SL00308_.WMF") returned -1 [0073.015] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF") returned="SL00298_.WMF" [0073.015] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.015] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.015] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.015] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.015] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SL00308_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" [0073.015] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb221029, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xae4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00345_.WMF", cAlternateFileName="")) returned 1 [0073.016] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.016] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SL00345_.WMF") returned -1 [0073.016] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SL00345_.WMF") returned -1 [0073.016] lstrcmpiA (lpString1="", lpString2="SL00345_.WMF") returned -1 [0073.016] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF") returned="SL00308_.WMF" [0073.016] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.016] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.016] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.016] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.016] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SL00345_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" [0073.016] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb923cb35, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00452_.WMF", cAlternateFileName="")) returned 1 [0073.016] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.016] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SL00452_.WMF") returned -1 [0073.016] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SL00452_.WMF") returned -1 [0073.016] lstrcmpiA (lpString1="", lpString2="SL00452_.WMF") returned -1 [0073.016] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF") returned="SL00345_.WMF" [0073.016] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.016] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.016] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.017] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.017] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SL00452_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" [0073.017] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb225f7f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00712_.WMF", cAlternateFileName="")) returned 1 [0073.017] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.017] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SL00712_.WMF") returned -1 [0073.017] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SL00712_.WMF") returned -1 [0073.017] lstrcmpiA (lpString1="", lpString2="SL00712_.WMF") returned -1 [0073.017] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF") returned="SL00452_.WMF" [0073.017] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.017] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.017] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.017] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.017] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SL00712_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" [0073.017] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9241912, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xcdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL01040_.WMF", cAlternateFileName="")) returned 1 [0073.017] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.018] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SL01040_.WMF") returned -1 [0073.018] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SL01040_.WMF") returned -1 [0073.018] lstrcmpiA (lpString1="", lpString2="SL01040_.WMF") returned -1 [0073.018] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF") returned="SL00712_.WMF" [0073.018] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.018] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.018] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.018] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.018] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SL01040_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" [0073.018] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb2299b9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL01041_.WMF", cAlternateFileName="")) returned 1 [0073.018] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.018] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SL01041_.WMF") returned -1 [0073.018] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SL01041_.WMF") returned -1 [0073.018] lstrcmpiA (lpString1="", lpString2="SL01041_.WMF") returned -1 [0073.018] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF") returned="SL01040_.WMF" [0073.018] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.018] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.018] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.018] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.019] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SL01041_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" [0073.019] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb230e23, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1b04, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL01394_.WMF", cAlternateFileName="")) returned 1 [0073.020] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.020] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SL01394_.WMF") returned -1 [0073.020] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SL01394_.WMF") returned -1 [0073.020] lstrcmpiA (lpString1="", lpString2="SL01394_.WMF") returned -1 [0073.020] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF") returned="SL01041_.WMF" [0073.020] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.020] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.020] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.020] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.020] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SL01394_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" [0073.020] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb235da2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL01395_.WMF", cAlternateFileName="")) returned 1 [0073.020] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.020] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SL01395_.WMF") returned -1 [0073.020] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SL01395_.WMF") returned -1 [0073.020] lstrcmpiA (lpString1="", lpString2="SL01395_.WMF") returned -1 [0073.020] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF") returned="SL01394_.WMF" [0073.021] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.021] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.021] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.021] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.021] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SL01395_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" [0073.021] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9246736, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6cc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL01565_.WMF", cAlternateFileName="")) returned 1 [0073.021] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.021] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SL01565_.WMF") returned -1 [0073.021] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SL01565_.WMF") returned -1 [0073.021] lstrcmpiA (lpString1="", lpString2="SL01565_.WMF") returned -1 [0073.021] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF") returned="SL01395_.WMF" [0073.021] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.021] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.021] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.021] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.021] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SL01565_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" [0073.021] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb928fb31, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x36aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00017_.WMF", cAlternateFileName="")) returned 1 [0073.021] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.021] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00017_.WMF") returned -1 [0073.021] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00017_.WMF") returned -1 [0073.021] lstrcmpiA (lpString1="", lpString2="SO00017_.WMF") returned -1 [0073.022] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF") returned="SL01565_.WMF" [0073.022] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.022] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.022] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.022] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.022] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00017_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" [0073.022] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9294928, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x32f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00018_.WMF", cAlternateFileName="")) returned 1 [0073.022] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.022] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00018_.WMF") returned -1 [0073.022] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00018_.WMF") returned -1 [0073.022] lstrcmpiA (lpString1="", lpString2="SO00018_.WMF") returned -1 [0073.022] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF") returned="SO00017_.WMF" [0073.022] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.022] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.022] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.022] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.022] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00018_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" [0073.022] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb266a15, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7a80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00152_.WMF", cAlternateFileName="")) returned 1 [0073.022] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.022] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00152_.WMF") returned -1 [0073.022] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00152_.WMF") returned -1 [0073.022] lstrcmpiA (lpString1="", lpString2="SO00152_.WMF") returned -1 [0073.022] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF") returned="SO00018_.WMF" [0073.023] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.023] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.023] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.023] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.023] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00152_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" [0073.023] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb26b80c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4754, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00157_.WMF", cAlternateFileName="")) returned 1 [0073.023] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.023] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00157_.WMF") returned -1 [0073.023] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00157_.WMF") returned -1 [0073.023] lstrcmpiA (lpString1="", lpString2="SO00157_.WMF") returned -1 [0073.023] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF") returned="SO00152_.WMF" [0073.023] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.023] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.023] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.023] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.023] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00157_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" [0073.023] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb26f222, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00159_.WMF", cAlternateFileName="")) returned 1 [0073.023] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.023] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00159_.WMF") returned -1 [0073.023] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00159_.WMF") returned -1 [0073.023] lstrcmpiA (lpString1="", lpString2="SO00159_.WMF") returned -1 [0073.023] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF") returned="SO00157_.WMF" [0073.023] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.024] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.024] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.024] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.024] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00159_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" [0073.024] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9299756, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x35b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00166_.WMF", cAlternateFileName="")) returned 1 [0073.024] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.024] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00166_.WMF") returned -1 [0073.024] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00166_.WMF") returned -1 [0073.024] lstrcmpiA (lpString1="", lpString2="SO00166_.WMF") returned -1 [0073.024] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF") returned="SO00159_.WMF" [0073.024] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.024] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.024] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.024] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.024] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00166_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" [0073.024] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb929e55c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00168_.WMF", cAlternateFileName="")) returned 1 [0073.024] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.024] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00168_.WMF") returned -1 [0073.024] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00168_.WMF") returned -1 [0073.024] lstrcmpiA (lpString1="", lpString2="SO00168_.WMF") returned -1 [0073.024] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF") returned="SO00166_.WMF" [0073.024] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.024] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.025] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.025] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.025] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00168_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" [0073.025] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb27677b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2242, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00170_.WMF", cAlternateFileName="")) returned 1 [0073.025] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.025] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00170_.WMF") returned -1 [0073.025] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00170_.WMF") returned -1 [0073.025] lstrcmpiA (lpString1="", lpString2="SO00170_.WMF") returned -1 [0073.025] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF") returned="SO00168_.WMF" [0073.025] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.025] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.025] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.025] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.025] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00170_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" [0073.025] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb27b59c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8f0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00177_.WMF", cAlternateFileName="")) returned 1 [0073.025] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.025] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00177_.WMF") returned -1 [0073.025] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00177_.WMF") returned -1 [0073.025] lstrcmpiA (lpString1="", lpString2="SO00177_.WMF") returned -1 [0073.025] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF") returned="SO00170_.WMF" [0073.025] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.026] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.026] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.026] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.026] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00177_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" [0073.026] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb92a4758, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x283c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00183_.WMF", cAlternateFileName="")) returned 1 [0073.026] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.026] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00183_.WMF") returned -1 [0073.026] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00183_.WMF") returned -1 [0073.026] lstrcmpiA (lpString1="", lpString2="SO00183_.WMF") returned -1 [0073.026] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF") returned="SO00177_.WMF" [0073.026] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.026] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.026] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.026] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.026] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00183_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" [0073.027] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb2803ec, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x514c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00190_.WMF", cAlternateFileName="")) returned 1 [0073.027] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.027] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00190_.WMF") returned -1 [0073.027] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00190_.WMF") returned -1 [0073.027] lstrcmpiA (lpString1="", lpString2="SO00190_.WMF") returned -1 [0073.027] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF") returned="SO00183_.WMF" [0073.027] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.027] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.027] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.027] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.027] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00190_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" [0073.027] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb2865d0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2090, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00191_.WMF", cAlternateFileName="")) returned 1 [0073.027] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.027] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00191_.WMF") returned -1 [0073.027] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00191_.WMF") returned -1 [0073.027] lstrcmpiA (lpString1="", lpString2="SO00191_.WMF") returned -1 [0073.027] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF") returned="SO00190_.WMF" [0073.027] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.027] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.027] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.028] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.028] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00191_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" [0073.028] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb92a9517, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x280c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00192_.WMF", cAlternateFileName="")) returned 1 [0073.028] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.028] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00192_.WMF") returned -1 [0073.028] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00192_.WMF") returned -1 [0073.028] lstrcmpiA (lpString1="", lpString2="SO00192_.WMF") returned -1 [0073.028] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF") returned="SO00191_.WMF" [0073.028] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.028] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.028] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.028] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.028] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00192_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" [0073.028] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb92ae3d2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x27c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00194_.WMF", cAlternateFileName="")) returned 1 [0073.028] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.029] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00194_.WMF") returned -1 [0073.029] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00194_.WMF") returned -1 [0073.029] lstrcmpiA (lpString1="", lpString2="SO00194_.WMF") returned -1 [0073.029] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF") returned="SO00192_.WMF" [0073.029] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.029] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.029] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.029] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.029] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00194_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" [0073.029] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb92b3131, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x238c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00197_.WMF", cAlternateFileName="")) returned 1 [0073.029] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.029] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00197_.WMF") returned -1 [0073.029] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00197_.WMF") returned -1 [0073.029] lstrcmpiA (lpString1="", lpString2="SO00197_.WMF") returned -1 [0073.029] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF") returned="SO00194_.WMF" [0073.029] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.029] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.029] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.029] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.030] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00197_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" [0073.030] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb92b9377, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x15fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00199_.WMF", cAlternateFileName="")) returned 1 [0073.030] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.030] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00199_.WMF") returned -1 [0073.030] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00199_.WMF") returned -1 [0073.030] lstrcmpiA (lpString1="", lpString2="SO00199_.WMF") returned -1 [0073.030] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF") returned="SO00197_.WMF" [0073.030] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.030] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.030] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.030] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.030] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00199_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" [0073.030] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb92bf4bb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2926, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00200_.WMF", cAlternateFileName="")) returned 1 [0073.134] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.134] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00200_.WMF") returned -1 [0073.134] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00200_.WMF") returned -1 [0073.134] lstrcmpiA (lpString1="", lpString2="SO00200_.WMF") returned -1 [0073.134] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF") returned="SO00199_.WMF" [0073.134] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.134] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.135] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.135] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.135] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00200_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" [0073.135] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb28c772, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00208_.WMF", cAlternateFileName="")) returned 1 [0073.135] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.135] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00208_.WMF") returned -1 [0073.135] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00208_.WMF") returned -1 [0073.135] lstrcmpiA (lpString1="", lpString2="SO00208_.WMF") returned -1 [0073.135] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF") returned="SO00200_.WMF" [0073.135] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.135] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.135] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.135] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.135] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00208_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" [0073.135] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb2928d7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4f72, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00212_.WMF", cAlternateFileName="")) returned 1 [0073.136] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.136] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00212_.WMF") returned -1 [0073.136] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00212_.WMF") returned -1 [0073.136] lstrcmpiA (lpString1="", lpString2="SO00212_.WMF") returned -1 [0073.136] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF") returned="SO00208_.WMF" [0073.136] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.136] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.136] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.136] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.136] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00212_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" [0073.136] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb92c42e4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1f74, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00221_.WMF", cAlternateFileName="")) returned 1 [0073.136] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.136] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00221_.WMF") returned -1 [0073.136] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00221_.WMF") returned -1 [0073.136] lstrcmpiA (lpString1="", lpString2="SO00221_.WMF") returned -1 [0073.136] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF") returned="SO00212_.WMF" [0073.136] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.136] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.136] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.136] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.137] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00221_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" [0073.137] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb29775e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1e5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00222_.WMF", cAlternateFileName="")) returned 1 [0073.137] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.137] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00222_.WMF") returned -1 [0073.137] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00222_.WMF") returned -1 [0073.137] lstrcmpiA (lpString1="", lpString2="SO00222_.WMF") returned -1 [0073.137] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF") returned="SO00221_.WMF" [0073.137] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.137] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.137] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.137] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.137] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00222_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" [0073.137] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb92c90f6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3642, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00223_.WMF", cAlternateFileName="")) returned 1 [0073.137] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.137] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00223_.WMF") returned -1 [0073.137] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00223_.WMF") returned -1 [0073.137] lstrcmpiA (lpString1="", lpString2="SO00223_.WMF") returned -1 [0073.137] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF") returned="SO00222_.WMF" [0073.137] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.138] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.138] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.138] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.138] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00223_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" [0073.138] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb92cf2ab, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x476e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00257_.WMF", cAlternateFileName="")) returned 1 [0073.138] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.138] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00257_.WMF") returned -1 [0073.138] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00257_.WMF") returned -1 [0073.138] lstrcmpiA (lpString1="", lpString2="SO00257_.WMF") returned -1 [0073.138] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF") returned="SO00223_.WMF" [0073.138] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.138] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.138] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.138] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.138] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00257_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" [0073.138] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb29d8cb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd8e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00289_.WMF", cAlternateFileName="")) returned 1 [0073.139] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.139] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00289_.WMF") returned -1 [0073.139] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00289_.WMF") returned -1 [0073.139] lstrcmpiA (lpString1="", lpString2="SO00289_.WMF") returned -1 [0073.139] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF") returned="SO00257_.WMF" [0073.139] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.139] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.139] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.139] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.139] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00289_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" [0073.139] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb92d679f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x10cb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00299_.WMF", cAlternateFileName="")) returned 1 [0073.139] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.139] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00299_.WMF") returned -1 [0073.139] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00299_.WMF") returned -1 [0073.139] lstrcmpiA (lpString1="", lpString2="SO00299_.WMF") returned -1 [0073.139] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF") returned="SO00289_.WMF" [0073.139] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.139] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.139] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.139] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.140] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00299_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" [0073.140] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb2a3a77, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7a04, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00305_.WMF", cAlternateFileName="")) returned 1 [0073.140] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.140] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00305_.WMF") returned -1 [0073.140] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00305_.WMF") returned -1 [0073.140] lstrcmpiA (lpString1="", lpString2="SO00305_.WMF") returned -1 [0073.140] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF") returned="SO00299_.WMF" [0073.140] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.140] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.140] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.140] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.140] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00305_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" [0073.140] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb2ac2d0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xee4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00333_.WMF", cAlternateFileName="")) returned 1 [0073.140] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.140] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00333_.WMF") returned -1 [0073.140] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00333_.WMF") returned -1 [0073.140] lstrcmpiA (lpString1="", lpString2="SO00333_.WMF") returned -1 [0073.140] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF") returned="SO00305_.WMF" [0073.140] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.140] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.141] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.141] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.141] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00333_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" [0073.141] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb92df0a8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8b96, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00345_.WMF", cAlternateFileName="")) returned 1 [0073.141] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.141] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00345_.WMF") returned -1 [0073.141] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00345_.WMF") returned -1 [0073.141] lstrcmpiA (lpString1="", lpString2="SO00345_.WMF") returned -1 [0073.141] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF") returned="SO00333_.WMF" [0073.141] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.141] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.141] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.141] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.141] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00345_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" [0073.141] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb2b24aa, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xbbe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00350_.WMF", cAlternateFileName="")) returned 1 [0073.141] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.141] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00350_.WMF") returned -1 [0073.142] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00350_.WMF") returned -1 [0073.142] lstrcmpiA (lpString1="", lpString2="SO00350_.WMF") returned -1 [0073.142] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF") returned="SO00345_.WMF" [0073.142] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.142] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.142] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.142] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.142] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00350_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" [0073.142] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb92e529c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x934c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00352_.WMF", cAlternateFileName="")) returned 1 [0073.142] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.142] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00352_.WMF") returned -1 [0073.142] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00352_.WMF") returned -1 [0073.142] lstrcmpiA (lpString1="", lpString2="SO00352_.WMF") returned -1 [0073.142] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF") returned="SO00350_.WMF" [0073.142] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.142] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.142] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.142] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.143] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00352_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" [0073.143] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb92ea0ed, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1948, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00364_.WMF", cAlternateFileName="")) returned 1 [0073.143] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.143] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00364_.WMF") returned -1 [0073.143] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00364_.WMF") returned -1 [0073.143] lstrcmpiA (lpString1="", lpString2="SO00364_.WMF") returned -1 [0073.143] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF") returned="SO00352_.WMF" [0073.143] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.143] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.143] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.143] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.143] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00364_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" [0073.143] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb92f01f2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x51ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00367_.WMF", cAlternateFileName="")) returned 1 [0073.143] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.143] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00367_.WMF") returned -1 [0073.143] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00367_.WMF") returned -1 [0073.143] lstrcmpiA (lpString1="", lpString2="SO00367_.WMF") returned -1 [0073.143] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF") returned="SO00364_.WMF" [0073.143] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.143] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.144] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.144] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.144] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00367_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" [0073.144] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb2b72d8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3308, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00373_.WMF", cAlternateFileName="")) returned 1 [0073.144] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.144] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00373_.WMF") returned -1 [0073.144] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00373_.WMF") returned -1 [0073.144] lstrcmpiA (lpString1="", lpString2="SO00373_.WMF") returned -1 [0073.144] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF") returned="SO00367_.WMF" [0073.144] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.144] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.144] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.144] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.145] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00373_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" [0073.145] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb2bd5ee, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x27f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00382_.WMF", cAlternateFileName="")) returned 1 [0073.145] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.145] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00382_.WMF") returned -1 [0073.145] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00382_.WMF") returned -1 [0073.145] lstrcmpiA (lpString1="", lpString2="SO00382_.WMF") returned -1 [0073.145] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF") returned="SO00373_.WMF" [0073.145] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.145] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.145] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.145] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.145] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00382_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" [0073.145] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb2c233c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00390_.WMF", cAlternateFileName="")) returned 1 [0073.145] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.145] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00390_.WMF") returned -1 [0073.145] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00390_.WMF") returned -1 [0073.145] lstrcmpiA (lpString1="", lpString2="SO00390_.WMF") returned -1 [0073.145] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF") returned="SO00382_.WMF" [0073.145] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.146] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.146] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.146] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.146] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00390_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" [0073.146] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb2c7094, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00391_.WMF", cAlternateFileName="")) returned 1 [0073.146] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.146] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00391_.WMF") returned -1 [0073.146] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00391_.WMF") returned -1 [0073.146] lstrcmpiA (lpString1="", lpString2="SO00391_.WMF") returned -1 [0073.146] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF") returned="SO00390_.WMF" [0073.146] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.146] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.146] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.146] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.146] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00391_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" [0073.146] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb2ce5ae, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x704e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00416_.WMF", cAlternateFileName="")) returned 1 [0073.146] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.147] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00416_.WMF") returned -1 [0073.147] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00416_.WMF") returned -1 [0073.147] lstrcmpiA (lpString1="", lpString2="SO00416_.WMF") returned -1 [0073.147] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF") returned="SO00391_.WMF" [0073.147] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.147] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.147] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.147] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.147] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00416_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" [0073.147] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb2d2042, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x143c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00423_.WMF", cAlternateFileName="")) returned 1 [0073.147] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.147] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00423_.WMF") returned -1 [0073.147] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00423_.WMF") returned -1 [0073.147] lstrcmpiA (lpString1="", lpString2="SO00423_.WMF") returned -1 [0073.147] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF") returned="SO00416_.WMF" [0073.147] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.147] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.147] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.147] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.147] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00423_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" [0073.148] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb2d6f59, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1544, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00444_.WMF", cAlternateFileName="")) returned 1 [0073.148] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.148] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00444_.WMF") returned -1 [0073.148] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00444_.WMF") returned -1 [0073.148] lstrcmpiA (lpString1="", lpString2="SO00444_.WMF") returned -1 [0073.148] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF") returned="SO00423_.WMF" [0073.148] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.148] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.148] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.148] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.148] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00444_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" [0073.148] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb92f5019, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00452_.WMF", cAlternateFileName="")) returned 1 [0073.148] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.148] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00452_.WMF") returned -1 [0073.148] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00452_.WMF") returned -1 [0073.148] lstrcmpiA (lpString1="", lpString2="SO00452_.WMF") returned -1 [0073.148] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF") returned="SO00444_.WMF" [0073.148] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.148] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.149] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.149] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.149] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00452_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" [0073.149] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb2de390, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x59ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00453_.WMF", cAlternateFileName="")) returned 1 [0073.149] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.149] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00453_.WMF") returned -1 [0073.149] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00453_.WMF") returned -1 [0073.149] lstrcmpiA (lpString1="", lpString2="SO00453_.WMF") returned -1 [0073.149] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF") returned="SO00452_.WMF" [0073.149] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.149] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.149] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.149] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.149] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00453_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" [0073.149] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb2e4554, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00454_.WMF", cAlternateFileName="")) returned 1 [0073.149] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.149] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00454_.WMF") returned -1 [0073.150] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00454_.WMF") returned -1 [0073.150] lstrcmpiA (lpString1="", lpString2="SO00454_.WMF") returned -1 [0073.150] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF") returned="SO00453_.WMF" [0073.150] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.150] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.150] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.150] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.150] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00454_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" [0073.150] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb92f8aa1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00466_.WMF", cAlternateFileName="")) returned 1 [0073.150] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.150] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00466_.WMF") returned -1 [0073.150] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00466_.WMF") returned -1 [0073.150] lstrcmpiA (lpString1="", lpString2="SO00466_.WMF") returned -1 [0073.150] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF") returned="SO00454_.WMF" [0073.150] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.150] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.150] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.150] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.150] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00466_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" [0073.151] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb92feca1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xfc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00476_.WMF", cAlternateFileName="")) returned 1 [0073.151] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.151] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00476_.WMF") returned -1 [0073.151] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00476_.WMF") returned -1 [0073.151] lstrcmpiA (lpString1="", lpString2="SO00476_.WMF") returned -1 [0073.151] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF") returned="SO00466_.WMF" [0073.151] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.151] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.151] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.151] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.151] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00476_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" [0073.151] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9304e3c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5b08, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00479_.WMF", cAlternateFileName="")) returned 1 [0073.151] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.151] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00479_.WMF") returned -1 [0073.151] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00479_.WMF") returned -1 [0073.151] lstrcmpiA (lpString1="", lpString2="SO00479_.WMF") returned -1 [0073.151] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF") returned="SO00476_.WMF" [0073.151] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.151] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.151] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.151] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.152] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00479_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" [0073.152] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb2e7ff6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2bb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00483_.WMF", cAlternateFileName="")) returned 1 [0073.152] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.152] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00483_.WMF") returned -1 [0073.152] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00483_.WMF") returned -1 [0073.152] lstrcmpiA (lpString1="", lpString2="SO00483_.WMF") returned -1 [0073.152] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF") returned="SO00479_.WMF" [0073.152] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.152] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.152] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.152] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.152] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00483_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" [0073.152] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb2ecddf, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00486_.WMF", cAlternateFileName="")) returned 1 [0073.152] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.152] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00486_.WMF") returned -1 [0073.152] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00486_.WMF") returned -1 [0073.152] lstrcmpiA (lpString1="", lpString2="SO00486_.WMF") returned -1 [0073.152] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF") returned="SO00483_.WMF" [0073.152] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.152] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.153] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.153] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.153] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00486_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" [0073.153] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb2f3023, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xaa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00505_.WMF", cAlternateFileName="")) returned 1 [0073.153] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.153] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00505_.WMF") returned -1 [0073.153] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00505_.WMF") returned -1 [0073.153] lstrcmpiA (lpString1="", lpString2="SO00505_.WMF") returned -1 [0073.153] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF") returned="SO00486_.WMF" [0073.153] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.153] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.153] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.153] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.153] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00505_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" [0073.153] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb2f91e8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1724, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00513_.WMF", cAlternateFileName="")) returned 1 [0073.154] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.154] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00513_.WMF") returned -1 [0073.154] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00513_.WMF") returned -1 [0073.154] lstrcmpiA (lpString1="", lpString2="SO00513_.WMF") returned -1 [0073.154] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF") returned="SO00505_.WMF" [0073.154] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.154] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.154] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.154] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.154] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00513_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" [0073.154] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb2fdf5c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2602, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00555_.WMF", cAlternateFileName="")) returned 1 [0073.154] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.154] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00555_.WMF") returned -1 [0073.154] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00555_.WMF") returned -1 [0073.154] lstrcmpiA (lpString1="", lpString2="SO00555_.WMF") returned -1 [0073.154] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF") returned="SO00513_.WMF" [0073.154] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.154] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.154] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.154] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.154] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00555_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" [0073.155] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb302d7c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6260, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00603_.WMF", cAlternateFileName="")) returned 1 [0073.158] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.158] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00603_.WMF") returned -1 [0073.158] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00603_.WMF") returned -1 [0073.158] lstrcmpiA (lpString1="", lpString2="SO00603_.WMF") returned -1 [0073.158] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF") returned="SO00555_.WMF" [0073.158] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.158] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.159] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.159] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.159] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00603_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" [0073.159] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb308f86, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x9c80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00610_.WMF", cAlternateFileName="")) returned 1 [0073.159] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.159] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00610_.WMF") returned -1 [0073.159] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00610_.WMF") returned -1 [0073.159] lstrcmpiA (lpString1="", lpString2="SO00610_.WMF") returned -1 [0073.159] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF") returned="SO00603_.WMF" [0073.159] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.159] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.160] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.160] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.160] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00610_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" [0073.160] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb30f0c5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xfe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00629_.WMF", cAlternateFileName="")) returned 1 [0073.160] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.160] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00629_.WMF") returned -1 [0073.160] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00629_.WMF") returned -1 [0073.160] lstrcmpiA (lpString1="", lpString2="SO00629_.WMF") returned -1 [0073.160] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF") returned="SO00610_.WMF" [0073.160] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.160] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.160] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.160] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.160] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00629_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" [0073.160] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb315386, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5006, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00633_.WMF", cAlternateFileName="")) returned 1 [0073.160] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.161] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00633_.WMF") returned -1 [0073.161] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00633_.WMF") returned -1 [0073.161] lstrcmpiA (lpString1="", lpString2="SO00633_.WMF") returned -1 [0073.161] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF") returned="SO00629_.WMF" [0073.161] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.161] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.161] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.161] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.161] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00633_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" [0073.161] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9309c13, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1aba, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00638_.WMF", cAlternateFileName="")) returned 1 [0073.161] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.161] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00638_.WMF") returned -1 [0073.161] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00638_.WMF") returned -1 [0073.161] lstrcmpiA (lpString1="", lpString2="SO00638_.WMF") returned -1 [0073.161] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF") returned="SO00633_.WMF" [0073.161] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.161] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.161] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.161] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.162] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00638_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" [0073.162] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb31a0e5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x584, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00656_.WMF", cAlternateFileName="")) returned 1 [0073.162] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.162] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00656_.WMF") returned -1 [0073.162] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00656_.WMF") returned -1 [0073.162] lstrcmpiA (lpString1="", lpString2="SO00656_.WMF") returned -1 [0073.162] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF") returned="SO00638_.WMF" [0073.162] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.162] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.162] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.162] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.162] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00656_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" [0073.162] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb31eecb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1652, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00668_.WMF", cAlternateFileName="")) returned 1 [0073.162] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.162] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SO00668_.WMF") returned -1 [0073.162] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SO00668_.WMF") returned -1 [0073.162] lstrcmpiA (lpString1="", lpString2="SO00668_.WMF") returned -1 [0073.162] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF") returned="SO00656_.WMF" [0073.162] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.163] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.163] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.163] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.163] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00668_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" [0073.163] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb930ea44, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00670_.WMF", cAlternateFileName="")) returned 1 [0073.163] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.163] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF") returned="SO00668_.WMF" [0073.163] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.163] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.163] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.163] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.163] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00670_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" [0073.163] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9314bcd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00671_.WMF", cAlternateFileName="")) returned 1 [0073.163] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.164] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF") returned="SO00670_.WMF" [0073.164] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.164] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.164] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.164] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.164] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00671_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" [0073.164] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9319a11, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x62b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00683_.WMF", cAlternateFileName="")) returned 1 [0073.164] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.164] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF") returned="SO00671_.WMF" [0073.164] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.164] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.164] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.164] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.164] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00683_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" [0073.164] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9320f2b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6302, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00694_.WMF", cAlternateFileName="")) returned 1 [0073.164] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.164] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF") returned="SO00683_.WMF" [0073.164] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.165] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.165] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.165] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.165] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00694_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" [0073.165] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb32506d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3636, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00704_.WMF", cAlternateFileName="")) returned 1 [0073.165] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.165] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF") returned="SO00694_.WMF" [0073.165] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.165] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.165] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.165] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.165] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00704_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" [0073.165] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9329818, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16478, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00726_.WMF", cAlternateFileName="")) returned 1 [0073.165] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.165] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF") returned="SO00704_.WMF" [0073.165] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.166] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.166] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.166] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.166] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00726_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" [0073.166] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb329eb8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00728_.WMF", cAlternateFileName="")) returned 1 [0073.166] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.166] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF") returned="SO00726_.WMF" [0073.166] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.166] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.166] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.166] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.166] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00728_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" [0073.166] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb32ece4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x13fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00732_.WMF", cAlternateFileName="")) returned 1 [0073.166] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.167] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF") returned="SO00728_.WMF" [0073.167] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.167] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.167] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.167] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.167] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00732_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" [0073.167] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb932f973, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x660, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00734_.WMF", cAlternateFileName="")) returned 1 [0073.167] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.167] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF") returned="SO00732_.WMF" [0073.167] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.167] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.167] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.167] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.167] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="SO00734_.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" [0073.167] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb93347ac, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00735_.WMF", cAlternateFileName="")) returned 1 [0073.167] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.185] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF") returned="SO00734_.WMF" [0073.185] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.185] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.185] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.185] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.185] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb93382be, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x184c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00736_.WMF", cAlternateFileName="")) returned 1 [0073.185] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.185] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF") returned="SO00735_.WMF" [0073.185] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.185] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.185] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.186] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb933e45e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x543a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00768_.WMF", cAlternateFileName="")) returned 1 [0073.186] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.186] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF") returned="SO00736_.WMF" [0073.186] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.186] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.186] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.186] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb93445e7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00783_.WMF", cAlternateFileName="")) returned 1 [0073.186] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.186] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF") returned="SO00768_.WMF" [0073.186] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.186] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.186] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.186] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb93493b1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x41c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00820_.WMF", cAlternateFileName="")) returned 1 [0073.186] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.186] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF") returned="SO00783_.WMF" [0073.186] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.187] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.187] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.187] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb33271b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x28ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00828_.WMF", cAlternateFileName="")) returned 1 [0073.187] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.187] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF") returned="SO00820_.WMF" [0073.187] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.187] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.187] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.187] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb3388ee, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x36da, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00834_.WMF", cAlternateFileName="")) returned 1 [0073.187] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.187] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF") returned="SO00828_.WMF" [0073.187] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.187] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.187] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.188] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb934e209, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3fe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00837_.WMF", cAlternateFileName="")) returned 1 [0073.188] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.188] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF") returned="SO00834_.WMF" [0073.188] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.188] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.188] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.188] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb935309c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1898, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00910_.WMF", cAlternateFileName="")) returned 1 [0073.188] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.188] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF") returned="SO00837_.WMF" [0073.188] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.188] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.188] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.188] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb93591f0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x29f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00911_.WMF", cAlternateFileName="")) returned 1 [0073.189] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.189] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF") returned="SO00910_.WMF" [0073.189] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.189] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.189] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.189] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9360699, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x28b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00913_.WMF", cAlternateFileName="")) returned 1 [0073.189] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.189] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF") returned="SO00911_.WMF" [0073.189] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.189] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.189] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.189] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb33d6ee, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1b0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00914_.WMF", cAlternateFileName="")) returned 1 [0073.189] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.189] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF") returned="SO00913_.WMF" [0073.189] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.189] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.190] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.190] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb93654de, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1bf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00915_.WMF", cAlternateFileName="")) returned 1 [0073.190] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.190] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF") returned="SO00914_.WMF" [0073.190] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.190] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.190] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.190] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb34252f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1270, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00916_.WMF", cAlternateFileName="")) returned 1 [0073.190] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.190] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF") returned="SO00915_.WMF" [0073.190] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.190] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.190] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.191] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb347367, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x25ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00917_.WMF", cAlternateFileName="")) returned 1 [0073.191] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.191] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF") returned="SO00916_.WMF" [0073.191] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.191] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.191] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.191] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb34d4f0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1f5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00918_.WMF", cAlternateFileName="")) returned 1 [0073.191] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.191] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF") returned="SO00917_.WMF" [0073.191] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.191] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.191] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.191] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb936a2fe, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2944, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00935_.WMF", cAlternateFileName="")) returned 1 [0073.191] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.191] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF") returned="SO00918_.WMF" [0073.191] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.191] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.192] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.192] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb3523ae, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1960, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00938_.WMF", cAlternateFileName="")) returned 1 [0073.192] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.192] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF") returned="SO00935_.WMF" [0073.192] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.192] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.192] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.193] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb936f184, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1708, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00941_.WMF", cAlternateFileName="")) returned 1 [0073.209] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.209] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF") returned="SO00938_.WMF" [0073.209] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.209] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.209] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.209] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb357129, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1264, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00942_.WMF", cAlternateFileName="")) returned 1 [0073.210] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.210] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF") returned="SO00941_.WMF" [0073.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.210] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.210] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.210] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb937536c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1d84, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00943_.WMF", cAlternateFileName="")) returned 1 [0073.210] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.210] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF") returned="SO00942_.WMF" [0073.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.210] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.210] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.210] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb35d305, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xae1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01044_.WMF", cAlternateFileName="")) returned 1 [0073.210] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.210] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF") returned="SO00943_.WMF" [0073.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.210] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.211] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.211] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb36349c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5b38, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01063_.WMF", cAlternateFileName="")) returned 1 [0073.211] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.211] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF") returned="SO01044_.WMF" [0073.211] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.211] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.211] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.211] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb36aa3c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1075e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01236_.WMF", cAlternateFileName="")) returned 1 [0073.211] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.211] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF") returned="SO01063_.WMF" [0073.211] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.211] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.211] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.212] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb937a101, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x43b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01560_.WMF", cAlternateFileName="")) returned 1 [0073.212] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.212] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF") returned="SO01236_.WMF" [0073.212] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.212] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.212] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.212] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb93802e2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x59d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01561_.WMF", cAlternateFileName="")) returned 1 [0073.212] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.212] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF") returned="SO01560_.WMF" [0073.212] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.212] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.212] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.212] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb370b6a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x75ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01563_.WMF", cAlternateFileName="")) returned 1 [0073.212] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.212] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF") returned="SO01561_.WMF" [0073.212] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.213] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.213] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.213] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb37597b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x51a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01566_.WMF", cAlternateFileName="")) returned 1 [0073.213] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.213] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF") returned="SO01563_.WMF" [0073.213] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.213] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.213] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.213] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb37bc02, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x54b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01568_.WMF", cAlternateFileName="")) returned 1 [0073.213] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.213] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF") returned="SO01566_.WMF" [0073.213] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.213] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.213] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.214] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb938505c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01569_.WMF", cAlternateFileName="")) returned 1 [0073.214] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.214] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF") returned="SO01568_.WMF" [0073.214] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.214] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.214] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.214] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb381cdc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa8a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01575_.WMF", cAlternateFileName="")) returned 1 [0073.214] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.214] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF") returned="SO01569_.WMF" [0073.214] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.214] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.214] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.214] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb938b2c3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2566, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01777_.WMF", cAlternateFileName="")) returned 1 [0073.214] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.215] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF") returned="SO01575_.WMF" [0073.215] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.215] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.215] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.215] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb387e7d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6ca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01785_.WMF", cAlternateFileName="")) returned 1 [0073.215] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.215] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF") returned="SO01777_.WMF" [0073.215] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.215] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.215] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.215] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb93902fc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1088, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01805_.WMF", cAlternateFileName="")) returned 1 [0073.215] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.215] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF") returned="SO01785_.WMF" [0073.215] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.215] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.215] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.216] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb38b8fd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01905_.WMF", cAlternateFileName="")) returned 1 [0073.216] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.216] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF") returned="SO01805_.WMF" [0073.216] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.216] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.216] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.216] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb391acb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3086, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01954_.WMF", cAlternateFileName="")) returned 1 [0073.216] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.216] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF") returned="SO01905_.WMF" [0073.216] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.216] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.216] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.216] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb3968f3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1d14, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02009_.WMF", cAlternateFileName="")) returned 1 [0073.217] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.217] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF") returned="SO01954_.WMF" [0073.217] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.217] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.217] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.217] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9394eb0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02022_.WMF", cAlternateFileName="")) returned 1 [0073.217] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.217] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF") returned="SO02009_.WMF" [0073.217] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.217] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.217] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.217] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9399df8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x23a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02024_.WMF", cAlternateFileName="")) returned 1 [0073.217] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.217] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF") returned="SO02022_.WMF" [0073.217] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.217] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.218] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.218] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb939fe8d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2016, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02025_.WMF", cAlternateFileName="")) returned 1 [0073.218] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.218] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF") returned="SO02024_.WMF" [0073.218] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.218] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.218] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.218] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb93a4ca0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x24c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02028_.WMF", cAlternateFileName="")) returned 1 [0073.218] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.218] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF") returned="SO02025_.WMF" [0073.218] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.218] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.218] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.219] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb39b6df, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x266c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02045_.WMF", cAlternateFileName="")) returned 1 [0073.219] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.219] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF") returned="SO02028_.WMF" [0073.219] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.219] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.219] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.219] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb3a0500, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1fde, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02048_.WMF", cAlternateFileName="")) returned 1 [0073.219] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.219] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF") returned="SO02045_.WMF" [0073.219] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.219] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.219] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.219] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb93a9abf, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2c2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02051_.WMF", cAlternateFileName="")) returned 1 [0073.219] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.219] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF") returned="SO02048_.WMF" [0073.219] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.219] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.220] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.220] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb93b36f5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x30ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02054_.WMF", cAlternateFileName="")) returned 1 [0073.220] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.220] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF") returned="SO02051_.WMF" [0073.220] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.220] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.220] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.220] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb3a7ab7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4c4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02055_.WMF", cAlternateFileName="")) returned 1 [0073.220] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.220] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF") returned="SO02054_.WMF" [0073.220] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.220] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.220] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.221] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb3aef6e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x382a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02067_.WMF", cAlternateFileName="")) returned 1 [0073.221] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.221] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF") returned="SO02055_.WMF" [0073.221] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.221] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.221] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.221] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb3b29e4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1b4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02094_.WMF", cAlternateFileName="")) returned 1 [0073.221] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.221] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF") returned="SO02067_.WMF" [0073.221] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.221] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.221] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.221] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb3b9f26, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02227_.WMF", cAlternateFileName="")) returned 1 [0073.221] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.222] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF") returned="SO02094_.WMF" [0073.222] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.253] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.253] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.253] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb93b8515, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x334, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02228_.WMF", cAlternateFileName="")) returned 1 [0073.253] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.254] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF") returned="SO02227_.WMF" [0073.254] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.254] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.254] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.254] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb93bd3d3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02233_.WMF", cAlternateFileName="")) returned 1 [0073.254] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.254] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF") returned="SO02228_.WMF" [0073.254] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.254] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.254] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.254] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb3c01ae, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe88, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02252_.WMF", cAlternateFileName="")) returned 1 [0073.254] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.254] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF") returned="SO02233_.WMF" [0073.254] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.255] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.255] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.255] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb93c0e41, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02253_.WMF", cAlternateFileName="")) returned 1 [0073.258] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.258] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF") returned="SO02252_.WMF" [0073.258] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.258] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.258] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.258] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb93c6f39, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x818, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02261_.WMF", cAlternateFileName="")) returned 1 [0073.258] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.258] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF") returned="SO02253_.WMF" [0073.258] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.258] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.258] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.259] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb3c3c13, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa94, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02263_.WMF", cAlternateFileName="")) returned 1 [0073.259] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.259] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF") returned="SO02261_.WMF" [0073.259] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.259] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.259] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.259] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb3c89a8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02265_.WMF", cAlternateFileName="")) returned 1 [0073.259] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.259] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF") returned="SO02263_.WMF" [0073.259] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.259] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.259] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.259] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb93cbd7f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02268_.WMF", cAlternateFileName="")) returned 1 [0073.259] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.259] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF") returned="SO02265_.WMF" [0073.259] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.260] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.260] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.260] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb3cd7c9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xaf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02269_.WMF", cAlternateFileName="")) returned 1 [0073.260] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.260] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF") returned="SO02268_.WMF" [0073.260] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.260] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.260] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.260] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb3d2687, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa68, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02270_.WMF", cAlternateFileName="")) returned 1 [0073.260] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.260] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF") returned="SO02269_.WMF" [0073.260] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.260] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.260] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.261] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb3d73d7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02276_.WMF", cAlternateFileName="")) returned 1 [0073.261] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.261] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF") returned="SO02270_.WMF" [0073.261] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.261] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.261] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.261] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb93d4647, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x17a1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02413_.WMF", cAlternateFileName="")) returned 1 [0073.261] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.261] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF") returned="SO02276_.WMF" [0073.261] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.261] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.261] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.261] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb3dc20f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02431_.WMF", cAlternateFileName="")) returned 1 [0073.262] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.262] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF") returned="SO02413_.WMF" [0073.262] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.262] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.262] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.262] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb3e1021, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02437_.WMF", cAlternateFileName="")) returned 1 [0073.262] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.262] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF") returned="SO02431_.WMF" [0073.262] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.262] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.262] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.262] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb93d94b7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02439_.WMF", cAlternateFileName="")) returned 1 [0073.262] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.262] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF") returned="SO02437_.WMF" [0073.262] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.262] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.263] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.263] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb93df60d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1a54, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02464_.WMF", cAlternateFileName="")) returned 1 [0073.263] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.263] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF") returned="SO02439_.WMF" [0073.263] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.263] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.263] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.263] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb93e4447, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02465_.WMF", cAlternateFileName="")) returned 1 [0073.263] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.263] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF") returned="SO02464_.WMF" [0073.263] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.263] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.263] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.264] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb3e7258, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x19ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02578_.WMF", cAlternateFileName="")) returned 1 [0073.264] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.264] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF") returned="SO02465_.WMF" [0073.264] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.264] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.264] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.264] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb93e92b3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5fec, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02617_.WMF", cAlternateFileName="")) returned 1 [0073.264] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.264] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF") returned="SO02578_.WMF" [0073.264] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.264] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.264] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.264] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb93ef469, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7f4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02790_.WMF", cAlternateFileName="")) returned 1 [0073.264] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.264] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF") returned="SO02617_.WMF" [0073.265] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.265] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.265] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.265] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb3ebfe4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x430c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02791_.WMF", cAlternateFileName="")) returned 1 [0073.265] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.265] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF") returned="SO02790_.WMF" [0073.265] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.265] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.265] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.265] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb93f6926, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02793_.WMF", cAlternateFileName="")) returned 1 [0073.265] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.265] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF") returned="SO02791_.WMF" [0073.265] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.265] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.265] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.266] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb3f0f26, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4b7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02794_.WMF", cAlternateFileName="")) returned 1 [0073.266] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.266] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF") returned="SO02793_.WMF" [0073.266] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.266] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.266] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.266] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb93fde27, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1262e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02862_.WMF", cAlternateFileName="")) returned 1 [0073.266] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.266] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF") returned="SO02794_.WMF" [0073.266] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.266] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.266] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.266] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9404021, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x967a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02886_.WMF", cAlternateFileName="")) returned 1 [0073.267] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.267] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF") returned="SO02862_.WMF" [0073.267] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.267] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.267] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.267] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb3f5d0f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x22f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02958_.WMF", cAlternateFileName="")) returned 1 [0073.267] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.267] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF") returned="SO02886_.WMF" [0073.267] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.267] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.267] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.267] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb948b7de, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x107b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPACE_01.MID", cAlternateFileName="")) returned 1 [0073.267] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.267] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF") returned="SO02958_.WMF" [0073.267] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.267] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.268] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.268] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb4eed6a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRNG_01.MID", cAlternateFileName="")) returned 1 [0073.268] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.268] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned="SPACE_01.MID" [0073.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.268] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.268] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.268] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4f3e00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb95d359b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8d4f3e00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xbd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUBBY1.WMF", cAlternateFileName="")) returned 1 [0073.268] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.268] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned="SPRNG_01.MID" [0073.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.268] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.268] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.310] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4f3e00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb578c20, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8d4f3e00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUBBY2.WMF", cAlternateFileName="")) returned 1 [0073.310] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.310] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF") returned="STUBBY1.WMF" [0073.310] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.310] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.311] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.311] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb95e0ce2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x36dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMER_01.MID", cAlternateFileName="")) returned 1 [0073.311] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.311] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF") returned="STUBBY2.WMF" [0073.311] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.311] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.311] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.311] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb594e30, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2135, dwReserved0=0x0, dwReserved1=0x0, cFileName="SWEST_01.MID", cAlternateFileName="")) returned 1 [0073.311] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.311] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned="SUMER_01.MID" [0073.311] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.311] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.311] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.312] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb59aed1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00110_.WMF", cAlternateFileName="")) returned 1 [0073.312] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.312] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned="SWEST_01.MID" [0073.312] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.312] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.312] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.312] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb95fba30, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1844, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00127_.WMF", cAlternateFileName="")) returned 1 [0073.312] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.312] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF") returned="SY00110_.WMF" [0073.312] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.312] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.312] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.312] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9600881, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x81c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00132_.WMF", cAlternateFileName="")) returned 1 [0073.312] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.313] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF") returned="SY00127_.WMF" [0073.313] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.313] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.313] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.313] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb960567d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1412, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00170_.WMF", cAlternateFileName="")) returned 1 [0073.313] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.313] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF") returned="SY00132_.WMF" [0073.313] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.313] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.313] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.313] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb59e9ec, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x50c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00560_.WMF", cAlternateFileName="")) returned 1 [0073.313] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.313] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF") returned="SY00170_.WMF" [0073.313] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.313] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.314] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.314] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb5a4b44, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00642_.WMF", cAlternateFileName="")) returned 1 [0073.315] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.315] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF") returned="SY00560_.WMF" [0073.316] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.316] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.316] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.316] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb5a98d3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2094, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00788_.WMF", cAlternateFileName="")) returned 1 [0073.316] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.316] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF") returned="SY00642_.WMF" [0073.316] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.316] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.316] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.316] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb5b0e23, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2fdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00792_.WMF", cAlternateFileName="")) returned 1 [0073.316] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.316] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF") returned="SY00788_.WMF" [0073.316] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.316] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.317] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.317] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb5b4949, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2764, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00795_.WMF", cAlternateFileName="")) returned 1 [0073.317] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.317] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF") returned="SY00792_.WMF" [0073.317] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.317] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.317] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.317] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb5baacd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x9b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00882_.WMF", cAlternateFileName="")) returned 1 [0073.317] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.317] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF") returned="SY00795_.WMF" [0073.317] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.317] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.317] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.317] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb5bf8ba, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01006_.WMF", cAlternateFileName="")) returned 1 [0073.318] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.318] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF") returned="SY00882_.WMF" [0073.318] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.318] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.318] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.318] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb960a523, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2734, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01252_.WMF", cAlternateFileName="")) returned 1 [0073.318] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.318] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF") returned="SY01006_.WMF" [0073.318] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.318] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.318] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.318] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb960f2ed, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01253_.WMF", cAlternateFileName="")) returned 1 [0073.318] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.318] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF") returned="SY01252_.WMF" [0073.318] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.318] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.319] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.319] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb96140fc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01462_.WMF", cAlternateFileName="")) returned 1 [0073.319] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.319] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF") returned="SY01253_.WMF" [0073.319] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.319] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.319] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.319] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9618f05, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01491_.WMF", cAlternateFileName="")) returned 1 [0073.319] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.319] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF") returned="SY01462_.WMF" [0073.319] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.319] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.319] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.319] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb961f08b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x13c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01563_.WMF", cAlternateFileName="")) returned 1 [0073.319] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.320] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF") returned="SY01491_.WMF" [0073.320] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.320] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.320] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.320] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9623e9a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01572_.WMF", cAlternateFileName="")) returned 1 [0073.320] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.320] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF") returned="SY01563_.WMF" [0073.320] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.320] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.320] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.320] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb5c46a4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x338e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01590_.WMF", cAlternateFileName="")) returned 1 [0073.320] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.320] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF") returned="SY01572_.WMF" [0073.320] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.320] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.320] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.321] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4f3e00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9676eb0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8d4f3e00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAIL.WMF", cAlternateFileName="")) returned 1 [0073.321] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.321] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF") returned="SY01590_.WMF" [0073.321] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.321] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.321] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.321] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9769ed5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xbde2, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00011_.WMF", cAlternateFileName="")) returned 1 [0073.321] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.381] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF") returned="TAIL.WMF" [0073.381] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.381] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.381] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.382] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb976ff23, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1d5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00014_.WMF", cAlternateFileName="")) returned 1 [0073.383] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.383] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF") returned="TN00011_.WMF" [0073.383] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.383] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.383] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.383] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9776113, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x243c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00018_.WMF", cAlternateFileName="")) returned 1 [0073.383] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.383] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF") returned="TN00014_.WMF" [0073.383] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.383] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.383] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.383] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb977d626, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x175a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00095_.WMF", cAlternateFileName="")) returned 1 [0073.383] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.383] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF") returned="TN00018_.WMF" [0073.383] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.383] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.383] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.383] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb83f34d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00211_.WMF", cAlternateFileName="")) returned 1 [0073.383] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.383] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF") returned="TN00095_.WMF" [0073.384] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.384] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.384] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.384] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9782462, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1224, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00217_.WMF", cAlternateFileName="")) returned 1 [0073.384] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.384] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF") returned="TN00211_.WMF" [0073.384] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.384] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.384] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.384] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb978723b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00218_.WMF", cAlternateFileName="")) returned 1 [0073.384] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.384] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF") returned="TN00217_.WMF" [0073.384] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.384] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.384] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.384] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb844156, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00231_.WMF", cAlternateFileName="")) returned 1 [0073.384] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.384] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF") returned="TN00218_.WMF" [0073.384] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.384] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.384] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.385] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb848f03, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xc68, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00234_.WMF", cAlternateFileName="")) returned 1 [0073.385] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.385] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF") returned="TN00231_.WMF" [0073.385] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.385] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.385] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.385] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb84dda0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xf8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00241_.WMF", cAlternateFileName="")) returned 1 [0073.385] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.385] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF") returned="TN00234_.WMF" [0073.385] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.385] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.385] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.385] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb978d3f1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00246_.WMF", cAlternateFileName="")) returned 1 [0073.385] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.385] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF") returned="TN00241_.WMF" [0073.385] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.385] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.385] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.386] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb852b6c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x15bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00253_.WMF", cAlternateFileName="")) returned 1 [0073.386] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.386] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF") returned="TN00246_.WMF" [0073.386] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.386] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.386] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.386] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb8579ef, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00255_.WMF", cAlternateFileName="")) returned 1 [0073.386] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.386] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF") returned="TN00253_.WMF" [0073.386] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.386] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.386] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb979222c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00330_.WMF", cAlternateFileName="")) returned 1 [0073.386] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.386] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF") returned="TN00255_.WMF" [0073.386] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.386] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.386] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb85c7a0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xf72, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00411_.WMF", cAlternateFileName="")) returned 1 [0073.386] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.386] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF") returned="TN00330_.WMF" [0073.387] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.387] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.387] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9795d53, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00687_.WMF", cAlternateFileName="")) returned 1 [0073.387] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.387] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF") returned="TN00411_.WMF" [0073.387] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.387] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.387] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb862928, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN01164_.WMF", cAlternateFileName="")) returned 1 [0073.387] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.387] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF") returned="TN00687_.WMF" [0073.387] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.387] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.387] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb979abc3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x66a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN01165_.WMF", cAlternateFileName="")) returned 1 [0073.387] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.387] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF") returned="TN01164_.WMF" [0073.387] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.387] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.387] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb86777e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4e02, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN01308_.WMF", cAlternateFileName="")) returned 1 [0073.388] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.388] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF") returned="TN01165_.WMF" [0073.388] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.388] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.388] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb97a95d2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x276a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00006_.WMF", cAlternateFileName="")) returned 1 [0073.388] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.388] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF") returned="TN01308_.WMF" [0073.388] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.388] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.388] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb97af6fc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x228c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00095_.WMF", cAlternateFileName="")) returned 1 [0073.390] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.390] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF") returned="TR00006_.WMF" [0073.390] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.390] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.390] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb8838ae, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00097_.WMF", cAlternateFileName="")) returned 1 [0073.390] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.390] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF") returned="TR00095_.WMF" [0073.390] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.390] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.390] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb97b450e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x25bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00116_.WMF", cAlternateFileName="")) returned 1 [0073.390] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.390] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF") returned="TR00097_.WMF" [0073.390] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.390] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.391] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb8886ad, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1234, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00126_.WMF", cAlternateFileName="")) returned 1 [0073.391] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.391] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF") returned="TR00116_.WMF" [0073.391] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.391] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.391] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb88e8d5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x235c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00172_.WMF", cAlternateFileName="")) returned 1 [0073.391] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.391] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF") returned="TR00126_.WMF" [0073.391] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.391] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.391] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb97ba694, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2142, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00178_.WMF", cAlternateFileName="")) returned 1 [0073.391] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.391] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF") returned="TR00172_.WMF" [0073.391] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.391] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.391] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb893697, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00232_.WMF", cAlternateFileName="")) returned 1 [0073.391] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.391] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF") returned="TR00178_.WMF" [0073.392] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.392] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.392] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb899842, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00233_.WMF", cAlternateFileName="")) returned 1 [0073.392] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.392] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF") returned="TR00232_.WMF" [0073.392] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.392] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.392] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb89e648, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00402_.WMF", cAlternateFileName="")) returned 1 [0073.392] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.392] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF") returned="TR00233_.WMF" [0073.392] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.392] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.392] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb8a3513, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2054, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00482_.WMF", cAlternateFileName="")) returned 1 [0073.392] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.392] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.392] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.392] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb8a8287, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00494_.WMF", cAlternateFileName="")) returned 1 [0073.392] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.393] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.393] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.393] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb8f50ee, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x342e, dwReserved0=0x0, dwReserved1=0x0, cFileName="URBAN_01.MID", cAlternateFileName="")) returned 1 [0073.393] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.393] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.393] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.393] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb9f7e6c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1361, dwReserved0=0x0, dwReserved1=0x0, cFileName="VCTRN_01.MID", cAlternateFileName="")) returned 1 [0073.393] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.393] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.393] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.393] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbb974e1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01219_.GIF", cAlternateFileName="")) returned 1 [0073.393] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.393] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.393] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.393] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.397] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2e4 [0073.398] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbb974e1, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.398] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.398] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x288, lpOverlapped=0x0) returned 1 [0073.400] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.400] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x288, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x288, lpOverlapped=0x0) returned 1 [0073.400] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.635] CloseHandle (hObject=0x1cc) returned 1 [0073.635] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01219_.gif.bd")) returned 1 [0073.636] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbb9d705, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01237_.GIF", cAlternateFileName="")) returned 1 [0073.636] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.636] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01237_.GIF") returned -1 [0073.636] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01237_.GIF") returned -1 [0073.636] lstrcmpiA (lpString1="", lpString2="WB01237_.GIF") returned -1 [0073.636] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.636] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.637] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.637] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01237_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" [0073.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF", pszSpec="*.zip") returned 0 [0073.637] lstrlenA (lpString="*.zip") returned 5 [0073.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF", pszSpec="*.rar") returned 0 [0073.637] lstrlenA (lpString="*.rar") returned 5 [0073.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF", pszSpec="*.7z") returned 0 [0073.637] lstrlenA (lpString="*.7z") returned 4 [0073.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF", pszSpec="*.tar") returned 0 [0073.637] lstrlenA (lpString="*.tar") returned 5 [0073.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF", pszSpec="*.gzip") returned 0 [0073.637] lstrlenA (lpString="*.gzip") returned 6 [0073.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF", pszSpec="*.jpg") returned 0 [0073.637] lstrlenA (lpString="*.jpg") returned 5 [0073.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF", pszSpec="*.jpeg") returned 0 [0073.637] lstrlenA (lpString="*.jpeg") returned 6 [0073.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF", pszSpec="*.psd") returned 0 [0073.637] lstrlenA (lpString="*.psd") returned 5 [0073.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF", pszSpec="*.cdr") returned 0 [0073.637] lstrlenA (lpString="*.cdr") returned 5 [0073.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF", pszSpec="*.dwg") returned 0 [0073.637] lstrlenA (lpString="*.dwg") returned 5 [0073.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF", pszSpec="*.max") returned 0 [0073.637] lstrlenA (lpString="*.max") returned 5 [0073.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF", pszSpec="*.bmp") returned 0 [0073.637] lstrlenA (lpString="*.bmp") returned 5 [0073.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF", pszSpec="*.gif") returned 1 [0073.637] lstrlenA (lpString="*.gif") returned 5 [0073.637] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" [0073.637] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" [0073.637] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF." [0073.638] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF.BD" [0073.638] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.639] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16b [0073.639] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbb9d705, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.639] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.639] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x10f, lpOverlapped=0x0) returned 1 [0073.640] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF") returned="WB01237_.GIF" [0073.640] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.640] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x10f, lpOverlapped=0x0) returned 1 [0073.640] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.640] CloseHandle (hObject=0x1cc) returned 1 [0073.640] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01237_.gif.bd")) returned 1 [0073.641] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9ded249, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x167, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01238_.GIF", cAlternateFileName="")) returned 1 [0073.641] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.641] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01238_.GIF") returned -1 [0073.641] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01238_.GIF") returned -1 [0073.641] lstrcmpiA (lpString1="", lpString2="WB01238_.GIF") returned -1 [0073.641] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF") returned="WB01237_.GIF" [0073.641] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.641] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.641] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.641] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.641] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01238_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" [0073.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF", pszSpec="*.zip") returned 0 [0073.641] lstrlenA (lpString="*.zip") returned 5 [0073.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF", pszSpec="*.rar") returned 0 [0073.641] lstrlenA (lpString="*.rar") returned 5 [0073.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF", pszSpec="*.7z") returned 0 [0073.641] lstrlenA (lpString="*.7z") returned 4 [0073.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF", pszSpec="*.tar") returned 0 [0073.641] lstrlenA (lpString="*.tar") returned 5 [0073.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF", pszSpec="*.gzip") returned 0 [0073.641] lstrlenA (lpString="*.gzip") returned 6 [0073.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF", pszSpec="*.jpg") returned 0 [0073.641] lstrlenA (lpString="*.jpg") returned 5 [0073.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF", pszSpec="*.jpeg") returned 0 [0073.641] lstrlenA (lpString="*.jpeg") returned 6 [0073.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF", pszSpec="*.psd") returned 0 [0073.641] lstrlenA (lpString="*.psd") returned 5 [0073.642] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF", pszSpec="*.cdr") returned 0 [0073.642] lstrlenA (lpString="*.cdr") returned 5 [0073.642] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF", pszSpec="*.dwg") returned 0 [0073.642] lstrlenA (lpString="*.dwg") returned 5 [0073.642] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF", pszSpec="*.max") returned 0 [0073.642] lstrlenA (lpString="*.max") returned 5 [0073.642] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF", pszSpec="*.bmp") returned 0 [0073.642] lstrlenA (lpString="*.bmp") returned 5 [0073.642] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF", pszSpec="*.gif") returned 1 [0073.642] lstrlenA (lpString="*.gif") returned 5 [0073.642] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" [0073.642] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" [0073.642] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF." [0073.642] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF.BD" [0073.642] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.643] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x167 [0073.643] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9ded249, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.643] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.643] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x10b, lpOverlapped=0x0) returned 1 [0073.644] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF") returned="WB01238_.GIF" [0073.645] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.645] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x10b, lpOverlapped=0x0) returned 1 [0073.645] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.645] CloseHandle (hObject=0x1cc) returned 1 [0073.645] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01238_.gif.bd")) returned 1 [0073.645] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9df33b6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01239_.GIF", cAlternateFileName="")) returned 1 [0073.645] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.645] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01239_.GIF") returned -1 [0073.646] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01239_.GIF") returned -1 [0073.646] lstrcmpiA (lpString1="", lpString2="WB01239_.GIF") returned -1 [0073.646] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF") returned="WB01238_.GIF" [0073.646] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.646] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.646] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.646] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.646] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01239_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" [0073.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF", pszSpec="*.zip") returned 0 [0073.646] lstrlenA (lpString="*.zip") returned 5 [0073.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF", pszSpec="*.rar") returned 0 [0073.646] lstrlenA (lpString="*.rar") returned 5 [0073.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF", pszSpec="*.7z") returned 0 [0073.646] lstrlenA (lpString="*.7z") returned 4 [0073.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF", pszSpec="*.tar") returned 0 [0073.646] lstrlenA (lpString="*.tar") returned 5 [0073.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF", pszSpec="*.gzip") returned 0 [0073.646] lstrlenA (lpString="*.gzip") returned 6 [0073.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF", pszSpec="*.jpg") returned 0 [0073.646] lstrlenA (lpString="*.jpg") returned 5 [0073.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF", pszSpec="*.jpeg") returned 0 [0073.646] lstrlenA (lpString="*.jpeg") returned 6 [0073.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF", pszSpec="*.psd") returned 0 [0073.646] lstrlenA (lpString="*.psd") returned 5 [0073.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF", pszSpec="*.cdr") returned 0 [0073.646] lstrlenA (lpString="*.cdr") returned 5 [0073.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF", pszSpec="*.dwg") returned 0 [0073.646] lstrlenA (lpString="*.dwg") returned 5 [0073.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF", pszSpec="*.max") returned 0 [0073.646] lstrlenA (lpString="*.max") returned 5 [0073.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF", pszSpec="*.bmp") returned 0 [0073.646] lstrlenA (lpString="*.bmp") returned 5 [0073.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF", pszSpec="*.gif") returned 1 [0073.646] lstrlenA (lpString="*.gif") returned 5 [0073.647] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" [0073.647] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" [0073.647] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF." [0073.647] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF.BD" [0073.647] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.647] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19a [0073.647] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9df33b6, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.648] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.648] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x13e, lpOverlapped=0x0) returned 1 [0073.649] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF") returned="WB01239_.GIF" [0073.649] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.649] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x13e, lpOverlapped=0x0) returned 1 [0073.649] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.649] CloseHandle (hObject=0x1cc) returned 1 [0073.649] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01239_.gif.bd")) returned 1 [0073.650] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9df81ff, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01240_.GIF", cAlternateFileName="")) returned 1 [0073.650] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.650] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01240_.GIF") returned -1 [0073.650] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01240_.GIF") returned -1 [0073.650] lstrcmpiA (lpString1="", lpString2="WB01240_.GIF") returned -1 [0073.650] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF") returned="WB01239_.GIF" [0073.650] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.650] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.650] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.650] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.650] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01240_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" [0073.650] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF", pszSpec="*.zip") returned 0 [0073.650] lstrlenA (lpString="*.zip") returned 5 [0073.650] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF", pszSpec="*.rar") returned 0 [0073.650] lstrlenA (lpString="*.rar") returned 5 [0073.650] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF", pszSpec="*.7z") returned 0 [0073.650] lstrlenA (lpString="*.7z") returned 4 [0073.650] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF", pszSpec="*.tar") returned 0 [0073.650] lstrlenA (lpString="*.tar") returned 5 [0073.650] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF", pszSpec="*.gzip") returned 0 [0073.650] lstrlenA (lpString="*.gzip") returned 6 [0073.650] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF", pszSpec="*.jpg") returned 0 [0073.650] lstrlenA (lpString="*.jpg") returned 5 [0073.650] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF", pszSpec="*.jpeg") returned 0 [0073.650] lstrlenA (lpString="*.jpeg") returned 6 [0073.650] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF", pszSpec="*.psd") returned 0 [0073.650] lstrlenA (lpString="*.psd") returned 5 [0073.650] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF", pszSpec="*.cdr") returned 0 [0073.650] lstrlenA (lpString="*.cdr") returned 5 [0073.650] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF", pszSpec="*.dwg") returned 0 [0073.650] lstrlenA (lpString="*.dwg") returned 5 [0073.650] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF", pszSpec="*.max") returned 0 [0073.651] lstrlenA (lpString="*.max") returned 5 [0073.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF", pszSpec="*.bmp") returned 0 [0073.651] lstrlenA (lpString="*.bmp") returned 5 [0073.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF", pszSpec="*.gif") returned 1 [0073.651] lstrlenA (lpString="*.gif") returned 5 [0073.651] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" [0073.651] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" [0073.651] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF." [0073.651] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF.BD" [0073.651] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.651] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14d [0073.651] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9df81ff, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.651] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.651] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xf1, lpOverlapped=0x0) returned 1 [0073.692] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF") returned="WB01240_.GIF" [0073.692] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.693] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xf1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xf1, lpOverlapped=0x0) returned 1 [0073.693] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.693] CloseHandle (hObject=0x1cc) returned 1 [0073.693] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01240_.gif.bd")) returned 1 [0073.694] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbba38ae, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01241_.GIF", cAlternateFileName="")) returned 1 [0073.694] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.694] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01241_.GIF") returned -1 [0073.694] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01241_.GIF") returned -1 [0073.694] lstrcmpiA (lpString1="", lpString2="WB01241_.GIF") returned -1 [0073.694] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF") returned="WB01240_.GIF" [0073.694] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.694] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.694] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.694] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.694] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01241_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" [0073.694] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF", pszSpec="*.zip") returned 0 [0073.694] lstrlenA (lpString="*.zip") returned 5 [0073.694] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF", pszSpec="*.rar") returned 0 [0073.694] lstrlenA (lpString="*.rar") returned 5 [0073.694] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF", pszSpec="*.7z") returned 0 [0073.694] lstrlenA (lpString="*.7z") returned 4 [0073.694] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF", pszSpec="*.tar") returned 0 [0073.694] lstrlenA (lpString="*.tar") returned 5 [0073.695] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF", pszSpec="*.gzip") returned 0 [0073.695] lstrlenA (lpString="*.gzip") returned 6 [0073.695] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF", pszSpec="*.jpg") returned 0 [0073.695] lstrlenA (lpString="*.jpg") returned 5 [0073.695] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF", pszSpec="*.jpeg") returned 0 [0073.695] lstrlenA (lpString="*.jpeg") returned 6 [0073.695] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF", pszSpec="*.psd") returned 0 [0073.695] lstrlenA (lpString="*.psd") returned 5 [0073.695] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF", pszSpec="*.cdr") returned 0 [0073.695] lstrlenA (lpString="*.cdr") returned 5 [0073.695] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF", pszSpec="*.dwg") returned 0 [0073.695] lstrlenA (lpString="*.dwg") returned 5 [0073.695] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF", pszSpec="*.max") returned 0 [0073.695] lstrlenA (lpString="*.max") returned 5 [0073.695] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF", pszSpec="*.bmp") returned 0 [0073.695] lstrlenA (lpString="*.bmp") returned 5 [0073.695] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF", pszSpec="*.gif") returned 1 [0073.695] lstrlenA (lpString="*.gif") returned 5 [0073.695] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" [0073.695] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" [0073.695] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF." [0073.695] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF.BD" [0073.695] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.696] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x182 [0073.696] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbba38ae, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.696] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.696] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x126, lpOverlapped=0x0) returned 1 [0073.697] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF") returned="WB01241_.GIF" [0073.697] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.697] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1 [0073.697] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.697] CloseHandle (hObject=0x1cc) returned 1 [0073.697] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01241_.gif.bd")) returned 1 [0073.698] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9dfd023, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01242_.GIF", cAlternateFileName="")) returned 1 [0073.698] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.698] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01242_.GIF") returned -1 [0073.698] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01242_.GIF") returned -1 [0073.698] lstrcmpiA (lpString1="", lpString2="WB01242_.GIF") returned -1 [0073.698] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF") returned="WB01241_.GIF" [0073.698] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.698] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.698] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.698] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.698] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01242_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" [0073.698] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF", pszSpec="*.zip") returned 0 [0073.698] lstrlenA (lpString="*.zip") returned 5 [0073.698] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF", pszSpec="*.rar") returned 0 [0073.698] lstrlenA (lpString="*.rar") returned 5 [0073.698] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF", pszSpec="*.7z") returned 0 [0073.698] lstrlenA (lpString="*.7z") returned 4 [0073.698] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF", pszSpec="*.tar") returned 0 [0073.698] lstrlenA (lpString="*.tar") returned 5 [0073.698] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF", pszSpec="*.gzip") returned 0 [0073.698] lstrlenA (lpString="*.gzip") returned 6 [0073.698] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF", pszSpec="*.jpg") returned 0 [0073.698] lstrlenA (lpString="*.jpg") returned 5 [0073.698] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF", pszSpec="*.jpeg") returned 0 [0073.698] lstrlenA (lpString="*.jpeg") returned 6 [0073.698] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF", pszSpec="*.psd") returned 0 [0073.698] lstrlenA (lpString="*.psd") returned 5 [0073.698] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF", pszSpec="*.cdr") returned 0 [0073.698] lstrlenA (lpString="*.cdr") returned 5 [0073.698] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF", pszSpec="*.dwg") returned 0 [0073.699] lstrlenA (lpString="*.dwg") returned 5 [0073.699] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF", pszSpec="*.max") returned 0 [0073.699] lstrlenA (lpString="*.max") returned 5 [0073.699] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF", pszSpec="*.bmp") returned 0 [0073.699] lstrlenA (lpString="*.bmp") returned 5 [0073.699] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF", pszSpec="*.gif") returned 1 [0073.699] lstrlenA (lpString="*.gif") returned 5 [0073.699] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" [0073.699] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" [0073.699] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF." [0073.699] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF.BD" [0073.699] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.699] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x158 [0073.699] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9dfd023, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.699] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.699] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xfc, lpOverlapped=0x0) returned 1 [0073.700] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF") returned="WB01242_.GIF" [0073.700] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.700] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xfc, lpOverlapped=0x0) returned 1 [0073.700] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.701] CloseHandle (hObject=0x1cc) returned 1 [0073.701] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01242_.gif.bd")) returned 1 [0073.701] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9e00b64, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01243_.GIF", cAlternateFileName="")) returned 1 [0073.701] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.701] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01243_.GIF") returned -1 [0073.701] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01243_.GIF") returned -1 [0073.701] lstrcmpiA (lpString1="", lpString2="WB01243_.GIF") returned -1 [0073.701] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF") returned="WB01242_.GIF" [0073.701] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.701] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.701] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.701] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.701] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01243_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" [0073.702] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", pszSpec="*.zip") returned 0 [0073.702] lstrlenA (lpString="*.zip") returned 5 [0073.702] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", pszSpec="*.rar") returned 0 [0073.702] lstrlenA (lpString="*.rar") returned 5 [0073.702] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", pszSpec="*.7z") returned 0 [0073.702] lstrlenA (lpString="*.7z") returned 4 [0073.702] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", pszSpec="*.tar") returned 0 [0073.702] lstrlenA (lpString="*.tar") returned 5 [0073.702] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", pszSpec="*.gzip") returned 0 [0073.702] lstrlenA (lpString="*.gzip") returned 6 [0073.702] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", pszSpec="*.jpg") returned 0 [0073.702] lstrlenA (lpString="*.jpg") returned 5 [0073.702] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", pszSpec="*.jpeg") returned 0 [0073.702] lstrlenA (lpString="*.jpeg") returned 6 [0073.702] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", pszSpec="*.psd") returned 0 [0073.702] lstrlenA (lpString="*.psd") returned 5 [0073.702] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", pszSpec="*.cdr") returned 0 [0073.702] lstrlenA (lpString="*.cdr") returned 5 [0073.702] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", pszSpec="*.dwg") returned 0 [0073.702] lstrlenA (lpString="*.dwg") returned 5 [0073.702] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", pszSpec="*.max") returned 0 [0073.702] lstrlenA (lpString="*.max") returned 5 [0073.702] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", pszSpec="*.bmp") returned 0 [0073.702] lstrlenA (lpString="*.bmp") returned 5 [0073.702] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", pszSpec="*.gif") returned 1 [0073.702] lstrlenA (lpString="*.gif") returned 5 [0073.702] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" [0073.702] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" [0073.702] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF." [0073.702] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF.BD" [0073.702] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.703] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1af [0073.703] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9e00b64, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.703] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.703] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x153, lpOverlapped=0x0) returned 1 [0073.704] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF") returned="WB01243_.GIF" [0073.704] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.704] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x153, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x153, lpOverlapped=0x0) returned 1 [0073.704] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.704] CloseHandle (hObject=0x1cc) returned 1 [0073.704] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01243_.gif.bd")) returned 1 [0073.705] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbba86a7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01244_.GIF", cAlternateFileName="")) returned 1 [0073.705] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.705] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01244_.GIF") returned -1 [0073.705] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01244_.GIF") returned -1 [0073.705] lstrcmpiA (lpString1="", lpString2="WB01244_.GIF") returned -1 [0073.705] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF") returned="WB01243_.GIF" [0073.705] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.705] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.705] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.705] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.705] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01244_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" [0073.705] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF", pszSpec="*.zip") returned 0 [0073.705] lstrlenA (lpString="*.zip") returned 5 [0073.705] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF", pszSpec="*.rar") returned 0 [0073.705] lstrlenA (lpString="*.rar") returned 5 [0073.705] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF", pszSpec="*.7z") returned 0 [0073.705] lstrlenA (lpString="*.7z") returned 4 [0073.705] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF", pszSpec="*.tar") returned 0 [0073.705] lstrlenA (lpString="*.tar") returned 5 [0073.705] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF", pszSpec="*.gzip") returned 0 [0073.705] lstrlenA (lpString="*.gzip") returned 6 [0073.705] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF", pszSpec="*.jpg") returned 0 [0073.706] lstrlenA (lpString="*.jpg") returned 5 [0073.706] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF", pszSpec="*.jpeg") returned 0 [0073.706] lstrlenA (lpString="*.jpeg") returned 6 [0073.706] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF", pszSpec="*.psd") returned 0 [0073.706] lstrlenA (lpString="*.psd") returned 5 [0073.706] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF", pszSpec="*.cdr") returned 0 [0073.706] lstrlenA (lpString="*.cdr") returned 5 [0073.706] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF", pszSpec="*.dwg") returned 0 [0073.706] lstrlenA (lpString="*.dwg") returned 5 [0073.706] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF", pszSpec="*.max") returned 0 [0073.706] lstrlenA (lpString="*.max") returned 5 [0073.706] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF", pszSpec="*.bmp") returned 0 [0073.706] lstrlenA (lpString="*.bmp") returned 5 [0073.706] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF", pszSpec="*.gif") returned 1 [0073.706] lstrlenA (lpString="*.gif") returned 5 [0073.706] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" [0073.707] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" [0073.707] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF." [0073.707] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF.BD" [0073.707] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.707] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d3 [0073.707] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbba86a7, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.707] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.707] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x177, lpOverlapped=0x0) returned 1 [0073.708] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF") returned="WB01244_.GIF" [0073.708] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.708] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x177, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x177, lpOverlapped=0x0) returned 1 [0073.708] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.708] CloseHandle (hObject=0x1cc) returned 1 [0073.708] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01244_.gif.bd")) returned 1 [0073.710] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbbac0d4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01245_.GIF", cAlternateFileName="")) returned 1 [0073.710] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.710] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01245_.GIF") returned -1 [0073.710] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01245_.GIF") returned -1 [0073.710] lstrcmpiA (lpString1="", lpString2="WB01245_.GIF") returned -1 [0073.710] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF") returned="WB01244_.GIF" [0073.710] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.710] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.710] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.710] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.710] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01245_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" [0073.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF", pszSpec="*.zip") returned 0 [0073.710] lstrlenA (lpString="*.zip") returned 5 [0073.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF", pszSpec="*.rar") returned 0 [0073.710] lstrlenA (lpString="*.rar") returned 5 [0073.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF", pszSpec="*.7z") returned 0 [0073.710] lstrlenA (lpString="*.7z") returned 4 [0073.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF", pszSpec="*.tar") returned 0 [0073.710] lstrlenA (lpString="*.tar") returned 5 [0073.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF", pszSpec="*.gzip") returned 0 [0073.710] lstrlenA (lpString="*.gzip") returned 6 [0073.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF", pszSpec="*.jpg") returned 0 [0073.710] lstrlenA (lpString="*.jpg") returned 5 [0073.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF", pszSpec="*.jpeg") returned 0 [0073.710] lstrlenA (lpString="*.jpeg") returned 6 [0073.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF", pszSpec="*.psd") returned 0 [0073.710] lstrlenA (lpString="*.psd") returned 5 [0073.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF", pszSpec="*.cdr") returned 0 [0073.710] lstrlenA (lpString="*.cdr") returned 5 [0073.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF", pszSpec="*.dwg") returned 0 [0073.710] lstrlenA (lpString="*.dwg") returned 5 [0073.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF", pszSpec="*.max") returned 0 [0073.711] lstrlenA (lpString="*.max") returned 5 [0073.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF", pszSpec="*.bmp") returned 0 [0073.711] lstrlenA (lpString="*.bmp") returned 5 [0073.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF", pszSpec="*.gif") returned 1 [0073.711] lstrlenA (lpString="*.gif") returned 5 [0073.711] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" [0073.711] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" [0073.711] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF." [0073.711] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF.BD" [0073.711] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.711] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0073.711] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbbac0d4, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.711] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.711] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xf9, lpOverlapped=0x0) returned 1 [0073.712] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF") returned="WB01245_.GIF" [0073.712] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.712] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xf9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xf9, lpOverlapped=0x0) returned 1 [0073.712] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.712] CloseHandle (hObject=0x1cc) returned 1 [0073.713] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01245_.gif.bd")) returned 1 [0073.713] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbbb22af, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01246_.GIF", cAlternateFileName="")) returned 1 [0073.713] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.713] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01246_.GIF") returned -1 [0073.713] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01246_.GIF") returned -1 [0073.713] lstrcmpiA (lpString1="", lpString2="WB01246_.GIF") returned -1 [0073.713] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF") returned="WB01245_.GIF" [0073.713] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.713] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.713] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.713] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.713] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01246_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" [0073.713] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF", pszSpec="*.zip") returned 0 [0073.714] lstrlenA (lpString="*.zip") returned 5 [0073.714] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF", pszSpec="*.rar") returned 0 [0073.714] lstrlenA (lpString="*.rar") returned 5 [0073.714] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF", pszSpec="*.7z") returned 0 [0073.714] lstrlenA (lpString="*.7z") returned 4 [0073.714] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF", pszSpec="*.tar") returned 0 [0073.714] lstrlenA (lpString="*.tar") returned 5 [0073.714] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF", pszSpec="*.gzip") returned 0 [0073.714] lstrlenA (lpString="*.gzip") returned 6 [0073.714] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF", pszSpec="*.jpg") returned 0 [0073.714] lstrlenA (lpString="*.jpg") returned 5 [0073.714] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF", pszSpec="*.jpeg") returned 0 [0073.714] lstrlenA (lpString="*.jpeg") returned 6 [0073.714] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF", pszSpec="*.psd") returned 0 [0073.714] lstrlenA (lpString="*.psd") returned 5 [0073.714] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF", pszSpec="*.cdr") returned 0 [0073.714] lstrlenA (lpString="*.cdr") returned 5 [0073.714] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF", pszSpec="*.dwg") returned 0 [0073.714] lstrlenA (lpString="*.dwg") returned 5 [0073.714] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF", pszSpec="*.max") returned 0 [0073.714] lstrlenA (lpString="*.max") returned 5 [0073.714] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF", pszSpec="*.bmp") returned 0 [0073.714] lstrlenA (lpString="*.bmp") returned 5 [0073.714] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF", pszSpec="*.gif") returned 1 [0073.714] lstrlenA (lpString="*.gif") returned 5 [0073.714] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" [0073.714] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" [0073.714] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF." [0073.714] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF.BD" [0073.714] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.715] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ce [0073.715] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbbb22af, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.715] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.715] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x172, lpOverlapped=0x0) returned 1 [0073.716] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF") returned="WB01246_.GIF" [0073.716] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.716] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x172, lpOverlapped=0x0) returned 1 [0073.717] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.717] CloseHandle (hObject=0x1cc) returned 1 [0073.717] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01246_.gif.bd")) returned 1 [0073.717] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbbb70d0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xff7, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01253_.GIF", cAlternateFileName="")) returned 1 [0073.717] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.717] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01253_.GIF") returned -1 [0073.717] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01253_.GIF") returned -1 [0073.717] lstrcmpiA (lpString1="", lpString2="WB01253_.GIF") returned -1 [0073.717] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF") returned="WB01246_.GIF" [0073.717] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.717] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.717] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.717] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.718] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01253_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" [0073.718] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF", pszSpec="*.zip") returned 0 [0073.718] lstrlenA (lpString="*.zip") returned 5 [0073.718] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF", pszSpec="*.rar") returned 0 [0073.718] lstrlenA (lpString="*.rar") returned 5 [0073.718] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF", pszSpec="*.7z") returned 0 [0073.718] lstrlenA (lpString="*.7z") returned 4 [0073.718] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF", pszSpec="*.tar") returned 0 [0073.718] lstrlenA (lpString="*.tar") returned 5 [0073.718] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF", pszSpec="*.gzip") returned 0 [0073.718] lstrlenA (lpString="*.gzip") returned 6 [0073.718] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF", pszSpec="*.jpg") returned 0 [0073.718] lstrlenA (lpString="*.jpg") returned 5 [0073.718] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF", pszSpec="*.jpeg") returned 0 [0073.718] lstrlenA (lpString="*.jpeg") returned 6 [0073.718] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF", pszSpec="*.psd") returned 0 [0073.718] lstrlenA (lpString="*.psd") returned 5 [0073.718] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF", pszSpec="*.cdr") returned 0 [0073.718] lstrlenA (lpString="*.cdr") returned 5 [0073.718] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF", pszSpec="*.dwg") returned 0 [0073.718] lstrlenA (lpString="*.dwg") returned 5 [0073.718] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF", pszSpec="*.max") returned 0 [0073.718] lstrlenA (lpString="*.max") returned 5 [0073.718] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF", pszSpec="*.bmp") returned 0 [0073.718] lstrlenA (lpString="*.bmp") returned 5 [0073.718] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF", pszSpec="*.gif") returned 1 [0073.718] lstrlenA (lpString="*.gif") returned 5 [0073.718] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" [0073.718] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" [0073.718] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF." [0073.718] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF.BD" [0073.718] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.719] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xff7 [0073.719] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbbb70d0, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.719] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.719] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xf9b, lpOverlapped=0x0) returned 1 [0073.720] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF") returned="WB01253_.GIF" [0073.720] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.721] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xf9b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xf9b, lpOverlapped=0x0) returned 1 [0073.721] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.721] CloseHandle (hObject=0x1cc) returned 1 [0073.721] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01253_.gif.bd")) returned 1 [0073.721] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9e06ce8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01268_.GIF", cAlternateFileName="")) returned 1 [0073.721] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.721] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01268_.GIF") returned -1 [0073.721] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01268_.GIF") returned -1 [0073.721] lstrcmpiA (lpString1="", lpString2="WB01268_.GIF") returned -1 [0073.721] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF") returned="WB01253_.GIF" [0073.721] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.722] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.722] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.722] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.722] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01268_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" [0073.722] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF", pszSpec="*.zip") returned 0 [0073.722] lstrlenA (lpString="*.zip") returned 5 [0073.722] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF", pszSpec="*.rar") returned 0 [0073.722] lstrlenA (lpString="*.rar") returned 5 [0073.722] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF", pszSpec="*.7z") returned 0 [0073.722] lstrlenA (lpString="*.7z") returned 4 [0073.722] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF", pszSpec="*.tar") returned 0 [0073.722] lstrlenA (lpString="*.tar") returned 5 [0073.722] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF", pszSpec="*.gzip") returned 0 [0073.722] lstrlenA (lpString="*.gzip") returned 6 [0073.722] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF", pszSpec="*.jpg") returned 0 [0073.722] lstrlenA (lpString="*.jpg") returned 5 [0073.722] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF", pszSpec="*.jpeg") returned 0 [0073.722] lstrlenA (lpString="*.jpeg") returned 6 [0073.722] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF", pszSpec="*.psd") returned 0 [0073.722] lstrlenA (lpString="*.psd") returned 5 [0073.722] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF", pszSpec="*.cdr") returned 0 [0073.722] lstrlenA (lpString="*.cdr") returned 5 [0073.723] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF", pszSpec="*.dwg") returned 0 [0073.723] lstrlenA (lpString="*.dwg") returned 5 [0073.723] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF", pszSpec="*.max") returned 0 [0073.723] lstrlenA (lpString="*.max") returned 5 [0073.723] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF", pszSpec="*.bmp") returned 0 [0073.723] lstrlenA (lpString="*.bmp") returned 5 [0073.723] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF", pszSpec="*.gif") returned 1 [0073.723] lstrlenA (lpString="*.gif") returned 5 [0073.723] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" [0073.723] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" [0073.723] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF." [0073.723] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF.BD" [0073.723] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.724] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ab [0073.724] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9e06ce8, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.724] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.724] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x14f, lpOverlapped=0x0) returned 1 [0073.725] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF") returned="WB01268_.GIF" [0073.725] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.725] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x14f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x14f, lpOverlapped=0x0) returned 1 [0073.725] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.725] CloseHandle (hObject=0x1cc) returned 1 [0073.725] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01268_.gif.bd")) returned 1 [0073.726] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbbbbef1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01292_.GIF", cAlternateFileName="")) returned 1 [0073.726] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.726] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01292_.GIF") returned -1 [0073.726] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01292_.GIF") returned -1 [0073.726] lstrcmpiA (lpString1="", lpString2="WB01292_.GIF") returned -1 [0073.726] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF") returned="WB01268_.GIF" [0073.726] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.726] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.726] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.726] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.726] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01292_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" [0073.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF", pszSpec="*.zip") returned 0 [0073.726] lstrlenA (lpString="*.zip") returned 5 [0073.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF", pszSpec="*.rar") returned 0 [0073.726] lstrlenA (lpString="*.rar") returned 5 [0073.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF", pszSpec="*.7z") returned 0 [0073.726] lstrlenA (lpString="*.7z") returned 4 [0073.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF", pszSpec="*.tar") returned 0 [0073.726] lstrlenA (lpString="*.tar") returned 5 [0073.726] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF", pszSpec="*.gzip") returned 0 [0073.726] lstrlenA (lpString="*.gzip") returned 6 [0073.727] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF", pszSpec="*.jpg") returned 0 [0073.727] lstrlenA (lpString="*.jpg") returned 5 [0073.727] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF", pszSpec="*.jpeg") returned 0 [0073.727] lstrlenA (lpString="*.jpeg") returned 6 [0073.727] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF", pszSpec="*.psd") returned 0 [0073.727] lstrlenA (lpString="*.psd") returned 5 [0073.727] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF", pszSpec="*.cdr") returned 0 [0073.727] lstrlenA (lpString="*.cdr") returned 5 [0073.727] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF", pszSpec="*.dwg") returned 0 [0073.727] lstrlenA (lpString="*.dwg") returned 5 [0073.727] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF", pszSpec="*.max") returned 0 [0073.727] lstrlenA (lpString="*.max") returned 5 [0073.727] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF", pszSpec="*.bmp") returned 0 [0073.727] lstrlenA (lpString="*.bmp") returned 5 [0073.727] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF", pszSpec="*.gif") returned 1 [0073.727] lstrlenA (lpString="*.gif") returned 5 [0073.727] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" [0073.727] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" [0073.727] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF." [0073.727] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF.BD" [0073.727] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.727] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x255 [0073.727] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbbbbef1, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.727] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.728] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1f9, lpOverlapped=0x0) returned 1 [0073.740] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF") returned="WB01292_.GIF" [0073.740] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.740] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1f9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1f9, lpOverlapped=0x0) returned 1 [0073.744] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.744] CloseHandle (hObject=0x1cc) returned 1 [0073.744] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01292_.gif.bd")) returned 1 [0073.745] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9e0ba90, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01293_.GIF", cAlternateFileName="")) returned 1 [0073.745] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.745] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01293_.GIF") returned -1 [0073.745] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01293_.GIF") returned -1 [0073.745] lstrcmpiA (lpString1="", lpString2="WB01293_.GIF") returned -1 [0073.745] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF") returned="WB01292_.GIF" [0073.745] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.745] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.745] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.745] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.745] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01293_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" [0073.745] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF", pszSpec="*.zip") returned 0 [0073.745] lstrlenA (lpString="*.zip") returned 5 [0073.745] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF", pszSpec="*.rar") returned 0 [0073.746] lstrlenA (lpString="*.rar") returned 5 [0073.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF", pszSpec="*.7z") returned 0 [0073.746] lstrlenA (lpString="*.7z") returned 4 [0073.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF", pszSpec="*.tar") returned 0 [0073.746] lstrlenA (lpString="*.tar") returned 5 [0073.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF", pszSpec="*.gzip") returned 0 [0073.746] lstrlenA (lpString="*.gzip") returned 6 [0073.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF", pszSpec="*.jpg") returned 0 [0073.746] lstrlenA (lpString="*.jpg") returned 5 [0073.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF", pszSpec="*.jpeg") returned 0 [0073.746] lstrlenA (lpString="*.jpeg") returned 6 [0073.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF", pszSpec="*.psd") returned 0 [0073.746] lstrlenA (lpString="*.psd") returned 5 [0073.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF", pszSpec="*.cdr") returned 0 [0073.746] lstrlenA (lpString="*.cdr") returned 5 [0073.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF", pszSpec="*.dwg") returned 0 [0073.746] lstrlenA (lpString="*.dwg") returned 5 [0073.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF", pszSpec="*.max") returned 0 [0073.746] lstrlenA (lpString="*.max") returned 5 [0073.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF", pszSpec="*.bmp") returned 0 [0073.746] lstrlenA (lpString="*.bmp") returned 5 [0073.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF", pszSpec="*.gif") returned 1 [0073.746] lstrlenA (lpString="*.gif") returned 5 [0073.746] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" [0073.746] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" [0073.746] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF." [0073.746] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF.BD" [0073.746] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.747] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a7 [0073.747] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9e0ba90, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.747] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.747] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x24b, lpOverlapped=0x0) returned 1 [0073.748] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF") returned="WB01293_.GIF" [0073.748] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.748] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x24b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x24b, lpOverlapped=0x0) returned 1 [0073.748] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.748] CloseHandle (hObject=0x1cc) returned 1 [0073.748] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01293_.gif.bd")) returned 1 [0073.749] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbbc0d0e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01294_.GIF", cAlternateFileName="")) returned 1 [0073.749] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.749] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01294_.GIF") returned -1 [0073.749] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01294_.GIF") returned -1 [0073.749] lstrcmpiA (lpString1="", lpString2="WB01294_.GIF") returned -1 [0073.750] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF") returned="WB01293_.GIF" [0073.750] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.750] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.750] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.750] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.750] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01294_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" [0073.750] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF", pszSpec="*.zip") returned 0 [0073.750] lstrlenA (lpString="*.zip") returned 5 [0073.750] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF", pszSpec="*.rar") returned 0 [0073.750] lstrlenA (lpString="*.rar") returned 5 [0073.750] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF", pszSpec="*.7z") returned 0 [0073.750] lstrlenA (lpString="*.7z") returned 4 [0073.750] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF", pszSpec="*.tar") returned 0 [0073.750] lstrlenA (lpString="*.tar") returned 5 [0073.750] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF", pszSpec="*.gzip") returned 0 [0073.750] lstrlenA (lpString="*.gzip") returned 6 [0073.750] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF", pszSpec="*.jpg") returned 0 [0073.750] lstrlenA (lpString="*.jpg") returned 5 [0073.750] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF", pszSpec="*.jpeg") returned 0 [0073.750] lstrlenA (lpString="*.jpeg") returned 6 [0073.750] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF", pszSpec="*.psd") returned 0 [0073.750] lstrlenA (lpString="*.psd") returned 5 [0073.750] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF", pszSpec="*.cdr") returned 0 [0073.750] lstrlenA (lpString="*.cdr") returned 5 [0073.750] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF", pszSpec="*.dwg") returned 0 [0073.750] lstrlenA (lpString="*.dwg") returned 5 [0073.750] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF", pszSpec="*.max") returned 0 [0073.750] lstrlenA (lpString="*.max") returned 5 [0073.750] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF", pszSpec="*.bmp") returned 0 [0073.750] lstrlenA (lpString="*.bmp") returned 5 [0073.750] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF", pszSpec="*.gif") returned 1 [0073.751] lstrlenA (lpString="*.gif") returned 5 [0073.751] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" [0073.751] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" [0073.751] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF." [0073.751] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF.BD" [0073.751] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.751] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ad [0073.751] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbbc0d0e, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.751] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.751] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x251, lpOverlapped=0x0) returned 1 [0073.752] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF") returned="WB01294_.GIF" [0073.752] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.752] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x251, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x251, lpOverlapped=0x0) returned 1 [0073.752] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.752] CloseHandle (hObject=0x1cc) returned 1 [0073.753] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01294_.gif.bd")) returned 1 [0073.760] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbbc5b87, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01295_.GIF", cAlternateFileName="")) returned 1 [0073.760] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.760] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01295_.GIF") returned -1 [0073.760] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01295_.GIF") returned -1 [0073.760] lstrcmpiA (lpString1="", lpString2="WB01295_.GIF") returned -1 [0073.760] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF") returned="WB01294_.GIF" [0073.760] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.760] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.760] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.760] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.760] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01295_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" [0073.760] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF", pszSpec="*.zip") returned 0 [0073.760] lstrlenA (lpString="*.zip") returned 5 [0073.760] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF", pszSpec="*.rar") returned 0 [0073.760] lstrlenA (lpString="*.rar") returned 5 [0073.760] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF", pszSpec="*.7z") returned 0 [0073.760] lstrlenA (lpString="*.7z") returned 4 [0073.760] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF", pszSpec="*.tar") returned 0 [0073.761] lstrlenA (lpString="*.tar") returned 5 [0073.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF", pszSpec="*.gzip") returned 0 [0073.761] lstrlenA (lpString="*.gzip") returned 6 [0073.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF", pszSpec="*.jpg") returned 0 [0073.761] lstrlenA (lpString="*.jpg") returned 5 [0073.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF", pszSpec="*.jpeg") returned 0 [0073.761] lstrlenA (lpString="*.jpeg") returned 6 [0073.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF", pszSpec="*.psd") returned 0 [0073.761] lstrlenA (lpString="*.psd") returned 5 [0073.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF", pszSpec="*.cdr") returned 0 [0073.761] lstrlenA (lpString="*.cdr") returned 5 [0073.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF", pszSpec="*.dwg") returned 0 [0073.761] lstrlenA (lpString="*.dwg") returned 5 [0073.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF", pszSpec="*.max") returned 0 [0073.761] lstrlenA (lpString="*.max") returned 5 [0073.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF", pszSpec="*.bmp") returned 0 [0073.761] lstrlenA (lpString="*.bmp") returned 5 [0073.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF", pszSpec="*.gif") returned 1 [0073.761] lstrlenA (lpString="*.gif") returned 5 [0073.761] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" [0073.761] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" [0073.761] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF." [0073.761] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF.BD" [0073.761] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.762] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x161 [0073.762] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbbc5b87, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.762] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.762] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x105, lpOverlapped=0x0) returned 1 [0073.763] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF") returned="WB01295_.GIF" [0073.763] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.763] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x105, lpOverlapped=0x0) returned 1 [0073.763] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.763] CloseHandle (hObject=0x1cc) returned 1 [0073.763] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01295_.gif.bd")) returned 1 [0073.764] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbbca924, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01296_.GIF", cAlternateFileName="")) returned 1 [0073.764] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.764] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01296_.GIF") returned -1 [0073.764] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01296_.GIF") returned -1 [0073.764] lstrcmpiA (lpString1="", lpString2="WB01296_.GIF") returned -1 [0073.764] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF") returned="WB01295_.GIF" [0073.764] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.764] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.764] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.764] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.764] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01296_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" [0073.764] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF", pszSpec="*.zip") returned 0 [0073.764] lstrlenA (lpString="*.zip") returned 5 [0073.764] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF", pszSpec="*.rar") returned 0 [0073.764] lstrlenA (lpString="*.rar") returned 5 [0073.764] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF", pszSpec="*.7z") returned 0 [0073.765] lstrlenA (lpString="*.7z") returned 4 [0073.765] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF", pszSpec="*.tar") returned 0 [0073.765] lstrlenA (lpString="*.tar") returned 5 [0073.765] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF", pszSpec="*.gzip") returned 0 [0073.765] lstrlenA (lpString="*.gzip") returned 6 [0073.765] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF", pszSpec="*.jpg") returned 0 [0073.765] lstrlenA (lpString="*.jpg") returned 5 [0073.765] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF", pszSpec="*.jpeg") returned 0 [0073.765] lstrlenA (lpString="*.jpeg") returned 6 [0073.765] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF", pszSpec="*.psd") returned 0 [0073.765] lstrlenA (lpString="*.psd") returned 5 [0073.765] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF", pszSpec="*.cdr") returned 0 [0073.765] lstrlenA (lpString="*.cdr") returned 5 [0073.765] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF", pszSpec="*.dwg") returned 0 [0073.765] lstrlenA (lpString="*.dwg") returned 5 [0073.765] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF", pszSpec="*.max") returned 0 [0073.765] lstrlenA (lpString="*.max") returned 5 [0073.765] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF", pszSpec="*.bmp") returned 0 [0073.765] lstrlenA (lpString="*.bmp") returned 5 [0073.765] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF", pszSpec="*.gif") returned 1 [0073.765] lstrlenA (lpString="*.gif") returned 5 [0073.765] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" [0073.765] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" [0073.765] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF." [0073.765] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF.BD" [0073.765] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.766] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ef [0073.766] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbbca924, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.766] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.766] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x193, lpOverlapped=0x0) returned 1 [0073.767] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF") returned="WB01296_.GIF" [0073.767] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.767] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x193, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x193, lpOverlapped=0x0) returned 1 [0073.767] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.767] CloseHandle (hObject=0x1cc) returned 1 [0073.767] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01296_.gif.bd")) returned 1 [0073.768] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9e0f526, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01297_.GIF", cAlternateFileName="")) returned 1 [0073.768] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.768] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01297_.GIF") returned -1 [0073.768] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01297_.GIF") returned -1 [0073.768] lstrcmpiA (lpString1="", lpString2="WB01297_.GIF") returned -1 [0073.768] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF") returned="WB01296_.GIF" [0073.768] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.768] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.768] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.768] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.768] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01297_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" [0073.768] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF", pszSpec="*.zip") returned 0 [0073.768] lstrlenA (lpString="*.zip") returned 5 [0073.768] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF", pszSpec="*.rar") returned 0 [0073.768] lstrlenA (lpString="*.rar") returned 5 [0073.768] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF", pszSpec="*.7z") returned 0 [0073.768] lstrlenA (lpString="*.7z") returned 4 [0073.768] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF", pszSpec="*.tar") returned 0 [0073.768] lstrlenA (lpString="*.tar") returned 5 [0073.768] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF", pszSpec="*.gzip") returned 0 [0073.768] lstrlenA (lpString="*.gzip") returned 6 [0073.768] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF", pszSpec="*.jpg") returned 0 [0073.768] lstrlenA (lpString="*.jpg") returned 5 [0073.768] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF", pszSpec="*.jpeg") returned 0 [0073.768] lstrlenA (lpString="*.jpeg") returned 6 [0073.768] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF", pszSpec="*.psd") returned 0 [0073.768] lstrlenA (lpString="*.psd") returned 5 [0073.768] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF", pszSpec="*.cdr") returned 0 [0073.769] lstrlenA (lpString="*.cdr") returned 5 [0073.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF", pszSpec="*.dwg") returned 0 [0073.769] lstrlenA (lpString="*.dwg") returned 5 [0073.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF", pszSpec="*.max") returned 0 [0073.769] lstrlenA (lpString="*.max") returned 5 [0073.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF", pszSpec="*.bmp") returned 0 [0073.769] lstrlenA (lpString="*.bmp") returned 5 [0073.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF", pszSpec="*.gif") returned 1 [0073.769] lstrlenA (lpString="*.gif") returned 5 [0073.769] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" [0073.769] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" [0073.769] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF." [0073.769] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF.BD" [0073.769] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.769] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x37e [0073.769] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9e0f526, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.769] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.769] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x322, lpOverlapped=0x0) returned 1 [0073.772] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF") returned="WB01297_.GIF" [0073.772] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.772] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x322, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x322, lpOverlapped=0x0) returned 1 [0073.772] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.772] CloseHandle (hObject=0x1cc) returned 1 [0073.772] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01297_.gif.bd")) returned 1 [0073.773] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbbcf75d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01298_.GIF", cAlternateFileName="")) returned 1 [0073.773] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.773] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01298_.GIF") returned -1 [0073.773] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01298_.GIF") returned -1 [0073.773] lstrcmpiA (lpString1="", lpString2="WB01298_.GIF") returned -1 [0073.773] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF") returned="WB01297_.GIF" [0073.773] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.773] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.773] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.773] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.773] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01298_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" [0073.773] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF", pszSpec="*.zip") returned 0 [0073.773] lstrlenA (lpString="*.zip") returned 5 [0073.773] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF", pszSpec="*.rar") returned 0 [0073.773] lstrlenA (lpString="*.rar") returned 5 [0073.773] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF", pszSpec="*.7z") returned 0 [0073.773] lstrlenA (lpString="*.7z") returned 4 [0073.773] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF", pszSpec="*.tar") returned 0 [0073.773] lstrlenA (lpString="*.tar") returned 5 [0073.773] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF", pszSpec="*.gzip") returned 0 [0073.774] lstrlenA (lpString="*.gzip") returned 6 [0073.774] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF", pszSpec="*.jpg") returned 0 [0073.774] lstrlenA (lpString="*.jpg") returned 5 [0073.774] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF", pszSpec="*.jpeg") returned 0 [0073.774] lstrlenA (lpString="*.jpeg") returned 6 [0073.774] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF", pszSpec="*.psd") returned 0 [0073.774] lstrlenA (lpString="*.psd") returned 5 [0073.774] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF", pszSpec="*.cdr") returned 0 [0073.774] lstrlenA (lpString="*.cdr") returned 5 [0073.774] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF", pszSpec="*.dwg") returned 0 [0073.774] lstrlenA (lpString="*.dwg") returned 5 [0073.774] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF", pszSpec="*.max") returned 0 [0073.774] lstrlenA (lpString="*.max") returned 5 [0073.774] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF", pszSpec="*.bmp") returned 0 [0073.774] lstrlenA (lpString="*.bmp") returned 5 [0073.774] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF", pszSpec="*.gif") returned 1 [0073.774] lstrlenA (lpString="*.gif") returned 5 [0073.774] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" [0073.774] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" [0073.774] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF." [0073.774] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF.BD" [0073.774] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.774] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2bc [0073.774] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbbcf75d, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.775] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.775] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x260, lpOverlapped=0x0) returned 1 [0073.776] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF") returned="WB01298_.GIF" [0073.776] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.776] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x260, lpOverlapped=0x0) returned 1 [0073.776] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.776] CloseHandle (hObject=0x1cc) returned 1 [0073.776] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01298_.gif.bd")) returned 1 [0073.777] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9e156d2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01299_.GIF", cAlternateFileName="")) returned 1 [0073.777] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.777] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01299_.GIF") returned -1 [0073.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01299_.GIF") returned -1 [0073.777] lstrcmpiA (lpString1="", lpString2="WB01299_.GIF") returned -1 [0073.777] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF") returned="WB01298_.GIF" [0073.777] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.777] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.777] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.777] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.777] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01299_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" [0073.778] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF", pszSpec="*.zip") returned 0 [0073.778] lstrlenA (lpString="*.zip") returned 5 [0073.778] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF", pszSpec="*.rar") returned 0 [0073.778] lstrlenA (lpString="*.rar") returned 5 [0073.778] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF", pszSpec="*.7z") returned 0 [0073.778] lstrlenA (lpString="*.7z") returned 4 [0073.778] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF", pszSpec="*.tar") returned 0 [0073.778] lstrlenA (lpString="*.tar") returned 5 [0073.778] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF", pszSpec="*.gzip") returned 0 [0073.778] lstrlenA (lpString="*.gzip") returned 6 [0073.778] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF", pszSpec="*.jpg") returned 0 [0073.778] lstrlenA (lpString="*.jpg") returned 5 [0073.778] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF", pszSpec="*.jpeg") returned 0 [0073.778] lstrlenA (lpString="*.jpeg") returned 6 [0073.778] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF", pszSpec="*.psd") returned 0 [0073.778] lstrlenA (lpString="*.psd") returned 5 [0073.778] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF", pszSpec="*.cdr") returned 0 [0073.778] lstrlenA (lpString="*.cdr") returned 5 [0073.778] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF", pszSpec="*.dwg") returned 0 [0073.778] lstrlenA (lpString="*.dwg") returned 5 [0073.778] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF", pszSpec="*.max") returned 0 [0073.778] lstrlenA (lpString="*.max") returned 5 [0073.778] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF", pszSpec="*.bmp") returned 0 [0073.778] lstrlenA (lpString="*.bmp") returned 5 [0073.778] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF", pszSpec="*.gif") returned 1 [0073.778] lstrlenA (lpString="*.gif") returned 5 [0073.778] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" [0073.778] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" [0073.778] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF." [0073.778] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF.BD" [0073.778] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.779] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13e [0073.779] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9e156d2, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.779] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.779] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xe2, lpOverlapped=0x0) returned 1 [0073.780] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF") returned="WB01299_.GIF" [0073.780] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.780] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xe2, lpOverlapped=0x0) returned 1 [0073.780] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.780] CloseHandle (hObject=0x1cc) returned 1 [0073.780] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01299_.gif.bd")) returned 1 [0073.781] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbbd45c6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x250, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01300_.GIF", cAlternateFileName="")) returned 1 [0073.781] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.781] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01300_.GIF") returned -1 [0073.781] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01300_.GIF") returned -1 [0073.781] lstrcmpiA (lpString1="", lpString2="WB01300_.GIF") returned -1 [0073.781] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF") returned="WB01299_.GIF" [0073.781] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.781] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.781] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.781] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.781] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01300_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" [0073.781] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF", pszSpec="*.zip") returned 0 [0073.781] lstrlenA (lpString="*.zip") returned 5 [0073.781] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF", pszSpec="*.rar") returned 0 [0073.781] lstrlenA (lpString="*.rar") returned 5 [0073.781] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF", pszSpec="*.7z") returned 0 [0073.781] lstrlenA (lpString="*.7z") returned 4 [0073.781] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF", pszSpec="*.tar") returned 0 [0073.781] lstrlenA (lpString="*.tar") returned 5 [0073.782] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF", pszSpec="*.gzip") returned 0 [0073.782] lstrlenA (lpString="*.gzip") returned 6 [0073.782] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF", pszSpec="*.jpg") returned 0 [0073.782] lstrlenA (lpString="*.jpg") returned 5 [0073.782] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF", pszSpec="*.jpeg") returned 0 [0073.782] lstrlenA (lpString="*.jpeg") returned 6 [0073.782] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF", pszSpec="*.psd") returned 0 [0073.782] lstrlenA (lpString="*.psd") returned 5 [0073.782] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF", pszSpec="*.cdr") returned 0 [0073.782] lstrlenA (lpString="*.cdr") returned 5 [0073.782] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF", pszSpec="*.dwg") returned 0 [0073.782] lstrlenA (lpString="*.dwg") returned 5 [0073.782] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF", pszSpec="*.max") returned 0 [0073.782] lstrlenA (lpString="*.max") returned 5 [0073.782] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF", pszSpec="*.bmp") returned 0 [0073.782] lstrlenA (lpString="*.bmp") returned 5 [0073.782] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF", pszSpec="*.gif") returned 1 [0073.782] lstrlenA (lpString="*.gif") returned 5 [0073.782] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" [0073.782] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" [0073.782] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF." [0073.782] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF.BD" [0073.782] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.782] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x250 [0073.783] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbbd45c6, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.783] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.783] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1f4, lpOverlapped=0x0) returned 1 [0073.789] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF") returned="WB01300_.GIF" [0073.789] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.789] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1f4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1f4, lpOverlapped=0x0) returned 1 [0073.790] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.790] CloseHandle (hObject=0x1cc) returned 1 [0073.790] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01300_.gif.bd")) returned 1 [0073.790] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbbda746, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01301_.GIF", cAlternateFileName="")) returned 1 [0073.790] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.790] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01301_.GIF") returned -1 [0073.790] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01301_.GIF") returned -1 [0073.790] lstrcmpiA (lpString1="", lpString2="WB01301_.GIF") returned -1 [0073.790] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF") returned="WB01300_.GIF" [0073.791] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.791] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.791] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.791] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.791] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01301_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" [0073.791] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF", pszSpec="*.zip") returned 0 [0073.791] lstrlenA (lpString="*.zip") returned 5 [0073.791] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF", pszSpec="*.rar") returned 0 [0073.791] lstrlenA (lpString="*.rar") returned 5 [0073.791] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF", pszSpec="*.7z") returned 0 [0073.791] lstrlenA (lpString="*.7z") returned 4 [0073.791] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF", pszSpec="*.tar") returned 0 [0073.791] lstrlenA (lpString="*.tar") returned 5 [0073.791] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF", pszSpec="*.gzip") returned 0 [0073.791] lstrlenA (lpString="*.gzip") returned 6 [0073.791] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF", pszSpec="*.jpg") returned 0 [0073.791] lstrlenA (lpString="*.jpg") returned 5 [0073.791] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF", pszSpec="*.jpeg") returned 0 [0073.791] lstrlenA (lpString="*.jpeg") returned 6 [0073.791] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF", pszSpec="*.psd") returned 0 [0073.791] lstrlenA (lpString="*.psd") returned 5 [0073.791] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF", pszSpec="*.cdr") returned 0 [0073.791] lstrlenA (lpString="*.cdr") returned 5 [0073.791] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF", pszSpec="*.dwg") returned 0 [0073.791] lstrlenA (lpString="*.dwg") returned 5 [0073.791] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF", pszSpec="*.max") returned 0 [0073.791] lstrlenA (lpString="*.max") returned 5 [0073.791] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF", pszSpec="*.bmp") returned 0 [0073.791] lstrlenA (lpString="*.bmp") returned 5 [0073.791] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF", pszSpec="*.gif") returned 1 [0073.791] lstrlenA (lpString="*.gif") returned 5 [0073.792] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" [0073.792] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" [0073.792] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF." [0073.792] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.BD" [0073.792] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.793] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a9 [0073.793] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbbda746, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.793] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.793] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x24d, lpOverlapped=0x0) returned 1 [0073.794] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF") returned="WB01301_.GIF" [0073.794] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.794] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x24d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x24d, lpOverlapped=0x0) returned 1 [0073.795] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.795] CloseHandle (hObject=0x1cc) returned 1 [0073.795] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01301_.gif.bd")) returned 1 [0073.797] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbbde1ca, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2076, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01304G.GIF", cAlternateFileName="")) returned 1 [0073.797] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.797] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01304G.GIF") returned -1 [0073.797] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01304G.GIF") returned -1 [0073.797] lstrcmpiA (lpString1="", lpString2="WB01304G.GIF") returned -1 [0073.797] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF") returned="WB01301_.GIF" [0073.797] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.797] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.797] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.797] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.797] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01304G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" [0073.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF", pszSpec="*.zip") returned 0 [0073.797] lstrlenA (lpString="*.zip") returned 5 [0073.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF", pszSpec="*.rar") returned 0 [0073.797] lstrlenA (lpString="*.rar") returned 5 [0073.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF", pszSpec="*.7z") returned 0 [0073.797] lstrlenA (lpString="*.7z") returned 4 [0073.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF", pszSpec="*.tar") returned 0 [0073.797] lstrlenA (lpString="*.tar") returned 5 [0073.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF", pszSpec="*.gzip") returned 0 [0073.797] lstrlenA (lpString="*.gzip") returned 6 [0073.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF", pszSpec="*.jpg") returned 0 [0073.797] lstrlenA (lpString="*.jpg") returned 5 [0073.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF", pszSpec="*.jpeg") returned 0 [0073.797] lstrlenA (lpString="*.jpeg") returned 6 [0073.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF", pszSpec="*.psd") returned 0 [0073.797] lstrlenA (lpString="*.psd") returned 5 [0073.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF", pszSpec="*.cdr") returned 0 [0073.798] lstrlenA (lpString="*.cdr") returned 5 [0073.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF", pszSpec="*.dwg") returned 0 [0073.798] lstrlenA (lpString="*.dwg") returned 5 [0073.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF", pszSpec="*.max") returned 0 [0073.798] lstrlenA (lpString="*.max") returned 5 [0073.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF", pszSpec="*.bmp") returned 0 [0073.798] lstrlenA (lpString="*.bmp") returned 5 [0073.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF", pszSpec="*.gif") returned 1 [0073.798] lstrlenA (lpString="*.gif") returned 5 [0073.798] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" [0073.798] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" [0073.798] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF." [0073.798] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.BD" [0073.798] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.798] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2076 [0073.798] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbbde1ca, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.798] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.798] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x201a, lpOverlapped=0x0) returned 1 [0073.800] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF") returned="WB01304G.GIF" [0073.800] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.801] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x201a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x201a, lpOverlapped=0x0) returned 1 [0073.801] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.801] CloseHandle (hObject=0x1cc) returned 1 [0073.801] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01304g.gif.bd")) returned 1 [0073.801] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbbe3003, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01330_.GIF", cAlternateFileName="")) returned 1 [0073.801] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.801] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01330_.GIF") returned -1 [0073.802] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01330_.GIF") returned -1 [0073.802] lstrcmpiA (lpString1="", lpString2="WB01330_.GIF") returned -1 [0073.802] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF") returned="WB01304G.GIF" [0073.802] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.802] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.802] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.802] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.802] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01330_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" [0073.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF", pszSpec="*.zip") returned 0 [0073.802] lstrlenA (lpString="*.zip") returned 5 [0073.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF", pszSpec="*.rar") returned 0 [0073.802] lstrlenA (lpString="*.rar") returned 5 [0073.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF", pszSpec="*.7z") returned 0 [0073.802] lstrlenA (lpString="*.7z") returned 4 [0073.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF", pszSpec="*.tar") returned 0 [0073.802] lstrlenA (lpString="*.tar") returned 5 [0073.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF", pszSpec="*.gzip") returned 0 [0073.802] lstrlenA (lpString="*.gzip") returned 6 [0073.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF", pszSpec="*.jpg") returned 0 [0073.802] lstrlenA (lpString="*.jpg") returned 5 [0073.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF", pszSpec="*.jpeg") returned 0 [0073.802] lstrlenA (lpString="*.jpeg") returned 6 [0073.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF", pszSpec="*.psd") returned 0 [0073.802] lstrlenA (lpString="*.psd") returned 5 [0073.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF", pszSpec="*.cdr") returned 0 [0073.802] lstrlenA (lpString="*.cdr") returned 5 [0073.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF", pszSpec="*.dwg") returned 0 [0073.802] lstrlenA (lpString="*.dwg") returned 5 [0073.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF", pszSpec="*.max") returned 0 [0073.802] lstrlenA (lpString="*.max") returned 5 [0073.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF", pszSpec="*.bmp") returned 0 [0073.803] lstrlenA (lpString="*.bmp") returned 5 [0073.803] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF", pszSpec="*.gif") returned 1 [0073.803] lstrlenA (lpString="*.gif") returned 5 [0073.803] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" [0073.803] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" [0073.803] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF." [0073.803] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.BD" [0073.803] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.803] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x172 [0073.803] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbbe3003, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.803] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.803] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x116, lpOverlapped=0x0) returned 1 [0073.804] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF") returned="WB01330_.GIF" [0073.804] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.804] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x116, lpOverlapped=0x0) returned 1 [0073.804] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.804] CloseHandle (hObject=0x1cc) returned 1 [0073.805] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01330_.gif.bd")) returned 1 [0073.805] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9e1a53f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x899, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01734_.GIF", cAlternateFileName="")) returned 1 [0073.805] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.805] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01734_.GIF") returned -1 [0073.805] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01734_.GIF") returned -1 [0073.805] lstrcmpiA (lpString1="", lpString2="WB01734_.GIF") returned -1 [0073.805] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF") returned="WB01330_.GIF" [0073.805] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.805] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.805] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.805] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.805] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01734_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" [0073.805] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF", pszSpec="*.zip") returned 0 [0073.806] lstrlenA (lpString="*.zip") returned 5 [0073.806] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF", pszSpec="*.rar") returned 0 [0073.806] lstrlenA (lpString="*.rar") returned 5 [0073.806] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF", pszSpec="*.7z") returned 0 [0073.806] lstrlenA (lpString="*.7z") returned 4 [0073.806] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF", pszSpec="*.tar") returned 0 [0073.806] lstrlenA (lpString="*.tar") returned 5 [0073.806] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF", pszSpec="*.gzip") returned 0 [0073.806] lstrlenA (lpString="*.gzip") returned 6 [0073.806] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF", pszSpec="*.jpg") returned 0 [0073.806] lstrlenA (lpString="*.jpg") returned 5 [0073.806] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF", pszSpec="*.jpeg") returned 0 [0073.806] lstrlenA (lpString="*.jpeg") returned 6 [0073.806] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF", pszSpec="*.psd") returned 0 [0073.806] lstrlenA (lpString="*.psd") returned 5 [0073.806] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF", pszSpec="*.cdr") returned 0 [0073.806] lstrlenA (lpString="*.cdr") returned 5 [0073.806] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF", pszSpec="*.dwg") returned 0 [0073.806] lstrlenA (lpString="*.dwg") returned 5 [0073.806] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF", pszSpec="*.max") returned 0 [0073.806] lstrlenA (lpString="*.max") returned 5 [0073.806] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF", pszSpec="*.bmp") returned 0 [0073.806] lstrlenA (lpString="*.bmp") returned 5 [0073.806] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF", pszSpec="*.gif") returned 1 [0073.806] lstrlenA (lpString="*.gif") returned 5 [0073.806] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" [0073.806] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" [0073.806] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF." [0073.806] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.BD" [0073.806] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.809] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x899 [0073.810] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9e1a53f, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.810] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.810] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x83d, lpOverlapped=0x0) returned 1 [0073.813] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF") returned="WB01734_.GIF" [0073.813] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.813] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x83d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x83d, lpOverlapped=0x0) returned 1 [0073.813] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.813] CloseHandle (hObject=0x1cc) returned 1 [0073.814] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01734_.gif.bd")) returned 1 [0073.814] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9e1f33a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01740_.GIF", cAlternateFileName="")) returned 1 [0073.814] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.814] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01740_.GIF") returned -1 [0073.814] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01740_.GIF") returned -1 [0073.814] lstrcmpiA (lpString1="", lpString2="WB01740_.GIF") returned -1 [0073.814] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF") returned="WB01734_.GIF" [0073.814] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.814] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.814] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.814] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.814] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01740_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" [0073.814] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF", pszSpec="*.zip") returned 0 [0073.814] lstrlenA (lpString="*.zip") returned 5 [0073.814] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF", pszSpec="*.rar") returned 0 [0073.815] lstrlenA (lpString="*.rar") returned 5 [0073.815] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF", pszSpec="*.7z") returned 0 [0073.815] lstrlenA (lpString="*.7z") returned 4 [0073.815] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF", pszSpec="*.tar") returned 0 [0073.815] lstrlenA (lpString="*.tar") returned 5 [0073.815] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF", pszSpec="*.gzip") returned 0 [0073.815] lstrlenA (lpString="*.gzip") returned 6 [0073.815] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF", pszSpec="*.jpg") returned 0 [0073.815] lstrlenA (lpString="*.jpg") returned 5 [0073.815] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF", pszSpec="*.jpeg") returned 0 [0073.815] lstrlenA (lpString="*.jpeg") returned 6 [0073.815] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF", pszSpec="*.psd") returned 0 [0073.815] lstrlenA (lpString="*.psd") returned 5 [0073.815] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF", pszSpec="*.cdr") returned 0 [0073.815] lstrlenA (lpString="*.cdr") returned 5 [0073.815] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF", pszSpec="*.dwg") returned 0 [0073.815] lstrlenA (lpString="*.dwg") returned 5 [0073.815] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF", pszSpec="*.max") returned 0 [0073.815] lstrlenA (lpString="*.max") returned 5 [0073.815] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF", pszSpec="*.bmp") returned 0 [0073.815] lstrlenA (lpString="*.bmp") returned 5 [0073.815] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF", pszSpec="*.gif") returned 1 [0073.815] lstrlenA (lpString="*.gif") returned 5 [0073.815] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" [0073.815] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" [0073.815] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF." [0073.815] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.BD" [0073.815] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.816] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c3 [0073.816] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9e1f33a, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.816] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.816] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x267, lpOverlapped=0x0) returned 1 [0073.817] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF") returned="WB01740_.GIF" [0073.817] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.817] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x267, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x267, lpOverlapped=0x0) returned 1 [0073.817] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.817] CloseHandle (hObject=0x1cc) returned 1 [0073.817] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01740_.gif.bd")) returned 1 [0073.819] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9e2415a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01742_.GIF", cAlternateFileName="")) returned 1 [0073.819] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.819] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01742_.GIF") returned -1 [0073.819] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01742_.GIF") returned -1 [0073.819] lstrcmpiA (lpString1="", lpString2="WB01742_.GIF") returned -1 [0073.819] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF") returned="WB01740_.GIF" [0073.819] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.819] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.819] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.819] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.819] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01742_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" [0073.819] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF", pszSpec="*.zip") returned 0 [0073.819] lstrlenA (lpString="*.zip") returned 5 [0073.819] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF", pszSpec="*.rar") returned 0 [0073.819] lstrlenA (lpString="*.rar") returned 5 [0073.819] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF", pszSpec="*.7z") returned 0 [0073.819] lstrlenA (lpString="*.7z") returned 4 [0073.819] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF", pszSpec="*.tar") returned 0 [0073.819] lstrlenA (lpString="*.tar") returned 5 [0073.819] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF", pszSpec="*.gzip") returned 0 [0073.820] lstrlenA (lpString="*.gzip") returned 6 [0073.820] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF", pszSpec="*.jpg") returned 0 [0073.820] lstrlenA (lpString="*.jpg") returned 5 [0073.820] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF", pszSpec="*.jpeg") returned 0 [0073.820] lstrlenA (lpString="*.jpeg") returned 6 [0073.820] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF", pszSpec="*.psd") returned 0 [0073.820] lstrlenA (lpString="*.psd") returned 5 [0073.820] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF", pszSpec="*.cdr") returned 0 [0073.820] lstrlenA (lpString="*.cdr") returned 5 [0073.820] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF", pszSpec="*.dwg") returned 0 [0073.820] lstrlenA (lpString="*.dwg") returned 5 [0073.820] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF", pszSpec="*.max") returned 0 [0073.820] lstrlenA (lpString="*.max") returned 5 [0073.820] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF", pszSpec="*.bmp") returned 0 [0073.820] lstrlenA (lpString="*.bmp") returned 5 [0073.820] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF", pszSpec="*.gif") returned 1 [0073.820] lstrlenA (lpString="*.gif") returned 5 [0073.820] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" [0073.820] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" [0073.820] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF." [0073.820] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.BD" [0073.820] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.820] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x253 [0073.821] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9e2415a, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.821] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.821] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1f7, lpOverlapped=0x0) returned 1 [0073.822] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF") returned="WB01742_.GIF" [0073.822] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.822] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1f7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1f7, lpOverlapped=0x0) returned 1 [0073.822] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.822] CloseHandle (hObject=0x1cc) returned 1 [0073.822] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01742_.gif.bd")) returned 1 [0073.822] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbbef32b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01743_.GIF", cAlternateFileName="")) returned 1 [0073.822] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.823] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01743_.GIF") returned -1 [0073.823] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01743_.GIF") returned -1 [0073.823] lstrcmpiA (lpString1="", lpString2="WB01743_.GIF") returned -1 [0073.823] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF") returned="WB01742_.GIF" [0073.823] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.823] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.823] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.823] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.823] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01743_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" [0073.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF", pszSpec="*.zip") returned 0 [0073.823] lstrlenA (lpString="*.zip") returned 5 [0073.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF", pszSpec="*.rar") returned 0 [0073.823] lstrlenA (lpString="*.rar") returned 5 [0073.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF", pszSpec="*.7z") returned 0 [0073.823] lstrlenA (lpString="*.7z") returned 4 [0073.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF", pszSpec="*.tar") returned 0 [0073.823] lstrlenA (lpString="*.tar") returned 5 [0073.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF", pszSpec="*.gzip") returned 0 [0073.823] lstrlenA (lpString="*.gzip") returned 6 [0073.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF", pszSpec="*.jpg") returned 0 [0073.823] lstrlenA (lpString="*.jpg") returned 5 [0073.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF", pszSpec="*.jpeg") returned 0 [0073.823] lstrlenA (lpString="*.jpeg") returned 6 [0073.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF", pszSpec="*.psd") returned 0 [0073.823] lstrlenA (lpString="*.psd") returned 5 [0073.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF", pszSpec="*.cdr") returned 0 [0073.823] lstrlenA (lpString="*.cdr") returned 5 [0073.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF", pszSpec="*.dwg") returned 0 [0073.823] lstrlenA (lpString="*.dwg") returned 5 [0073.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF", pszSpec="*.max") returned 0 [0073.823] lstrlenA (lpString="*.max") returned 5 [0073.824] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF", pszSpec="*.bmp") returned 0 [0073.824] lstrlenA (lpString="*.bmp") returned 5 [0073.824] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF", pszSpec="*.gif") returned 1 [0073.824] lstrlenA (lpString="*.gif") returned 5 [0073.824] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" [0073.824] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" [0073.824] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF." [0073.824] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.BD" [0073.824] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.825] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4d5 [0073.825] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbbef32b, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.825] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.825] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x479, lpOverlapped=0x0) returned 1 [0073.826] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF") returned="WB01743_.GIF" [0073.826] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.826] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x479, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x479, lpOverlapped=0x0) returned 1 [0073.827] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.827] CloseHandle (hObject=0x1cc) returned 1 [0073.827] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01743_.gif.bd")) returned 1 [0073.827] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbbf417f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x31f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01744_.GIF", cAlternateFileName="")) returned 1 [0073.827] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.827] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01744_.GIF") returned -1 [0073.827] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01744_.GIF") returned -1 [0073.827] lstrcmpiA (lpString1="", lpString2="WB01744_.GIF") returned -1 [0073.827] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF") returned="WB01743_.GIF" [0073.827] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.827] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.828] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.828] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.828] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01744_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" [0073.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF", pszSpec="*.zip") returned 0 [0073.828] lstrlenA (lpString="*.zip") returned 5 [0073.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF", pszSpec="*.rar") returned 0 [0073.828] lstrlenA (lpString="*.rar") returned 5 [0073.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF", pszSpec="*.7z") returned 0 [0073.828] lstrlenA (lpString="*.7z") returned 4 [0073.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF", pszSpec="*.tar") returned 0 [0073.828] lstrlenA (lpString="*.tar") returned 5 [0073.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF", pszSpec="*.gzip") returned 0 [0073.828] lstrlenA (lpString="*.gzip") returned 6 [0073.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF", pszSpec="*.jpg") returned 0 [0073.828] lstrlenA (lpString="*.jpg") returned 5 [0073.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF", pszSpec="*.jpeg") returned 0 [0073.828] lstrlenA (lpString="*.jpeg") returned 6 [0073.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF", pszSpec="*.psd") returned 0 [0073.828] lstrlenA (lpString="*.psd") returned 5 [0073.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF", pszSpec="*.cdr") returned 0 [0073.828] lstrlenA (lpString="*.cdr") returned 5 [0073.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF", pszSpec="*.dwg") returned 0 [0073.828] lstrlenA (lpString="*.dwg") returned 5 [0073.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF", pszSpec="*.max") returned 0 [0073.828] lstrlenA (lpString="*.max") returned 5 [0073.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF", pszSpec="*.bmp") returned 0 [0073.828] lstrlenA (lpString="*.bmp") returned 5 [0073.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF", pszSpec="*.gif") returned 1 [0073.828] lstrlenA (lpString="*.gif") returned 5 [0073.828] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" [0073.828] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" [0073.829] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF." [0073.829] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.BD" [0073.829] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.829] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x31f [0073.829] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbbf417f, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.829] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.829] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x2c3, lpOverlapped=0x0) returned 1 [0073.863] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF") returned="WB01744_.GIF" [0073.863] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.863] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x2c3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x2c3, lpOverlapped=0x0) returned 1 [0073.863] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.863] CloseHandle (hObject=0x1cc) returned 1 [0073.863] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01744_.gif.bd")) returned 1 [0073.864] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbbf8f92, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01745_.GIF", cAlternateFileName="")) returned 1 [0073.864] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.864] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01745_.GIF") returned -1 [0073.864] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01745_.GIF") returned -1 [0073.864] lstrcmpiA (lpString1="", lpString2="WB01745_.GIF") returned -1 [0073.864] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF") returned="WB01744_.GIF" [0073.864] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.864] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.864] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.864] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.865] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01745_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" [0073.865] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF", pszSpec="*.zip") returned 0 [0073.865] lstrlenA (lpString="*.zip") returned 5 [0073.865] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF", pszSpec="*.rar") returned 0 [0073.865] lstrlenA (lpString="*.rar") returned 5 [0073.865] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF", pszSpec="*.7z") returned 0 [0073.865] lstrlenA (lpString="*.7z") returned 4 [0073.865] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF", pszSpec="*.tar") returned 0 [0073.865] lstrlenA (lpString="*.tar") returned 5 [0073.865] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF", pszSpec="*.gzip") returned 0 [0073.865] lstrlenA (lpString="*.gzip") returned 6 [0073.865] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF", pszSpec="*.jpg") returned 0 [0073.865] lstrlenA (lpString="*.jpg") returned 5 [0073.865] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF", pszSpec="*.jpeg") returned 0 [0073.865] lstrlenA (lpString="*.jpeg") returned 6 [0073.865] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF", pszSpec="*.psd") returned 0 [0073.865] lstrlenA (lpString="*.psd") returned 5 [0073.865] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF", pszSpec="*.cdr") returned 0 [0073.865] lstrlenA (lpString="*.cdr") returned 5 [0073.865] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF", pszSpec="*.dwg") returned 0 [0073.865] lstrlenA (lpString="*.dwg") returned 5 [0073.865] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF", pszSpec="*.max") returned 0 [0073.865] lstrlenA (lpString="*.max") returned 5 [0073.865] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF", pszSpec="*.bmp") returned 0 [0073.865] lstrlenA (lpString="*.bmp") returned 5 [0073.865] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF", pszSpec="*.gif") returned 1 [0073.865] lstrlenA (lpString="*.gif") returned 5 [0073.865] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" [0073.865] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" [0073.865] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF." [0073.866] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.BD" [0073.866] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.866] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5ac [0073.866] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbbf8f92, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.866] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.866] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x550, lpOverlapped=0x0) returned 1 [0073.868] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF") returned="WB01745_.GIF" [0073.868] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.868] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x550, lpOverlapped=0x0) returned 1 [0073.868] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.868] CloseHandle (hObject=0x1cc) returned 1 [0073.868] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01745_.gif.bd")) returned 1 [0073.869] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbbfdda6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01746_.GIF", cAlternateFileName="")) returned 1 [0073.869] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.869] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01746_.GIF") returned -1 [0073.869] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01746_.GIF") returned -1 [0073.869] lstrcmpiA (lpString1="", lpString2="WB01746_.GIF") returned -1 [0073.869] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF") returned="WB01745_.GIF" [0073.869] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.869] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.869] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.869] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.869] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01746_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" [0073.869] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF", pszSpec="*.zip") returned 0 [0073.869] lstrlenA (lpString="*.zip") returned 5 [0073.869] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF", pszSpec="*.rar") returned 0 [0073.869] lstrlenA (lpString="*.rar") returned 5 [0073.869] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF", pszSpec="*.7z") returned 0 [0073.869] lstrlenA (lpString="*.7z") returned 4 [0073.869] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF", pszSpec="*.tar") returned 0 [0073.870] lstrlenA (lpString="*.tar") returned 5 [0073.870] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF", pszSpec="*.gzip") returned 0 [0073.870] lstrlenA (lpString="*.gzip") returned 6 [0073.870] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF", pszSpec="*.jpg") returned 0 [0073.870] lstrlenA (lpString="*.jpg") returned 5 [0073.870] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF", pszSpec="*.jpeg") returned 0 [0073.870] lstrlenA (lpString="*.jpeg") returned 6 [0073.870] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF", pszSpec="*.psd") returned 0 [0073.870] lstrlenA (lpString="*.psd") returned 5 [0073.870] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF", pszSpec="*.cdr") returned 0 [0073.870] lstrlenA (lpString="*.cdr") returned 5 [0073.870] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF", pszSpec="*.dwg") returned 0 [0073.870] lstrlenA (lpString="*.dwg") returned 5 [0073.870] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF", pszSpec="*.max") returned 0 [0073.870] lstrlenA (lpString="*.max") returned 5 [0073.870] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF", pszSpec="*.bmp") returned 0 [0073.870] lstrlenA (lpString="*.bmp") returned 5 [0073.870] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF", pszSpec="*.gif") returned 1 [0073.870] lstrlenA (lpString="*.gif") returned 5 [0073.870] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" [0073.870] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" [0073.870] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF." [0073.870] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.BD" [0073.870] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.870] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2e2 [0073.871] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbbfdda6, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.871] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.871] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x286, lpOverlapped=0x0) returned 1 [0073.872] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF") returned="WB01746_.GIF" [0073.872] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.872] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x286, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x286, lpOverlapped=0x0) returned 1 [0073.872] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.872] CloseHandle (hObject=0x1cc) returned 1 [0073.873] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01746_.gif.bd")) returned 1 [0073.873] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbc03f8e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01747_.GIF", cAlternateFileName="")) returned 1 [0073.873] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.873] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01747_.GIF") returned -1 [0073.873] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01747_.GIF") returned -1 [0073.873] lstrcmpiA (lpString1="", lpString2="WB01747_.GIF") returned -1 [0073.873] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF") returned="WB01746_.GIF" [0073.873] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.873] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.873] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.873] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.873] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01747_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" [0073.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF", pszSpec="*.zip") returned 0 [0073.874] lstrlenA (lpString="*.zip") returned 5 [0073.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF", pszSpec="*.rar") returned 0 [0073.874] lstrlenA (lpString="*.rar") returned 5 [0073.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF", pszSpec="*.7z") returned 0 [0073.874] lstrlenA (lpString="*.7z") returned 4 [0073.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF", pszSpec="*.tar") returned 0 [0073.874] lstrlenA (lpString="*.tar") returned 5 [0073.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF", pszSpec="*.gzip") returned 0 [0073.874] lstrlenA (lpString="*.gzip") returned 6 [0073.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF", pszSpec="*.jpg") returned 0 [0073.874] lstrlenA (lpString="*.jpg") returned 5 [0073.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF", pszSpec="*.jpeg") returned 0 [0073.874] lstrlenA (lpString="*.jpeg") returned 6 [0073.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF", pszSpec="*.psd") returned 0 [0073.874] lstrlenA (lpString="*.psd") returned 5 [0073.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF", pszSpec="*.cdr") returned 0 [0073.874] lstrlenA (lpString="*.cdr") returned 5 [0073.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF", pszSpec="*.dwg") returned 0 [0073.874] lstrlenA (lpString="*.dwg") returned 5 [0073.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF", pszSpec="*.max") returned 0 [0073.874] lstrlenA (lpString="*.max") returned 5 [0073.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF", pszSpec="*.bmp") returned 0 [0073.874] lstrlenA (lpString="*.bmp") returned 5 [0073.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF", pszSpec="*.gif") returned 1 [0073.874] lstrlenA (lpString="*.gif") returned 5 [0073.874] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" [0073.874] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" [0073.874] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF." [0073.874] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.BD" [0073.874] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.875] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x387 [0073.875] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbc03f8e, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.875] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.875] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x32b, lpOverlapped=0x0) returned 1 [0073.877] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF") returned="WB01747_.GIF" [0073.877] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.877] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x32b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x32b, lpOverlapped=0x0) returned 1 [0073.877] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.877] CloseHandle (hObject=0x1cc) returned 1 [0073.877] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01747_.gif.bd")) returned 1 [0073.878] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9e27c5c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01748_.GIF", cAlternateFileName="")) returned 1 [0073.878] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.878] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01748_.GIF") returned -1 [0073.878] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01748_.GIF") returned -1 [0073.878] lstrcmpiA (lpString1="", lpString2="WB01748_.GIF") returned -1 [0073.878] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF") returned="WB01747_.GIF" [0073.878] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.878] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.878] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.878] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.879] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01748_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" [0073.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF", pszSpec="*.zip") returned 0 [0073.879] lstrlenA (lpString="*.zip") returned 5 [0073.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF", pszSpec="*.rar") returned 0 [0073.879] lstrlenA (lpString="*.rar") returned 5 [0073.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF", pszSpec="*.7z") returned 0 [0073.879] lstrlenA (lpString="*.7z") returned 4 [0073.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF", pszSpec="*.tar") returned 0 [0073.879] lstrlenA (lpString="*.tar") returned 5 [0073.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF", pszSpec="*.gzip") returned 0 [0073.879] lstrlenA (lpString="*.gzip") returned 6 [0073.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF", pszSpec="*.jpg") returned 0 [0073.879] lstrlenA (lpString="*.jpg") returned 5 [0073.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF", pszSpec="*.jpeg") returned 0 [0073.879] lstrlenA (lpString="*.jpeg") returned 6 [0073.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF", pszSpec="*.psd") returned 0 [0073.879] lstrlenA (lpString="*.psd") returned 5 [0073.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF", pszSpec="*.cdr") returned 0 [0073.879] lstrlenA (lpString="*.cdr") returned 5 [0073.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF", pszSpec="*.dwg") returned 0 [0073.879] lstrlenA (lpString="*.dwg") returned 5 [0073.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF", pszSpec="*.max") returned 0 [0073.879] lstrlenA (lpString="*.max") returned 5 [0073.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF", pszSpec="*.bmp") returned 0 [0073.879] lstrlenA (lpString="*.bmp") returned 5 [0073.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF", pszSpec="*.gif") returned 1 [0073.879] lstrlenA (lpString="*.gif") returned 5 [0073.879] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" [0073.879] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" [0073.879] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF." [0073.879] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.BD" [0073.879] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.880] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d7 [0073.880] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9e27c5c, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.880] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.880] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x27b, lpOverlapped=0x0) returned 1 [0073.886] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF") returned="WB01748_.GIF" [0073.886] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.886] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x27b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x27b, lpOverlapped=0x0) returned 1 [0073.886] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.886] CloseHandle (hObject=0x1cc) returned 1 [0073.886] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01748_.gif.bd")) returned 1 [0073.887] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbc08de7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01749_.GIF", cAlternateFileName="")) returned 1 [0073.887] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.887] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01749_.GIF") returned -1 [0073.887] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01749_.GIF") returned -1 [0073.887] lstrcmpiA (lpString1="", lpString2="WB01749_.GIF") returned -1 [0073.887] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF") returned="WB01748_.GIF" [0073.887] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.887] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.887] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.887] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.887] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01749_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" [0073.887] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF", pszSpec="*.zip") returned 0 [0073.887] lstrlenA (lpString="*.zip") returned 5 [0073.887] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF", pszSpec="*.rar") returned 0 [0073.887] lstrlenA (lpString="*.rar") returned 5 [0073.888] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF", pszSpec="*.7z") returned 0 [0073.888] lstrlenA (lpString="*.7z") returned 4 [0073.888] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF", pszSpec="*.tar") returned 0 [0073.888] lstrlenA (lpString="*.tar") returned 5 [0073.888] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF", pszSpec="*.gzip") returned 0 [0073.888] lstrlenA (lpString="*.gzip") returned 6 [0073.888] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF", pszSpec="*.jpg") returned 0 [0073.888] lstrlenA (lpString="*.jpg") returned 5 [0073.888] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF", pszSpec="*.jpeg") returned 0 [0073.888] lstrlenA (lpString="*.jpeg") returned 6 [0073.888] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF", pszSpec="*.psd") returned 0 [0073.888] lstrlenA (lpString="*.psd") returned 5 [0073.888] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF", pszSpec="*.cdr") returned 0 [0073.888] lstrlenA (lpString="*.cdr") returned 5 [0073.888] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF", pszSpec="*.dwg") returned 0 [0073.888] lstrlenA (lpString="*.dwg") returned 5 [0073.888] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF", pszSpec="*.max") returned 0 [0073.888] lstrlenA (lpString="*.max") returned 5 [0073.888] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF", pszSpec="*.bmp") returned 0 [0073.888] lstrlenA (lpString="*.bmp") returned 5 [0073.888] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF", pszSpec="*.gif") returned 1 [0073.888] lstrlenA (lpString="*.gif") returned 5 [0073.888] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" [0073.888] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" [0073.888] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF." [0073.888] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.BD" [0073.888] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.889] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b4 [0073.889] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbc08de7, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.889] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.889] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x358, lpOverlapped=0x0) returned 1 [0073.890] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF") returned="WB01749_.GIF" [0073.890] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.890] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x358, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x358, lpOverlapped=0x0) returned 1 [0073.890] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.891] CloseHandle (hObject=0x1cc) returned 1 [0073.891] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01749_.gif.bd")) returned 1 [0073.891] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbc0c7f8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01750_.GIF", cAlternateFileName="")) returned 1 [0073.891] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.891] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01750_.GIF") returned -1 [0073.891] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01750_.GIF") returned -1 [0073.891] lstrcmpiA (lpString1="", lpString2="WB01750_.GIF") returned -1 [0073.891] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF") returned="WB01749_.GIF" [0073.891] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.891] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.891] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.891] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.892] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01750_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" [0073.892] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF", pszSpec="*.zip") returned 0 [0073.892] lstrlenA (lpString="*.zip") returned 5 [0073.892] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF", pszSpec="*.rar") returned 0 [0073.892] lstrlenA (lpString="*.rar") returned 5 [0073.892] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF", pszSpec="*.7z") returned 0 [0073.892] lstrlenA (lpString="*.7z") returned 4 [0073.892] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF", pszSpec="*.tar") returned 0 [0073.892] lstrlenA (lpString="*.tar") returned 5 [0073.892] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF", pszSpec="*.gzip") returned 0 [0073.892] lstrlenA (lpString="*.gzip") returned 6 [0073.892] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF", pszSpec="*.jpg") returned 0 [0073.892] lstrlenA (lpString="*.jpg") returned 5 [0073.892] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF", pszSpec="*.jpeg") returned 0 [0073.892] lstrlenA (lpString="*.jpeg") returned 6 [0073.892] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF", pszSpec="*.psd") returned 0 [0073.892] lstrlenA (lpString="*.psd") returned 5 [0073.892] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF", pszSpec="*.cdr") returned 0 [0073.892] lstrlenA (lpString="*.cdr") returned 5 [0073.892] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF", pszSpec="*.dwg") returned 0 [0073.892] lstrlenA (lpString="*.dwg") returned 5 [0073.892] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF", pszSpec="*.max") returned 0 [0073.892] lstrlenA (lpString="*.max") returned 5 [0073.892] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF", pszSpec="*.bmp") returned 0 [0073.892] lstrlenA (lpString="*.bmp") returned 5 [0073.892] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF", pszSpec="*.gif") returned 1 [0073.892] lstrlenA (lpString="*.gif") returned 5 [0073.892] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" [0073.892] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" [0073.892] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF." [0073.892] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.BD" [0073.892] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.893] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x494 [0073.893] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbc0c7f8, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.893] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.893] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x438, lpOverlapped=0x0) returned 1 [0073.895] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF") returned="WB01750_.GIF" [0073.895] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.896] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x438, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x438, lpOverlapped=0x0) returned 1 [0073.896] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.896] CloseHandle (hObject=0x1cc) returned 1 [0073.896] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01750_.gif.bd")) returned 1 [0073.896] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9e2dd7e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01751_.GIF", cAlternateFileName="")) returned 1 [0073.896] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.896] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01751_.GIF") returned -1 [0073.896] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01751_.GIF") returned -1 [0073.896] lstrcmpiA (lpString1="", lpString2="WB01751_.GIF") returned -1 [0073.897] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF") returned="WB01750_.GIF" [0073.897] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.897] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.897] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.897] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.897] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01751_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" [0073.897] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF", pszSpec="*.zip") returned 0 [0073.897] lstrlenA (lpString="*.zip") returned 5 [0073.897] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF", pszSpec="*.rar") returned 0 [0073.897] lstrlenA (lpString="*.rar") returned 5 [0073.897] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF", pszSpec="*.7z") returned 0 [0073.897] lstrlenA (lpString="*.7z") returned 4 [0073.897] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF", pszSpec="*.tar") returned 0 [0073.897] lstrlenA (lpString="*.tar") returned 5 [0073.897] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF", pszSpec="*.gzip") returned 0 [0073.897] lstrlenA (lpString="*.gzip") returned 6 [0073.897] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF", pszSpec="*.jpg") returned 0 [0073.897] lstrlenA (lpString="*.jpg") returned 5 [0073.897] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF", pszSpec="*.jpeg") returned 0 [0073.897] lstrlenA (lpString="*.jpeg") returned 6 [0073.897] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF", pszSpec="*.psd") returned 0 [0073.897] lstrlenA (lpString="*.psd") returned 5 [0073.897] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF", pszSpec="*.cdr") returned 0 [0073.897] lstrlenA (lpString="*.cdr") returned 5 [0073.897] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF", pszSpec="*.dwg") returned 0 [0073.897] lstrlenA (lpString="*.dwg") returned 5 [0073.897] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF", pszSpec="*.max") returned 0 [0073.897] lstrlenA (lpString="*.max") returned 5 [0073.897] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF", pszSpec="*.bmp") returned 0 [0073.898] lstrlenA (lpString="*.bmp") returned 5 [0073.898] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF", pszSpec="*.gif") returned 1 [0073.898] lstrlenA (lpString="*.gif") returned 5 [0073.898] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" [0073.898] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" [0073.898] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF." [0073.898] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.BD" [0073.898] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.899] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b9 [0073.899] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9e2dd7e, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.899] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.899] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x35d, lpOverlapped=0x0) returned 1 [0073.900] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF") returned="WB01751_.GIF" [0073.900] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.900] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x35d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x35d, lpOverlapped=0x0) returned 1 [0073.900] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.901] CloseHandle (hObject=0x1cc) returned 1 [0073.901] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01751_.gif.bd")) returned 1 [0073.901] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9e32bce, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x304, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01770_.GIF", cAlternateFileName="")) returned 1 [0073.901] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.901] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01770_.GIF") returned -1 [0073.901] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01770_.GIF") returned -1 [0073.901] lstrcmpiA (lpString1="", lpString2="WB01770_.GIF") returned -1 [0073.901] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF") returned="WB01751_.GIF" [0073.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.901] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.901] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.901] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.902] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01770_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" [0073.902] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF", pszSpec="*.zip") returned 0 [0073.902] lstrlenA (lpString="*.zip") returned 5 [0073.902] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF", pszSpec="*.rar") returned 0 [0073.902] lstrlenA (lpString="*.rar") returned 5 [0073.902] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF", pszSpec="*.7z") returned 0 [0073.902] lstrlenA (lpString="*.7z") returned 4 [0073.902] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF", pszSpec="*.tar") returned 0 [0073.902] lstrlenA (lpString="*.tar") returned 5 [0073.902] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF", pszSpec="*.gzip") returned 0 [0073.902] lstrlenA (lpString="*.gzip") returned 6 [0073.902] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF", pszSpec="*.jpg") returned 0 [0073.902] lstrlenA (lpString="*.jpg") returned 5 [0073.902] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF", pszSpec="*.jpeg") returned 0 [0073.902] lstrlenA (lpString="*.jpeg") returned 6 [0073.902] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF", pszSpec="*.psd") returned 0 [0073.902] lstrlenA (lpString="*.psd") returned 5 [0073.902] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF", pszSpec="*.cdr") returned 0 [0073.902] lstrlenA (lpString="*.cdr") returned 5 [0073.902] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF", pszSpec="*.dwg") returned 0 [0073.902] lstrlenA (lpString="*.dwg") returned 5 [0073.902] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF", pszSpec="*.max") returned 0 [0073.902] lstrlenA (lpString="*.max") returned 5 [0073.902] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF", pszSpec="*.bmp") returned 0 [0073.902] lstrlenA (lpString="*.bmp") returned 5 [0073.902] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF", pszSpec="*.gif") returned 1 [0073.902] lstrlenA (lpString="*.gif") returned 5 [0073.902] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" [0073.902] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" [0073.902] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF." [0073.903] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.BD" [0073.903] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.903] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x304 [0073.903] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9e32bce, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.903] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.903] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x2a8, lpOverlapped=0x0) returned 1 [0073.905] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF") returned="WB01770_.GIF" [0073.905] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.905] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x2a8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x2a8, lpOverlapped=0x0) returned 1 [0073.905] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.905] CloseHandle (hObject=0x1cc) returned 1 [0073.905] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01770_.gif.bd")) returned 1 [0073.906] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbc11816, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01838_.GIF", cAlternateFileName="")) returned 1 [0073.906] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.906] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01838_.GIF") returned -1 [0073.906] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01838_.GIF") returned -1 [0073.906] lstrcmpiA (lpString1="", lpString2="WB01838_.GIF") returned -1 [0073.906] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF") returned="WB01770_.GIF" [0073.906] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.906] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.906] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.906] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.906] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01838_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" [0073.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF", pszSpec="*.zip") returned 0 [0073.906] lstrlenA (lpString="*.zip") returned 5 [0073.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF", pszSpec="*.rar") returned 0 [0073.906] lstrlenA (lpString="*.rar") returned 5 [0073.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF", pszSpec="*.7z") returned 0 [0073.906] lstrlenA (lpString="*.7z") returned 4 [0073.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF", pszSpec="*.tar") returned 0 [0073.906] lstrlenA (lpString="*.tar") returned 5 [0073.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF", pszSpec="*.gzip") returned 0 [0073.906] lstrlenA (lpString="*.gzip") returned 6 [0073.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF", pszSpec="*.jpg") returned 0 [0073.906] lstrlenA (lpString="*.jpg") returned 5 [0073.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF", pszSpec="*.jpeg") returned 0 [0073.906] lstrlenA (lpString="*.jpeg") returned 6 [0073.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF", pszSpec="*.psd") returned 0 [0073.907] lstrlenA (lpString="*.psd") returned 5 [0073.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF", pszSpec="*.cdr") returned 0 [0073.907] lstrlenA (lpString="*.cdr") returned 5 [0073.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF", pszSpec="*.dwg") returned 0 [0073.907] lstrlenA (lpString="*.dwg") returned 5 [0073.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF", pszSpec="*.max") returned 0 [0073.907] lstrlenA (lpString="*.max") returned 5 [0073.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF", pszSpec="*.bmp") returned 0 [0073.907] lstrlenA (lpString="*.bmp") returned 5 [0073.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF", pszSpec="*.gif") returned 1 [0073.907] lstrlenA (lpString="*.gif") returned 5 [0073.907] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" [0073.907] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" [0073.907] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF." [0073.907] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.BD" [0073.907] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.907] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe44 [0073.907] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbc11816, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.907] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.907] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xde8, lpOverlapped=0x0) returned 1 [0073.909] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF") returned="WB01838_.GIF" [0073.909] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.909] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xde8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xde8, lpOverlapped=0x0) returned 1 [0073.910] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.910] CloseHandle (hObject=0x1cc) returned 1 [0073.910] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01838_.gif.bd")) returned 1 [0073.910] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbc177b0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01839_.GIF", cAlternateFileName="")) returned 1 [0073.910] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.910] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01839_.GIF") returned -1 [0073.910] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01839_.GIF") returned -1 [0073.910] lstrcmpiA (lpString1="", lpString2="WB01839_.GIF") returned -1 [0073.910] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF") returned="WB01838_.GIF" [0073.910] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.910] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.910] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.910] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.911] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01839_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" [0073.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF", pszSpec="*.zip") returned 0 [0073.911] lstrlenA (lpString="*.zip") returned 5 [0073.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF", pszSpec="*.rar") returned 0 [0073.911] lstrlenA (lpString="*.rar") returned 5 [0073.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF", pszSpec="*.7z") returned 0 [0073.911] lstrlenA (lpString="*.7z") returned 4 [0073.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF", pszSpec="*.tar") returned 0 [0073.911] lstrlenA (lpString="*.tar") returned 5 [0073.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF", pszSpec="*.gzip") returned 0 [0073.911] lstrlenA (lpString="*.gzip") returned 6 [0073.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF", pszSpec="*.jpg") returned 0 [0073.911] lstrlenA (lpString="*.jpg") returned 5 [0073.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF", pszSpec="*.jpeg") returned 0 [0073.911] lstrlenA (lpString="*.jpeg") returned 6 [0073.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF", pszSpec="*.psd") returned 0 [0073.911] lstrlenA (lpString="*.psd") returned 5 [0073.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF", pszSpec="*.cdr") returned 0 [0073.911] lstrlenA (lpString="*.cdr") returned 5 [0073.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF", pszSpec="*.dwg") returned 0 [0073.911] lstrlenA (lpString="*.dwg") returned 5 [0073.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF", pszSpec="*.max") returned 0 [0073.911] lstrlenA (lpString="*.max") returned 5 [0073.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF", pszSpec="*.bmp") returned 0 [0073.911] lstrlenA (lpString="*.bmp") returned 5 [0073.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF", pszSpec="*.gif") returned 1 [0073.911] lstrlenA (lpString="*.gif") returned 5 [0073.911] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" [0073.911] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" [0073.911] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF." [0073.911] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.BD" [0073.911] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.917] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x446 [0073.917] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbc177b0, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.917] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.917] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x3ea, lpOverlapped=0x0) returned 1 [0073.918] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF") returned="WB01839_.GIF" [0073.919] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.919] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x3ea, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x3ea, lpOverlapped=0x0) returned 1 [0073.919] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.919] CloseHandle (hObject=0x1cc) returned 1 [0073.919] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01839_.gif.bd")) returned 1 [0073.919] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbc1b31a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01840_.GIF", cAlternateFileName="")) returned 1 [0073.920] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.920] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01840_.GIF") returned -1 [0073.920] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01840_.GIF") returned -1 [0073.920] lstrcmpiA (lpString1="", lpString2="WB01840_.GIF") returned -1 [0073.920] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF") returned="WB01839_.GIF" [0073.920] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.920] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.920] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.920] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.920] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01840_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" [0073.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF", pszSpec="*.zip") returned 0 [0073.920] lstrlenA (lpString="*.zip") returned 5 [0073.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF", pszSpec="*.rar") returned 0 [0073.920] lstrlenA (lpString="*.rar") returned 5 [0073.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF", pszSpec="*.7z") returned 0 [0073.920] lstrlenA (lpString="*.7z") returned 4 [0073.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF", pszSpec="*.tar") returned 0 [0073.920] lstrlenA (lpString="*.tar") returned 5 [0073.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF", pszSpec="*.gzip") returned 0 [0073.920] lstrlenA (lpString="*.gzip") returned 6 [0073.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF", pszSpec="*.jpg") returned 0 [0073.920] lstrlenA (lpString="*.jpg") returned 5 [0073.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF", pszSpec="*.jpeg") returned 0 [0073.920] lstrlenA (lpString="*.jpeg") returned 6 [0073.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF", pszSpec="*.psd") returned 0 [0073.920] lstrlenA (lpString="*.psd") returned 5 [0073.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF", pszSpec="*.cdr") returned 0 [0073.920] lstrlenA (lpString="*.cdr") returned 5 [0073.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF", pszSpec="*.dwg") returned 0 [0073.921] lstrlenA (lpString="*.dwg") returned 5 [0073.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF", pszSpec="*.max") returned 0 [0073.921] lstrlenA (lpString="*.max") returned 5 [0073.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF", pszSpec="*.bmp") returned 0 [0073.921] lstrlenA (lpString="*.bmp") returned 5 [0073.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF", pszSpec="*.gif") returned 1 [0073.921] lstrlenA (lpString="*.gif") returned 5 [0073.921] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" [0073.921] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" [0073.921] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF." [0073.921] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.BD" [0073.921] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.921] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5fe [0073.921] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbc1b31a, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.921] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.921] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x5a2, lpOverlapped=0x0) returned 1 [0073.923] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF") returned="WB01840_.GIF" [0073.923] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.923] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x5a2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x5a2, lpOverlapped=0x0) returned 1 [0073.923] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.923] CloseHandle (hObject=0x1cc) returned 1 [0073.923] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01840_.gif.bd")) returned 1 [0073.924] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9e37a09, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x76c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01842_.GIF", cAlternateFileName="")) returned 1 [0073.924] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.924] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01842_.GIF") returned -1 [0073.924] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01842_.GIF") returned -1 [0073.924] lstrcmpiA (lpString1="", lpString2="WB01842_.GIF") returned -1 [0073.924] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF") returned="WB01840_.GIF" [0073.924] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.924] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.924] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.924] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.924] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01842_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" [0073.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF", pszSpec="*.zip") returned 0 [0073.924] lstrlenA (lpString="*.zip") returned 5 [0073.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF", pszSpec="*.rar") returned 0 [0073.924] lstrlenA (lpString="*.rar") returned 5 [0073.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF", pszSpec="*.7z") returned 0 [0073.924] lstrlenA (lpString="*.7z") returned 4 [0073.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF", pszSpec="*.tar") returned 0 [0073.924] lstrlenA (lpString="*.tar") returned 5 [0073.925] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF", pszSpec="*.gzip") returned 0 [0073.925] lstrlenA (lpString="*.gzip") returned 6 [0073.925] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF", pszSpec="*.jpg") returned 0 [0073.925] lstrlenA (lpString="*.jpg") returned 5 [0073.925] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF", pszSpec="*.jpeg") returned 0 [0073.925] lstrlenA (lpString="*.jpeg") returned 6 [0073.925] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF", pszSpec="*.psd") returned 0 [0073.925] lstrlenA (lpString="*.psd") returned 5 [0073.925] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF", pszSpec="*.cdr") returned 0 [0073.925] lstrlenA (lpString="*.cdr") returned 5 [0073.925] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF", pszSpec="*.dwg") returned 0 [0073.925] lstrlenA (lpString="*.dwg") returned 5 [0073.925] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF", pszSpec="*.max") returned 0 [0073.925] lstrlenA (lpString="*.max") returned 5 [0073.925] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF", pszSpec="*.bmp") returned 0 [0073.925] lstrlenA (lpString="*.bmp") returned 5 [0073.925] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF", pszSpec="*.gif") returned 1 [0073.925] lstrlenA (lpString="*.gif") returned 5 [0073.925] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" [0073.925] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" [0073.925] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF." [0073.925] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.BD" [0073.925] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.926] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x76c [0073.926] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9e37a09, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.926] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.926] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x710, lpOverlapped=0x0) returned 1 [0073.927] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF") returned="WB01842_.GIF" [0073.928] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.928] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x710, lpOverlapped=0x0) returned 1 [0073.928] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.928] CloseHandle (hObject=0x1cc) returned 1 [0073.928] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01842_.gif.bd")) returned 1 [0073.929] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9e3b4d9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x12d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01843_.GIF", cAlternateFileName="")) returned 1 [0073.929] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.929] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01843_.GIF") returned -1 [0073.929] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01843_.GIF") returned -1 [0073.929] lstrcmpiA (lpString1="", lpString2="WB01843_.GIF") returned -1 [0073.929] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF") returned="WB01842_.GIF" [0073.929] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.929] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.929] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.929] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.929] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB01843_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" [0073.929] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF", pszSpec="*.zip") returned 0 [0073.929] lstrlenA (lpString="*.zip") returned 5 [0073.929] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF", pszSpec="*.rar") returned 0 [0073.929] lstrlenA (lpString="*.rar") returned 5 [0073.929] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF", pszSpec="*.7z") returned 0 [0073.929] lstrlenA (lpString="*.7z") returned 4 [0073.929] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF", pszSpec="*.tar") returned 0 [0073.929] lstrlenA (lpString="*.tar") returned 5 [0073.929] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF", pszSpec="*.gzip") returned 0 [0073.929] lstrlenA (lpString="*.gzip") returned 6 [0073.929] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF", pszSpec="*.jpg") returned 0 [0073.929] lstrlenA (lpString="*.jpg") returned 5 [0073.930] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF", pszSpec="*.jpeg") returned 0 [0073.930] lstrlenA (lpString="*.jpeg") returned 6 [0073.930] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF", pszSpec="*.psd") returned 0 [0073.930] lstrlenA (lpString="*.psd") returned 5 [0073.930] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF", pszSpec="*.cdr") returned 0 [0073.930] lstrlenA (lpString="*.cdr") returned 5 [0073.930] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF", pszSpec="*.dwg") returned 0 [0073.930] lstrlenA (lpString="*.dwg") returned 5 [0073.930] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF", pszSpec="*.max") returned 0 [0073.930] lstrlenA (lpString="*.max") returned 5 [0073.930] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF", pszSpec="*.bmp") returned 0 [0073.930] lstrlenA (lpString="*.bmp") returned 5 [0073.930] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF", pszSpec="*.gif") returned 1 [0073.930] lstrlenA (lpString="*.gif") returned 5 [0073.930] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" [0073.930] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" [0073.930] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF." [0073.930] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.BD" [0073.930] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.931] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12d1 [0073.931] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9e3b4d9, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.931] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.931] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1275, lpOverlapped=0x0) returned 1 [0073.932] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF") returned="WB01843_.GIF" [0073.932] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.932] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1275, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1275, lpOverlapped=0x0) returned 1 [0073.933] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.933] CloseHandle (hObject=0x1cc) returned 1 [0073.933] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb01843_.gif.bd")) returned 1 [0073.933] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9e6c18d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x102b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02229_.GIF", cAlternateFileName="")) returned 1 [0073.933] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.933] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB02229_.GIF") returned -1 [0073.933] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02229_.GIF") returned -1 [0073.933] lstrcmpiA (lpString1="", lpString2="WB02229_.GIF") returned -1 [0073.933] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF") returned="WB01843_.GIF" [0073.933] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.933] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.934] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.934] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.934] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WB02229_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" [0073.934] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF", pszSpec="*.zip") returned 0 [0073.934] lstrlenA (lpString="*.zip") returned 5 [0073.934] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF", pszSpec="*.rar") returned 0 [0073.934] lstrlenA (lpString="*.rar") returned 5 [0073.934] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF", pszSpec="*.7z") returned 0 [0073.934] lstrlenA (lpString="*.7z") returned 4 [0073.934] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF", pszSpec="*.tar") returned 0 [0073.934] lstrlenA (lpString="*.tar") returned 5 [0073.934] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF", pszSpec="*.gzip") returned 0 [0073.934] lstrlenA (lpString="*.gzip") returned 6 [0073.934] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF", pszSpec="*.jpg") returned 0 [0073.934] lstrlenA (lpString="*.jpg") returned 5 [0073.934] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF", pszSpec="*.jpeg") returned 0 [0073.934] lstrlenA (lpString="*.jpeg") returned 6 [0073.934] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF", pszSpec="*.psd") returned 0 [0073.934] lstrlenA (lpString="*.psd") returned 5 [0073.934] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF", pszSpec="*.cdr") returned 0 [0073.934] lstrlenA (lpString="*.cdr") returned 5 [0073.934] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF", pszSpec="*.dwg") returned 0 [0073.934] lstrlenA (lpString="*.dwg") returned 5 [0073.934] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF", pszSpec="*.max") returned 0 [0073.934] lstrlenA (lpString="*.max") returned 5 [0073.934] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF", pszSpec="*.bmp") returned 0 [0073.934] lstrlenA (lpString="*.bmp") returned 5 [0073.934] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF", pszSpec="*.gif") returned 1 [0073.934] lstrlenA (lpString="*.gif") returned 5 [0073.934] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" [0073.934] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" [0073.935] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF." [0073.935] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.BD" [0073.935] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb02229_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.935] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x102b [0073.935] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9e6c18d, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.935] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.936] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xfcf, lpOverlapped=0x0) returned 1 [0073.937] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF") returned="WB02229_.GIF" [0073.937] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.937] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xfcf, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xfcf, lpOverlapped=0x0) returned 1 [0073.938] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.938] CloseHandle (hObject=0x1cc) returned 1 [0073.938] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb02229_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\wb02229_.gif.bd")) returned 1 [0073.938] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4f3e00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbe2781e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8d4f3e00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHIRL1.WMF", cAlternateFileName="")) returned 1 [0073.938] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.938] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WHIRL1.WMF") returned -1 [0073.938] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WHIRL1.WMF") returned -1 [0073.938] lstrcmpiA (lpString1="", lpString2="WHIRL1.WMF") returned -1 [0073.938] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF") returned="WB02229_.GIF" [0073.938] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.938] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.939] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.939] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.939] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WHIRL1.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" [0073.939] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.zip") returned 0 [0073.939] lstrlenA (lpString="*.zip") returned 5 [0073.939] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.rar") returned 0 [0073.939] lstrlenA (lpString="*.rar") returned 5 [0073.939] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.7z") returned 0 [0073.939] lstrlenA (lpString="*.7z") returned 4 [0073.939] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.tar") returned 0 [0073.939] lstrlenA (lpString="*.tar") returned 5 [0073.939] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.gzip") returned 0 [0073.939] lstrlenA (lpString="*.gzip") returned 6 [0073.939] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.jpg") returned 0 [0073.939] lstrlenA (lpString="*.jpg") returned 5 [0073.939] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.jpeg") returned 0 [0073.939] lstrlenA (lpString="*.jpeg") returned 6 [0073.939] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.psd") returned 0 [0073.939] lstrlenA (lpString="*.psd") returned 5 [0073.939] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.cdr") returned 0 [0073.939] lstrlenA (lpString="*.cdr") returned 5 [0073.939] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.dwg") returned 0 [0073.939] lstrlenA (lpString="*.dwg") returned 5 [0073.939] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.max") returned 0 [0073.939] lstrlenA (lpString="*.max") returned 5 [0073.939] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.bmp") returned 0 [0073.939] lstrlenA (lpString="*.bmp") returned 5 [0073.939] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.gif") returned 0 [0073.939] lstrlenA (lpString="*.gif") returned 5 [0073.939] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.png") returned 0 [0073.939] lstrlenA (lpString="*.png") returned 5 [0073.940] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.doc") returned 0 [0073.940] lstrlenA (lpString="*.doc") returned 5 [0073.940] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.docx") returned 0 [0073.940] lstrlenA (lpString="*.docx") returned 6 [0073.940] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.xls") returned 0 [0073.940] lstrlenA (lpString="*.xls") returned 5 [0073.940] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.xlsx") returned 0 [0073.940] lstrlenA (lpString="*.xlsx") returned 6 [0073.940] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.ppt") returned 0 [0073.940] lstrlenA (lpString="*.ppt") returned 5 [0073.940] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.pptx") returned 0 [0073.940] lstrlenA (lpString="*.pptx") returned 6 [0073.940] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.txt") returned 0 [0073.940] lstrlenA (lpString="*.txt") returned 5 [0073.940] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.pdf") returned 0 [0073.940] lstrlenA (lpString="*.pdf") returned 5 [0073.940] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.djvu") returned 0 [0073.940] lstrlenA (lpString="*.djvu") returned 6 [0073.940] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.htm") returned 0 [0073.940] lstrlenA (lpString="*.htm") returned 5 [0073.940] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.html") returned 0 [0073.940] lstrlenA (lpString="*.html") returned 6 [0073.940] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.mdb") returned 0 [0073.940] lstrlenA (lpString="*.mdb") returned 5 [0073.940] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.cer") returned 0 [0073.940] lstrlenA (lpString="*.cer") returned 5 [0073.940] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.p12") returned 0 [0073.942] lstrlenA (lpString="*.p12") returned 5 [0073.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.pfx") returned 0 [0073.942] lstrlenA (lpString="*.pfx") returned 5 [0073.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.kwm") returned 0 [0073.942] lstrlenA (lpString="*.kwm") returned 5 [0073.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.pwm") returned 0 [0073.942] lstrlenA (lpString="*.pwm") returned 5 [0073.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.1cd") returned 0 [0073.942] lstrlenA (lpString="*.1cd") returned 5 [0073.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.md") returned 0 [0073.942] lstrlenA (lpString="*.md") returned 4 [0073.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.mdf") returned 0 [0073.942] lstrlenA (lpString="*.mdf") returned 5 [0073.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.dbf") returned 0 [0073.942] lstrlenA (lpString="*.dbf") returned 5 [0073.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.odt") returned 0 [0073.942] lstrlenA (lpString="*.odt") returned 5 [0073.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.vob") returned 0 [0073.942] lstrlenA (lpString="*.vob") returned 5 [0073.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.ifo") returned 0 [0073.943] lstrlenA (lpString="*.ifo") returned 5 [0073.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.lnk") returned 0 [0073.943] lstrlenA (lpString="*.lnk") returned 5 [0073.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.torrent") returned 0 [0073.943] lstrlenA (lpString="*.torrent") returned 9 [0073.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.mov") returned 0 [0073.943] lstrlenA (lpString="*.mov") returned 5 [0073.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.m2v") returned 0 [0073.943] lstrlenA (lpString="*.m2v") returned 5 [0073.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.3gp") returned 0 [0073.943] lstrlenA (lpString="*.3gp") returned 5 [0073.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.mpeg") returned 0 [0073.943] lstrlenA (lpString="*.mpeg") returned 6 [0073.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.mpg") returned 0 [0073.943] lstrlenA (lpString="*.mpg") returned 5 [0073.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.flv") returned 0 [0073.943] lstrlenA (lpString="*.flv") returned 5 [0073.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.avi") returned 0 [0073.943] lstrlenA (lpString="*.avi") returned 5 [0073.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.mp4") returned 0 [0073.943] lstrlenA (lpString="*.mp4") returned 5 [0073.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.wmv") returned 0 [0073.943] lstrlenA (lpString="*.wmv") returned 5 [0073.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.divx") returned 0 [0073.943] lstrlenA (lpString="*.divx") returned 6 [0073.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.mkv") returned 0 [0073.943] lstrlenA (lpString="*.mkv") returned 5 [0073.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.mp3") returned 0 [0073.943] lstrlenA (lpString="*.mp3") returned 5 [0073.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.wav") returned 0 [0073.943] lstrlenA (lpString="*.wav") returned 5 [0073.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.flac") returned 0 [0073.943] lstrlenA (lpString="*.flac") returned 6 [0073.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.ape") returned 0 [0073.943] lstrlenA (lpString="*.ape") returned 5 [0073.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.wma") returned 0 [0073.944] lstrlenA (lpString="*.wma") returned 5 [0073.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.ac3") returned 0 [0073.944] lstrlenA (lpString="*.ac3") returned 5 [0073.944] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4f3e00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9ea1c57, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8d4f3e00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHIRL2.WMF", cAlternateFileName="")) returned 1 [0073.944] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.944] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WHIRL2.WMF") returned -1 [0073.944] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WHIRL2.WMF") returned -1 [0073.944] lstrcmpiA (lpString1="", lpString2="WHIRL2.WMF") returned -1 [0073.944] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF") returned="WHIRL1.WMF" [0073.944] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.944] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.944] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.944] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.944] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WHIRL2.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" [0073.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.zip") returned 0 [0073.944] lstrlenA (lpString="*.zip") returned 5 [0073.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.rar") returned 0 [0073.944] lstrlenA (lpString="*.rar") returned 5 [0073.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.7z") returned 0 [0073.944] lstrlenA (lpString="*.7z") returned 4 [0073.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.tar") returned 0 [0073.944] lstrlenA (lpString="*.tar") returned 5 [0073.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.gzip") returned 0 [0073.944] lstrlenA (lpString="*.gzip") returned 6 [0073.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.jpg") returned 0 [0073.944] lstrlenA (lpString="*.jpg") returned 5 [0073.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.jpeg") returned 0 [0073.944] lstrlenA (lpString="*.jpeg") returned 6 [0073.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.psd") returned 0 [0073.944] lstrlenA (lpString="*.psd") returned 5 [0073.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.cdr") returned 0 [0073.944] lstrlenA (lpString="*.cdr") returned 5 [0073.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.dwg") returned 0 [0073.945] lstrlenA (lpString="*.dwg") returned 5 [0073.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.max") returned 0 [0073.945] lstrlenA (lpString="*.max") returned 5 [0073.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.bmp") returned 0 [0073.945] lstrlenA (lpString="*.bmp") returned 5 [0073.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.gif") returned 0 [0073.945] lstrlenA (lpString="*.gif") returned 5 [0073.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.png") returned 0 [0073.945] lstrlenA (lpString="*.png") returned 5 [0073.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.doc") returned 0 [0073.945] lstrlenA (lpString="*.doc") returned 5 [0073.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.docx") returned 0 [0073.945] lstrlenA (lpString="*.docx") returned 6 [0073.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.xls") returned 0 [0073.945] lstrlenA (lpString="*.xls") returned 5 [0073.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.xlsx") returned 0 [0073.945] lstrlenA (lpString="*.xlsx") returned 6 [0073.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.ppt") returned 0 [0073.945] lstrlenA (lpString="*.ppt") returned 5 [0073.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.pptx") returned 0 [0073.945] lstrlenA (lpString="*.pptx") returned 6 [0073.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.txt") returned 0 [0073.945] lstrlenA (lpString="*.txt") returned 5 [0073.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.pdf") returned 0 [0073.945] lstrlenA (lpString="*.pdf") returned 5 [0073.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.djvu") returned 0 [0073.945] lstrlenA (lpString="*.djvu") returned 6 [0073.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.htm") returned 0 [0073.945] lstrlenA (lpString="*.htm") returned 5 [0073.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.html") returned 0 [0073.945] lstrlenA (lpString="*.html") returned 6 [0073.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.mdb") returned 0 [0073.945] lstrlenA (lpString="*.mdb") returned 5 [0073.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.cer") returned 0 [0073.946] lstrlenA (lpString="*.cer") returned 5 [0073.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.p12") returned 0 [0073.946] lstrlenA (lpString="*.p12") returned 5 [0073.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.pfx") returned 0 [0073.946] lstrlenA (lpString="*.pfx") returned 5 [0073.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.kwm") returned 0 [0073.946] lstrlenA (lpString="*.kwm") returned 5 [0073.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.pwm") returned 0 [0073.946] lstrlenA (lpString="*.pwm") returned 5 [0073.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.1cd") returned 0 [0073.946] lstrlenA (lpString="*.1cd") returned 5 [0073.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.md") returned 0 [0073.946] lstrlenA (lpString="*.md") returned 4 [0073.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.mdf") returned 0 [0073.946] lstrlenA (lpString="*.mdf") returned 5 [0073.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.dbf") returned 0 [0073.946] lstrlenA (lpString="*.dbf") returned 5 [0073.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.odt") returned 0 [0073.946] lstrlenA (lpString="*.odt") returned 5 [0073.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.vob") returned 0 [0073.946] lstrlenA (lpString="*.vob") returned 5 [0073.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.ifo") returned 0 [0073.946] lstrlenA (lpString="*.ifo") returned 5 [0073.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.lnk") returned 0 [0073.946] lstrlenA (lpString="*.lnk") returned 5 [0073.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.torrent") returned 0 [0073.946] lstrlenA (lpString="*.torrent") returned 9 [0073.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.mov") returned 0 [0073.946] lstrlenA (lpString="*.mov") returned 5 [0073.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.m2v") returned 0 [0073.946] lstrlenA (lpString="*.m2v") returned 5 [0073.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.3gp") returned 0 [0073.946] lstrlenA (lpString="*.3gp") returned 5 [0073.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.mpeg") returned 0 [0073.946] lstrlenA (lpString="*.mpeg") returned 6 [0073.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.mpg") returned 0 [0073.947] lstrlenA (lpString="*.mpg") returned 5 [0073.947] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.flv") returned 0 [0073.947] lstrlenA (lpString="*.flv") returned 5 [0073.947] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.avi") returned 0 [0073.947] lstrlenA (lpString="*.avi") returned 5 [0073.947] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.mp4") returned 0 [0073.947] lstrlenA (lpString="*.mp4") returned 5 [0073.947] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.wmv") returned 0 [0073.947] lstrlenA (lpString="*.wmv") returned 5 [0073.947] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.divx") returned 0 [0073.947] lstrlenA (lpString="*.divx") returned 6 [0073.947] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.mkv") returned 0 [0073.947] lstrlenA (lpString="*.mkv") returned 5 [0073.947] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.mp3") returned 0 [0073.947] lstrlenA (lpString="*.mp3") returned 5 [0073.947] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.wav") returned 0 [0073.947] lstrlenA (lpString="*.wav") returned 5 [0073.947] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.flac") returned 0 [0073.947] lstrlenA (lpString="*.flac") returned 6 [0073.947] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.ape") returned 0 [0073.947] lstrlenA (lpString="*.ape") returned 5 [0073.947] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.wma") returned 0 [0073.947] lstrlenA (lpString="*.wma") returned 5 [0073.947] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.ac3") returned 0 [0073.947] lstrlenA (lpString="*.ac3") returned 5 [0073.947] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4f3e00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9fc58be, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8d4f3e00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x0, cFileName="WING1.WMF", cAlternateFileName="")) returned 1 [0073.947] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.947] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WING1.WMF") returned -1 [0073.947] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WING1.WMF") returned -1 [0073.947] lstrcmpiA (lpString1="", lpString2="WING1.WMF") returned -1 [0073.947] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF") returned="WHIRL2.WMF" [0073.947] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.948] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.948] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.948] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.948] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WING1.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" [0073.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.zip") returned 0 [0073.948] lstrlenA (lpString="*.zip") returned 5 [0073.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.rar") returned 0 [0073.948] lstrlenA (lpString="*.rar") returned 5 [0073.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.7z") returned 0 [0073.948] lstrlenA (lpString="*.7z") returned 4 [0073.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.tar") returned 0 [0073.948] lstrlenA (lpString="*.tar") returned 5 [0073.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.gzip") returned 0 [0073.948] lstrlenA (lpString="*.gzip") returned 6 [0073.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.jpg") returned 0 [0073.948] lstrlenA (lpString="*.jpg") returned 5 [0073.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.jpeg") returned 0 [0073.948] lstrlenA (lpString="*.jpeg") returned 6 [0073.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.psd") returned 0 [0073.948] lstrlenA (lpString="*.psd") returned 5 [0073.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.cdr") returned 0 [0073.948] lstrlenA (lpString="*.cdr") returned 5 [0073.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.dwg") returned 0 [0073.948] lstrlenA (lpString="*.dwg") returned 5 [0073.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.max") returned 0 [0073.948] lstrlenA (lpString="*.max") returned 5 [0073.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.bmp") returned 0 [0073.948] lstrlenA (lpString="*.bmp") returned 5 [0073.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.gif") returned 0 [0073.948] lstrlenA (lpString="*.gif") returned 5 [0073.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.png") returned 0 [0073.949] lstrlenA (lpString="*.png") returned 5 [0073.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.doc") returned 0 [0073.949] lstrlenA (lpString="*.doc") returned 5 [0073.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.docx") returned 0 [0073.949] lstrlenA (lpString="*.docx") returned 6 [0073.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.xls") returned 0 [0073.949] lstrlenA (lpString="*.xls") returned 5 [0073.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.xlsx") returned 0 [0073.949] lstrlenA (lpString="*.xlsx") returned 6 [0073.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.ppt") returned 0 [0073.949] lstrlenA (lpString="*.ppt") returned 5 [0073.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.pptx") returned 0 [0073.949] lstrlenA (lpString="*.pptx") returned 6 [0073.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.txt") returned 0 [0073.949] lstrlenA (lpString="*.txt") returned 5 [0073.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.pdf") returned 0 [0073.949] lstrlenA (lpString="*.pdf") returned 5 [0073.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.djvu") returned 0 [0073.949] lstrlenA (lpString="*.djvu") returned 6 [0073.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.htm") returned 0 [0073.949] lstrlenA (lpString="*.htm") returned 5 [0073.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.html") returned 0 [0073.949] lstrlenA (lpString="*.html") returned 6 [0073.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.mdb") returned 0 [0073.949] lstrlenA (lpString="*.mdb") returned 5 [0073.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.cer") returned 0 [0073.949] lstrlenA (lpString="*.cer") returned 5 [0073.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.p12") returned 0 [0073.949] lstrlenA (lpString="*.p12") returned 5 [0073.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.pfx") returned 0 [0073.949] lstrlenA (lpString="*.pfx") returned 5 [0073.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.kwm") returned 0 [0073.949] lstrlenA (lpString="*.kwm") returned 5 [0073.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.pwm") returned 0 [0073.950] lstrlenA (lpString="*.pwm") returned 5 [0073.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.1cd") returned 0 [0073.950] lstrlenA (lpString="*.1cd") returned 5 [0073.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.md") returned 0 [0073.950] lstrlenA (lpString="*.md") returned 4 [0073.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.mdf") returned 0 [0073.950] lstrlenA (lpString="*.mdf") returned 5 [0073.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.dbf") returned 0 [0073.950] lstrlenA (lpString="*.dbf") returned 5 [0073.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.odt") returned 0 [0073.950] lstrlenA (lpString="*.odt") returned 5 [0073.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.vob") returned 0 [0073.950] lstrlenA (lpString="*.vob") returned 5 [0073.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.ifo") returned 0 [0073.950] lstrlenA (lpString="*.ifo") returned 5 [0073.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.lnk") returned 0 [0073.950] lstrlenA (lpString="*.lnk") returned 5 [0073.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.torrent") returned 0 [0073.950] lstrlenA (lpString="*.torrent") returned 9 [0073.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.mov") returned 0 [0073.950] lstrlenA (lpString="*.mov") returned 5 [0073.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.m2v") returned 0 [0073.950] lstrlenA (lpString="*.m2v") returned 5 [0073.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.3gp") returned 0 [0073.950] lstrlenA (lpString="*.3gp") returned 5 [0073.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.mpeg") returned 0 [0073.950] lstrlenA (lpString="*.mpeg") returned 6 [0073.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.mpg") returned 0 [0073.950] lstrlenA (lpString="*.mpg") returned 5 [0073.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.flv") returned 0 [0073.950] lstrlenA (lpString="*.flv") returned 5 [0073.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.avi") returned 0 [0073.951] lstrlenA (lpString="*.avi") returned 5 [0073.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.mp4") returned 0 [0073.951] lstrlenA (lpString="*.mp4") returned 5 [0073.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.wmv") returned 0 [0073.951] lstrlenA (lpString="*.wmv") returned 5 [0073.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.divx") returned 0 [0073.951] lstrlenA (lpString="*.divx") returned 6 [0073.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.mkv") returned 0 [0073.951] lstrlenA (lpString="*.mkv") returned 5 [0073.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.mp3") returned 0 [0073.951] lstrlenA (lpString="*.mp3") returned 5 [0073.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.wav") returned 0 [0073.951] lstrlenA (lpString="*.wav") returned 5 [0073.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.flac") returned 0 [0073.951] lstrlenA (lpString="*.flac") returned 6 [0073.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.ape") returned 0 [0073.951] lstrlenA (lpString="*.ape") returned 5 [0073.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.wma") returned 0 [0073.951] lstrlenA (lpString="*.wma") returned 5 [0073.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.ac3") returned 0 [0073.951] lstrlenA (lpString="*.ac3") returned 5 [0073.951] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4f3e00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9fcbb0b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8d4f3e00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x0, dwReserved1=0x0, cFileName="WING2.WMF", cAlternateFileName="")) returned 1 [0073.951] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.951] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WING2.WMF") returned -1 [0073.951] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WING2.WMF") returned -1 [0073.951] lstrcmpiA (lpString1="", lpString2="WING2.WMF") returned -1 [0073.951] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF") returned="WING1.WMF" [0073.951] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.951] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.951] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.951] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.952] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WING2.WMF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" [0073.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.zip") returned 0 [0073.952] lstrlenA (lpString="*.zip") returned 5 [0073.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.rar") returned 0 [0073.952] lstrlenA (lpString="*.rar") returned 5 [0073.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.7z") returned 0 [0073.952] lstrlenA (lpString="*.7z") returned 4 [0073.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.tar") returned 0 [0073.952] lstrlenA (lpString="*.tar") returned 5 [0073.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.gzip") returned 0 [0073.952] lstrlenA (lpString="*.gzip") returned 6 [0073.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.jpg") returned 0 [0073.952] lstrlenA (lpString="*.jpg") returned 5 [0073.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.jpeg") returned 0 [0073.952] lstrlenA (lpString="*.jpeg") returned 6 [0073.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.psd") returned 0 [0073.952] lstrlenA (lpString="*.psd") returned 5 [0073.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.cdr") returned 0 [0073.952] lstrlenA (lpString="*.cdr") returned 5 [0073.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.dwg") returned 0 [0073.952] lstrlenA (lpString="*.dwg") returned 5 [0073.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.max") returned 0 [0073.952] lstrlenA (lpString="*.max") returned 5 [0073.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.bmp") returned 0 [0073.952] lstrlenA (lpString="*.bmp") returned 5 [0073.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.gif") returned 0 [0073.952] lstrlenA (lpString="*.gif") returned 5 [0073.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.png") returned 0 [0073.952] lstrlenA (lpString="*.png") returned 5 [0073.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.doc") returned 0 [0073.952] lstrlenA (lpString="*.doc") returned 5 [0073.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.docx") returned 0 [0073.953] lstrlenA (lpString="*.docx") returned 6 [0073.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.xls") returned 0 [0073.953] lstrlenA (lpString="*.xls") returned 5 [0073.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.xlsx") returned 0 [0073.953] lstrlenA (lpString="*.xlsx") returned 6 [0073.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.ppt") returned 0 [0073.953] lstrlenA (lpString="*.ppt") returned 5 [0073.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.pptx") returned 0 [0073.953] lstrlenA (lpString="*.pptx") returned 6 [0073.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.txt") returned 0 [0073.953] lstrlenA (lpString="*.txt") returned 5 [0073.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.pdf") returned 0 [0073.953] lstrlenA (lpString="*.pdf") returned 5 [0073.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.djvu") returned 0 [0073.953] lstrlenA (lpString="*.djvu") returned 6 [0073.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.htm") returned 0 [0073.953] lstrlenA (lpString="*.htm") returned 5 [0073.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.html") returned 0 [0073.953] lstrlenA (lpString="*.html") returned 6 [0073.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.mdb") returned 0 [0073.953] lstrlenA (lpString="*.mdb") returned 5 [0073.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.cer") returned 0 [0073.953] lstrlenA (lpString="*.cer") returned 5 [0073.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.p12") returned 0 [0073.953] lstrlenA (lpString="*.p12") returned 5 [0073.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.pfx") returned 0 [0073.953] lstrlenA (lpString="*.pfx") returned 5 [0073.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.kwm") returned 0 [0073.953] lstrlenA (lpString="*.kwm") returned 5 [0073.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.pwm") returned 0 [0073.953] lstrlenA (lpString="*.pwm") returned 5 [0073.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.1cd") returned 0 [0073.953] lstrlenA (lpString="*.1cd") returned 5 [0073.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.md") returned 0 [0073.953] lstrlenA (lpString="*.md") returned 4 [0073.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.mdf") returned 0 [0073.954] lstrlenA (lpString="*.mdf") returned 5 [0073.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.dbf") returned 0 [0073.954] lstrlenA (lpString="*.dbf") returned 5 [0073.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.odt") returned 0 [0073.954] lstrlenA (lpString="*.odt") returned 5 [0073.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.vob") returned 0 [0073.954] lstrlenA (lpString="*.vob") returned 5 [0073.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.ifo") returned 0 [0073.954] lstrlenA (lpString="*.ifo") returned 5 [0073.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.lnk") returned 0 [0073.954] lstrlenA (lpString="*.lnk") returned 5 [0073.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.torrent") returned 0 [0073.954] lstrlenA (lpString="*.torrent") returned 9 [0073.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.mov") returned 0 [0073.954] lstrlenA (lpString="*.mov") returned 5 [0073.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.m2v") returned 0 [0073.954] lstrlenA (lpString="*.m2v") returned 5 [0073.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.3gp") returned 0 [0073.954] lstrlenA (lpString="*.3gp") returned 5 [0073.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.mpeg") returned 0 [0073.954] lstrlenA (lpString="*.mpeg") returned 6 [0073.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.mpg") returned 0 [0073.954] lstrlenA (lpString="*.mpg") returned 5 [0073.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.flv") returned 0 [0073.954] lstrlenA (lpString="*.flv") returned 5 [0073.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.avi") returned 0 [0073.954] lstrlenA (lpString="*.avi") returned 5 [0073.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.mp4") returned 0 [0073.954] lstrlenA (lpString="*.mp4") returned 5 [0073.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.wmv") returned 0 [0073.954] lstrlenA (lpString="*.wmv") returned 5 [0073.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.divx") returned 0 [0073.954] lstrlenA (lpString="*.divx") returned 6 [0073.955] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.mkv") returned 0 [0073.955] lstrlenA (lpString="*.mkv") returned 5 [0073.955] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.mp3") returned 0 [0073.955] lstrlenA (lpString="*.mp3") returned 5 [0073.955] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.wav") returned 0 [0073.955] lstrlenA (lpString="*.wav") returned 5 [0073.955] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.flac") returned 0 [0073.955] lstrlenA (lpString="*.flac") returned 6 [0073.955] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.ape") returned 0 [0073.955] lstrlenA (lpString="*.ape") returned 5 [0073.955] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.wma") returned 0 [0073.955] lstrlenA (lpString="*.wma") returned 5 [0073.955] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.ac3") returned 0 [0073.955] lstrlenA (lpString="*.ac3") returned 5 [0073.955] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xba07b704, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1b03, dwReserved0=0x0, dwReserved1=0x0, cFileName="WNTER_01.MID", cAlternateFileName="")) returned 1 [0073.955] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0073.955] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WNTER_01.MID") returned -1 [0073.955] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WNTER_01.MID") returned -1 [0073.955] lstrcmpiA (lpString1="", lpString2="WNTER_01.MID") returned -1 [0073.955] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF") returned="WING2.WMF" [0073.955] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" [0073.955] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0073.955] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0073.955] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0073.955] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="WNTER_01.MID" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" [0073.955] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID", pszSpec="*.zip") returned 0 [0073.955] lstrlenA (lpString="*.zip") returned 5 [0073.955] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID", pszSpec="*.rar") returned 0 [0073.955] lstrlenA (lpString="*.rar") returned 5 [0073.955] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID", pszSpec="*.7z") returned 0 [0073.955] lstrlenA (lpString="*.7z") returned 4 [0073.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID", pszSpec="*.tar") returned 0 [0073.956] lstrlenA (lpString="*.tar") returned 5 [0073.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID", pszSpec="*.gzip") returned 0 [0073.956] lstrlenA (lpString="*.gzip") returned 6 [0073.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID", pszSpec="*.jpg") returned 0 [0073.956] lstrlenA (lpString="*.jpg") returned 5 [0073.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID", pszSpec="*.jpeg") returned 0 [0073.956] lstrlenA (lpString="*.jpeg") returned 6 [0073.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID", pszSpec="*.psd") returned 0 [0073.956] lstrlenA (lpString="*.psd") returned 5 [0073.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID", pszSpec="*.cdr") returned 0 [0073.956] lstrlenA (lpString="*.cdr") returned 5 [0073.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID", pszSpec="*.dwg") returned 0 [0073.956] lstrlenA (lpString="*.dwg") returned 5 [0073.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID", pszSpec="*.max") returned 0 [0073.956] lstrlenA (lpString="*.max") returned 5 [0073.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID", pszSpec="*.bmp") returned 0 [0073.956] lstrlenA (lpString="*.bmp") returned 5 [0073.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID", pszSpec="*.gif") returned 0 [0073.956] lstrlenA (lpString="*.gif") returned 5 [0073.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID", pszSpec="*.png") returned 0 [0073.956] lstrlenA (lpString="*.png") returned 5 [0073.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID", pszSpec="*.doc") returned 0 [0073.956] lstrlenA (lpString="*.doc") returned 5 [0073.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID", pszSpec="*.docx") returned 0 [0073.957] lstrlenA (lpString="*.docx") returned 6 [0073.957] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID", pszSpec="*.xls") returned 0 [0073.957] lstrlenA (lpString="*.xls") returned 5 [0073.957] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID", pszSpec="*.xlsx") returned 0 [0073.957] lstrlenA (lpString="*.xlsx") returned 6 [0073.957] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID", pszSpec="*.ppt") returned 0 [0073.957] lstrlenA (lpString="*.ppt") returned 5 [0073.957] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID", pszSpec="*.pptx") returned 0 [0073.957] lstrlenA (lpString="*.pptx") returned 6 [0073.957] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID", pszSpec="*.txt") returned 0 [0073.957] lstrlenA (lpString="*.txt") returned 5 [0073.957] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xba07b704, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1b03, dwReserved0=0x0, dwReserved1=0x0, cFileName="WNTER_01.MID", cAlternateFileName="")) returned 0 [0073.957] FindClose (in: hFindFile=0x636530 | out: hFindFile=0x636530) returned 1 [0073.957] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadf383a4, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0xadf39748, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xadf39748, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0073.957] lstrcmpA (lpString1=".", lpString2="Publisher") returned -1 [0073.958] lstrcmpA (lpString1="..", lpString2="Publisher") returned -1 [0073.958] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\*.*") returned="*.*" [0073.958] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\", lpString2="Publisher" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher" [0073.958] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\*.*" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\*.*"), lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadf383a4, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0xadf39748, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xadf39748, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636970 [0073.959] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0073.959] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadf383a4, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0xadf39748, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xadf39748, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.959] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0073.959] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0073.959] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadf39748, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0xcbdd346b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xcbdd346b, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 1 [0073.959] lstrcmpA (lpString1=".", lpString2="Backgrounds") returned -1 [0073.959] lstrcmpA (lpString1="..", lpString2="Backgrounds") returned -1 [0073.959] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\*.*") returned="*.*" [0073.959] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\", lpString2="Backgrounds" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0073.959] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadf39748, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0xcbdd346b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xcbdd346b, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6468a0, dwReserved1=0x646898, cFileName=".", cAlternateFileName="")) returned 0x6365b0 [0073.961] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0073.961] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadf39748, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0xcbdd346b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xcbdd346b, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6468a0, dwReserved1=0x646898, cFileName="..", cAlternateFileName="")) returned 1 [0073.961] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0073.961] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0073.961] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf3ab5b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xf77, dwReserved0=0x6468a0, dwReserved1=0x646898, cFileName="J0143743.GIF", cAlternateFileName="")) returned 1 [0073.961] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0073.961] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0143743.GIF") returned -1 [0073.961] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0143743.GIF") returned -1 [0073.961] lstrcmpiA (lpString1="", lpString2="J0143743.GIF") returned -1 [0073.961] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*") returned="*.*" [0073.961] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0073.961] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0073.961] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0073.962] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0xffffffff [0073.962] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0073.963] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0073.964] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0073.964] CloseHandle (hObject=0x1d0) returned 1 [0073.964] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143743.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" [0073.964] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", pszSpec="*.zip") returned 0 [0073.964] lstrlenA (lpString="*.zip") returned 5 [0073.964] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", pszSpec="*.rar") returned 0 [0073.964] lstrlenA (lpString="*.rar") returned 5 [0073.964] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", pszSpec="*.7z") returned 0 [0073.964] lstrlenA (lpString="*.7z") returned 4 [0073.964] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", pszSpec="*.tar") returned 0 [0073.965] lstrlenA (lpString="*.tar") returned 5 [0073.965] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", pszSpec="*.gzip") returned 0 [0073.965] lstrlenA (lpString="*.gzip") returned 6 [0073.965] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", pszSpec="*.jpg") returned 0 [0073.965] lstrlenA (lpString="*.jpg") returned 5 [0073.965] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", pszSpec="*.jpeg") returned 0 [0073.965] lstrlenA (lpString="*.jpeg") returned 6 [0073.965] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", pszSpec="*.psd") returned 0 [0073.965] lstrlenA (lpString="*.psd") returned 5 [0073.965] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", pszSpec="*.cdr") returned 0 [0073.965] lstrlenA (lpString="*.cdr") returned 5 [0073.965] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", pszSpec="*.dwg") returned 0 [0073.965] lstrlenA (lpString="*.dwg") returned 5 [0073.965] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", pszSpec="*.max") returned 0 [0073.965] lstrlenA (lpString="*.max") returned 5 [0073.965] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", pszSpec="*.bmp") returned 0 [0073.965] lstrlenA (lpString="*.bmp") returned 5 [0073.965] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", pszSpec="*.gif") returned 1 [0073.965] lstrlenA (lpString="*.gif") returned 5 [0073.965] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" [0073.965] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" [0073.965] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF." [0073.965] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.BD" [0073.965] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0073.966] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf77 [0073.966] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xadf3ab5b, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.966] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.966] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xf1b, lpOverlapped=0x0) returned 1 [0073.967] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned="J0143743.GIF" [0073.968] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.968] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xf1b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xf1b, lpOverlapped=0x0) returned 1 [0073.968] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.968] CloseHandle (hObject=0x1d0) returned 1 [0073.968] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif.bd")) returned 1 [0073.969] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf3f951, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143744.GIF", cAlternateFileName="")) returned 1 [0073.969] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0073.969] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0143744.GIF") returned -1 [0073.969] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0143744.GIF") returned -1 [0073.969] lstrcmpiA (lpString1="", lpString2="J0143744.GIF") returned -1 [0073.969] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned="J0143743.GIF" [0073.969] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0073.969] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0073.969] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0073.969] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0073.969] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143744.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" [0073.969] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.zip") returned 0 [0073.969] lstrlenA (lpString="*.zip") returned 5 [0073.969] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.rar") returned 0 [0073.969] lstrlenA (lpString="*.rar") returned 5 [0073.969] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.7z") returned 0 [0073.969] lstrlenA (lpString="*.7z") returned 4 [0073.969] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.tar") returned 0 [0073.969] lstrlenA (lpString="*.tar") returned 5 [0073.969] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.gzip") returned 0 [0073.969] lstrlenA (lpString="*.gzip") returned 6 [0073.969] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.jpg") returned 0 [0073.969] lstrlenA (lpString="*.jpg") returned 5 [0073.969] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.jpeg") returned 0 [0073.969] lstrlenA (lpString="*.jpeg") returned 6 [0073.969] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.psd") returned 0 [0073.969] lstrlenA (lpString="*.psd") returned 5 [0073.970] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.cdr") returned 0 [0073.970] lstrlenA (lpString="*.cdr") returned 5 [0073.970] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.dwg") returned 0 [0073.970] lstrlenA (lpString="*.dwg") returned 5 [0073.970] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.max") returned 0 [0073.970] lstrlenA (lpString="*.max") returned 5 [0073.970] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.bmp") returned 0 [0073.970] lstrlenA (lpString="*.bmp") returned 5 [0073.970] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.gif") returned 1 [0073.970] lstrlenA (lpString="*.gif") returned 5 [0073.970] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" [0073.970] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" [0073.970] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF." [0073.970] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.BD" [0073.970] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0073.970] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f [0073.970] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xadf3f951, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.970] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.970] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0073.970] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.971] CloseHandle (hObject=0x1d0) returned 1 [0073.971] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif.bd")) returned 1 [0073.971] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf4334c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143745.GIF", cAlternateFileName="")) returned 1 [0073.971] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0073.971] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0143745.GIF") returned -1 [0073.971] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0143745.GIF") returned -1 [0073.971] lstrcmpiA (lpString1="", lpString2="J0143745.GIF") returned -1 [0073.971] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned="J0143744.GIF" [0073.971] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0073.971] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0073.971] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0073.971] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0073.971] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143745.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" [0073.972] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.zip") returned 0 [0073.972] lstrlenA (lpString="*.zip") returned 5 [0073.972] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.rar") returned 0 [0073.972] lstrlenA (lpString="*.rar") returned 5 [0073.972] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.7z") returned 0 [0073.972] lstrlenA (lpString="*.7z") returned 4 [0073.972] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.tar") returned 0 [0073.972] lstrlenA (lpString="*.tar") returned 5 [0073.972] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.gzip") returned 0 [0073.972] lstrlenA (lpString="*.gzip") returned 6 [0073.972] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.jpg") returned 0 [0073.972] lstrlenA (lpString="*.jpg") returned 5 [0073.972] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.jpeg") returned 0 [0073.972] lstrlenA (lpString="*.jpeg") returned 6 [0073.972] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.psd") returned 0 [0073.972] lstrlenA (lpString="*.psd") returned 5 [0073.972] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.cdr") returned 0 [0073.972] lstrlenA (lpString="*.cdr") returned 5 [0073.972] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.dwg") returned 0 [0073.972] lstrlenA (lpString="*.dwg") returned 5 [0073.973] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.max") returned 0 [0073.973] lstrlenA (lpString="*.max") returned 5 [0073.973] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.bmp") returned 0 [0073.973] lstrlenA (lpString="*.bmp") returned 5 [0073.973] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.gif") returned 1 [0073.973] lstrlenA (lpString="*.gif") returned 5 [0073.973] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" [0073.973] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" [0073.973] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF." [0073.973] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.BD" [0073.973] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0073.973] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2dd [0073.973] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xadf4334c, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.973] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.973] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x281, lpOverlapped=0x0) returned 1 [0073.980] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned="J0143745.GIF" [0073.980] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.980] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x281, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x281, lpOverlapped=0x0) returned 1 [0073.980] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.980] CloseHandle (hObject=0x1d0) returned 1 [0073.980] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif.bd")) returned 1 [0073.981] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf49518, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x595, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143746.GIF", cAlternateFileName="")) returned 1 [0073.981] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0073.981] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0143746.GIF") returned -1 [0073.981] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0143746.GIF") returned -1 [0073.981] lstrcmpiA (lpString1="", lpString2="J0143746.GIF") returned -1 [0073.981] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned="J0143745.GIF" [0073.981] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0073.981] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0073.981] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0073.981] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0073.982] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143746.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" [0073.982] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.zip") returned 0 [0073.982] lstrlenA (lpString="*.zip") returned 5 [0073.982] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.rar") returned 0 [0073.982] lstrlenA (lpString="*.rar") returned 5 [0073.982] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.7z") returned 0 [0073.982] lstrlenA (lpString="*.7z") returned 4 [0073.982] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.tar") returned 0 [0073.982] lstrlenA (lpString="*.tar") returned 5 [0073.982] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.gzip") returned 0 [0073.982] lstrlenA (lpString="*.gzip") returned 6 [0073.982] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.jpg") returned 0 [0073.982] lstrlenA (lpString="*.jpg") returned 5 [0073.982] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.jpeg") returned 0 [0073.982] lstrlenA (lpString="*.jpeg") returned 6 [0073.982] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.psd") returned 0 [0073.982] lstrlenA (lpString="*.psd") returned 5 [0073.982] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.cdr") returned 0 [0073.982] lstrlenA (lpString="*.cdr") returned 5 [0073.982] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.dwg") returned 0 [0073.982] lstrlenA (lpString="*.dwg") returned 5 [0073.982] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.max") returned 0 [0073.982] lstrlenA (lpString="*.max") returned 5 [0073.982] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.bmp") returned 0 [0073.982] lstrlenA (lpString="*.bmp") returned 5 [0073.982] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.gif") returned 1 [0073.982] lstrlenA (lpString="*.gif") returned 5 [0073.982] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" [0073.982] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" [0073.982] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF." [0073.982] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.BD" [0073.983] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0073.983] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x595 [0073.983] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xadf49518, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.983] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.983] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x539, lpOverlapped=0x0) returned 1 [0073.985] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned="J0143746.GIF" [0073.985] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.985] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x539, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x539, lpOverlapped=0x0) returned 1 [0073.985] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.985] CloseHandle (hObject=0x1d0) returned 1 [0073.985] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif.bd")) returned 1 [0073.986] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf4e3ed, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x11d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143748.GIF", cAlternateFileName="")) returned 1 [0073.986] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0073.986] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0143748.GIF") returned -1 [0073.986] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0143748.GIF") returned -1 [0073.986] lstrcmpiA (lpString1="", lpString2="J0143748.GIF") returned -1 [0073.986] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned="J0143746.GIF" [0073.986] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0073.986] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0073.986] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0073.986] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0073.986] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143748.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" [0073.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.zip") returned 0 [0073.986] lstrlenA (lpString="*.zip") returned 5 [0073.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.rar") returned 0 [0073.986] lstrlenA (lpString="*.rar") returned 5 [0073.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.7z") returned 0 [0073.986] lstrlenA (lpString="*.7z") returned 4 [0073.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.tar") returned 0 [0073.986] lstrlenA (lpString="*.tar") returned 5 [0073.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.gzip") returned 0 [0073.986] lstrlenA (lpString="*.gzip") returned 6 [0073.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.jpg") returned 0 [0073.987] lstrlenA (lpString="*.jpg") returned 5 [0073.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.jpeg") returned 0 [0073.987] lstrlenA (lpString="*.jpeg") returned 6 [0073.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.psd") returned 0 [0073.987] lstrlenA (lpString="*.psd") returned 5 [0073.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.cdr") returned 0 [0073.987] lstrlenA (lpString="*.cdr") returned 5 [0073.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.dwg") returned 0 [0073.987] lstrlenA (lpString="*.dwg") returned 5 [0073.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.max") returned 0 [0073.987] lstrlenA (lpString="*.max") returned 5 [0073.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.bmp") returned 0 [0073.987] lstrlenA (lpString="*.bmp") returned 5 [0073.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.gif") returned 1 [0073.987] lstrlenA (lpString="*.gif") returned 5 [0073.987] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" [0073.987] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" [0073.987] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF." [0073.987] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.BD" [0073.987] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0073.988] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11d1 [0073.988] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xadf4e3ed, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.988] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.988] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1175, lpOverlapped=0x0) returned 1 [0073.989] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned="J0143748.GIF" [0073.989] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.989] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1175, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1175, lpOverlapped=0x0) returned 1 [0073.989] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.989] CloseHandle (hObject=0x1d0) returned 1 [0073.990] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif.bd")) returned 1 [0073.990] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33f8a6d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1323, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143749.GIF", cAlternateFileName="")) returned 1 [0073.990] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0073.990] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0143749.GIF") returned -1 [0073.990] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0143749.GIF") returned -1 [0073.990] lstrcmpiA (lpString1="", lpString2="J0143749.GIF") returned -1 [0073.990] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned="J0143748.GIF" [0073.990] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0073.990] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0073.990] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0073.990] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0073.990] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143749.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" [0073.991] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.zip") returned 0 [0073.991] lstrlenA (lpString="*.zip") returned 5 [0073.991] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.rar") returned 0 [0073.991] lstrlenA (lpString="*.rar") returned 5 [0073.991] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.7z") returned 0 [0073.991] lstrlenA (lpString="*.7z") returned 4 [0073.991] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.tar") returned 0 [0073.991] lstrlenA (lpString="*.tar") returned 5 [0073.991] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.gzip") returned 0 [0073.991] lstrlenA (lpString="*.gzip") returned 6 [0073.991] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.jpg") returned 0 [0073.991] lstrlenA (lpString="*.jpg") returned 5 [0073.991] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.jpeg") returned 0 [0073.991] lstrlenA (lpString="*.jpeg") returned 6 [0073.991] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.psd") returned 0 [0073.991] lstrlenA (lpString="*.psd") returned 5 [0073.991] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.cdr") returned 0 [0073.991] lstrlenA (lpString="*.cdr") returned 5 [0073.991] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.dwg") returned 0 [0073.991] lstrlenA (lpString="*.dwg") returned 5 [0073.991] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.max") returned 0 [0073.991] lstrlenA (lpString="*.max") returned 5 [0073.991] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.bmp") returned 0 [0073.991] lstrlenA (lpString="*.bmp") returned 5 [0073.991] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.gif") returned 1 [0073.991] lstrlenA (lpString="*.gif") returned 5 [0073.991] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" [0073.991] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" [0073.991] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF." [0073.991] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.BD" [0073.991] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0073.992] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1323 [0073.992] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc33f8a6d, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.992] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.992] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x12c7, lpOverlapped=0x0) returned 1 [0073.996] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned="J0143749.GIF" [0073.996] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.996] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x12c7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x12c7, lpOverlapped=0x0) returned 1 [0073.996] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.996] CloseHandle (hObject=0x1d0) returned 1 [0073.996] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif.bd")) returned 1 [0073.997] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33fd896, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x43e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143750.GIF", cAlternateFileName="")) returned 1 [0073.997] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0073.997] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0143750.GIF") returned -1 [0073.997] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0143750.GIF") returned -1 [0073.997] lstrcmpiA (lpString1="", lpString2="J0143750.GIF") returned -1 [0073.997] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned="J0143749.GIF" [0073.997] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0073.997] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0073.997] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0073.997] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0073.997] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143750.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" [0073.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.zip") returned 0 [0073.997] lstrlenA (lpString="*.zip") returned 5 [0073.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.rar") returned 0 [0073.997] lstrlenA (lpString="*.rar") returned 5 [0073.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.7z") returned 0 [0073.997] lstrlenA (lpString="*.7z") returned 4 [0073.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.tar") returned 0 [0073.997] lstrlenA (lpString="*.tar") returned 5 [0073.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.gzip") returned 0 [0073.997] lstrlenA (lpString="*.gzip") returned 6 [0073.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.jpg") returned 0 [0073.998] lstrlenA (lpString="*.jpg") returned 5 [0073.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.jpeg") returned 0 [0073.998] lstrlenA (lpString="*.jpeg") returned 6 [0073.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.psd") returned 0 [0073.998] lstrlenA (lpString="*.psd") returned 5 [0073.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.cdr") returned 0 [0073.998] lstrlenA (lpString="*.cdr") returned 5 [0073.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.dwg") returned 0 [0073.998] lstrlenA (lpString="*.dwg") returned 5 [0073.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.max") returned 0 [0073.998] lstrlenA (lpString="*.max") returned 5 [0073.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.bmp") returned 0 [0073.998] lstrlenA (lpString="*.bmp") returned 5 [0073.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.gif") returned 1 [0073.998] lstrlenA (lpString="*.gif") returned 5 [0073.998] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" [0073.998] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" [0073.998] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF." [0073.998] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.BD" [0073.998] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0073.998] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43e [0073.999] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc33fd896, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0073.999] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0073.999] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x3e2, lpOverlapped=0x0) returned 1 [0074.000] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned="J0143750.GIF" [0074.000] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.000] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x3e2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x3e2, lpOverlapped=0x0) returned 1 [0074.000] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.001] CloseHandle (hObject=0x1d0) returned 1 [0074.001] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif.bd")) returned 1 [0074.001] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf53155, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x412, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143752.GIF", cAlternateFileName="")) returned 1 [0074.001] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.001] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0143752.GIF") returned -1 [0074.001] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0143752.GIF") returned -1 [0074.001] lstrcmpiA (lpString1="", lpString2="J0143752.GIF") returned -1 [0074.001] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned="J0143750.GIF" [0074.001] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0074.001] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0074.001] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0074.001] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0074.002] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143752.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" [0074.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.zip") returned 0 [0074.002] lstrlenA (lpString="*.zip") returned 5 [0074.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.rar") returned 0 [0074.002] lstrlenA (lpString="*.rar") returned 5 [0074.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.7z") returned 0 [0074.002] lstrlenA (lpString="*.7z") returned 4 [0074.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.tar") returned 0 [0074.002] lstrlenA (lpString="*.tar") returned 5 [0074.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.gzip") returned 0 [0074.002] lstrlenA (lpString="*.gzip") returned 6 [0074.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.jpg") returned 0 [0074.002] lstrlenA (lpString="*.jpg") returned 5 [0074.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.jpeg") returned 0 [0074.002] lstrlenA (lpString="*.jpeg") returned 6 [0074.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.psd") returned 0 [0074.002] lstrlenA (lpString="*.psd") returned 5 [0074.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.cdr") returned 0 [0074.002] lstrlenA (lpString="*.cdr") returned 5 [0074.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.dwg") returned 0 [0074.002] lstrlenA (lpString="*.dwg") returned 5 [0074.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.max") returned 0 [0074.002] lstrlenA (lpString="*.max") returned 5 [0074.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.bmp") returned 0 [0074.002] lstrlenA (lpString="*.bmp") returned 5 [0074.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.gif") returned 1 [0074.002] lstrlenA (lpString="*.gif") returned 5 [0074.002] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" [0074.002] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" [0074.002] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF." [0074.002] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.BD" [0074.003] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.003] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x412 [0074.003] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xadf53155, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0074.003] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.003] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x3b6, lpOverlapped=0x0) returned 1 [0074.005] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned="J0143752.GIF" [0074.005] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.005] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x3b6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x3b6, lpOverlapped=0x0) returned 1 [0074.005] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.005] CloseHandle (hObject=0x1d0) returned 1 [0074.005] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif.bd")) returned 1 [0074.006] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf58042, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1b7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143753.GIF", cAlternateFileName="")) returned 1 [0074.006] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.006] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0143753.GIF") returned -1 [0074.006] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0143753.GIF") returned -1 [0074.006] lstrcmpiA (lpString1="", lpString2="J0143753.GIF") returned -1 [0074.006] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned="J0143752.GIF" [0074.006] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0074.006] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0074.006] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0074.006] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0074.006] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143753.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" [0074.006] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.zip") returned 0 [0074.006] lstrlenA (lpString="*.zip") returned 5 [0074.006] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.rar") returned 0 [0074.006] lstrlenA (lpString="*.rar") returned 5 [0074.006] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.7z") returned 0 [0074.006] lstrlenA (lpString="*.7z") returned 4 [0074.006] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.tar") returned 0 [0074.006] lstrlenA (lpString="*.tar") returned 5 [0074.006] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.gzip") returned 0 [0074.006] lstrlenA (lpString="*.gzip") returned 6 [0074.006] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.jpg") returned 0 [0074.006] lstrlenA (lpString="*.jpg") returned 5 [0074.006] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.jpeg") returned 0 [0074.006] lstrlenA (lpString="*.jpeg") returned 6 [0074.006] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.psd") returned 0 [0074.006] lstrlenA (lpString="*.psd") returned 5 [0074.006] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.cdr") returned 0 [0074.006] lstrlenA (lpString="*.cdr") returned 5 [0074.007] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.dwg") returned 0 [0074.007] lstrlenA (lpString="*.dwg") returned 5 [0074.007] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.max") returned 0 [0074.007] lstrlenA (lpString="*.max") returned 5 [0074.007] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.bmp") returned 0 [0074.007] lstrlenA (lpString="*.bmp") returned 5 [0074.007] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.gif") returned 1 [0074.007] lstrlenA (lpString="*.gif") returned 5 [0074.007] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" [0074.007] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" [0074.007] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF." [0074.007] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.BD" [0074.007] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.007] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b7f [0074.007] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xadf58042, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0074.007] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.007] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1b23, lpOverlapped=0x0) returned 1 [0074.009] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned="J0143753.GIF" [0074.009] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.009] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1b23, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1b23, lpOverlapped=0x0) returned 1 [0074.009] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.009] CloseHandle (hObject=0x1d0) returned 1 [0074.009] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif.bd")) returned 1 [0074.010] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc340b9fa, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143754.GIF", cAlternateFileName="")) returned 1 [0074.010] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.010] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0143754.GIF") returned -1 [0074.010] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0143754.GIF") returned -1 [0074.010] lstrcmpiA (lpString1="", lpString2="J0143754.GIF") returned -1 [0074.010] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned="J0143753.GIF" [0074.010] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0074.010] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0074.010] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0074.010] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0074.010] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143754.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" [0074.010] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.zip") returned 0 [0074.010] lstrlenA (lpString="*.zip") returned 5 [0074.010] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.rar") returned 0 [0074.010] lstrlenA (lpString="*.rar") returned 5 [0074.010] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.7z") returned 0 [0074.010] lstrlenA (lpString="*.7z") returned 4 [0074.010] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.tar") returned 0 [0074.010] lstrlenA (lpString="*.tar") returned 5 [0074.011] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.gzip") returned 0 [0074.011] lstrlenA (lpString="*.gzip") returned 6 [0074.011] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.jpg") returned 0 [0074.011] lstrlenA (lpString="*.jpg") returned 5 [0074.011] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.jpeg") returned 0 [0074.011] lstrlenA (lpString="*.jpeg") returned 6 [0074.011] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.psd") returned 0 [0074.011] lstrlenA (lpString="*.psd") returned 5 [0074.011] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.cdr") returned 0 [0074.011] lstrlenA (lpString="*.cdr") returned 5 [0074.011] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.dwg") returned 0 [0074.011] lstrlenA (lpString="*.dwg") returned 5 [0074.011] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.max") returned 0 [0074.011] lstrlenA (lpString="*.max") returned 5 [0074.011] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.bmp") returned 0 [0074.011] lstrlenA (lpString="*.bmp") returned 5 [0074.011] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.gif") returned 1 [0074.011] lstrlenA (lpString="*.gif") returned 5 [0074.011] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" [0074.011] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" [0074.011] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF." [0074.011] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.BD" [0074.011] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.011] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6ad [0074.012] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc340b9fa, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0074.012] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.012] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x651, lpOverlapped=0x0) returned 1 [0074.013] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned="J0143754.GIF" [0074.013] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.013] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x651, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x651, lpOverlapped=0x0) returned 1 [0074.013] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.013] CloseHandle (hObject=0x1d0) returned 1 [0074.014] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif.bd")) returned 1 [0074.017] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc341dc7b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x69f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143758.GIF", cAlternateFileName="")) returned 1 [0074.017] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.017] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0143758.GIF") returned -1 [0074.017] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0143758.GIF") returned -1 [0074.017] lstrcmpiA (lpString1="", lpString2="J0143758.GIF") returned -1 [0074.018] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned="J0143754.GIF" [0074.018] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0074.018] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0074.018] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0074.018] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0074.018] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143758.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" [0074.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.zip") returned 0 [0074.018] lstrlenA (lpString="*.zip") returned 5 [0074.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.rar") returned 0 [0074.018] lstrlenA (lpString="*.rar") returned 5 [0074.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.7z") returned 0 [0074.018] lstrlenA (lpString="*.7z") returned 4 [0074.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.tar") returned 0 [0074.018] lstrlenA (lpString="*.tar") returned 5 [0074.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.gzip") returned 0 [0074.018] lstrlenA (lpString="*.gzip") returned 6 [0074.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.jpg") returned 0 [0074.018] lstrlenA (lpString="*.jpg") returned 5 [0074.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.jpeg") returned 0 [0074.018] lstrlenA (lpString="*.jpeg") returned 6 [0074.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.psd") returned 0 [0074.018] lstrlenA (lpString="*.psd") returned 5 [0074.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.cdr") returned 0 [0074.018] lstrlenA (lpString="*.cdr") returned 5 [0074.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.dwg") returned 0 [0074.018] lstrlenA (lpString="*.dwg") returned 5 [0074.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.max") returned 0 [0074.023] lstrlenA (lpString="*.max") returned 5 [0074.023] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.bmp") returned 0 [0074.023] lstrlenA (lpString="*.bmp") returned 5 [0074.023] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.gif") returned 1 [0074.023] lstrlenA (lpString="*.gif") returned 5 [0074.023] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" [0074.023] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" [0074.023] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF." [0074.023] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.BD" [0074.023] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.023] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x69f [0074.023] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xc341dc7b, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0074.023] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.024] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x643, lpOverlapped=0x0) returned 1 [0074.025] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned="J0143758.GIF" [0074.025] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.025] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x643, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x643, lpOverlapped=0x0) returned 1 [0074.025] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.025] CloseHandle (hObject=0x1d0) returned 1 [0074.025] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif.bd")) returned 1 [0074.026] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbb84ffd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x124a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00516L.GIF", cAlternateFileName="")) returned 1 [0074.026] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.026] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB00516L.GIF") returned -1 [0074.026] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB00516L.GIF") returned -1 [0074.026] lstrcmpiA (lpString1="", lpString2="WB00516L.GIF") returned -1 [0074.026] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned="J0143758.GIF" [0074.026] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0074.026] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0074.026] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0074.026] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0074.026] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB00516L.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" [0074.026] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.zip") returned 0 [0074.026] lstrlenA (lpString="*.zip") returned 5 [0074.026] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.rar") returned 0 [0074.026] lstrlenA (lpString="*.rar") returned 5 [0074.026] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.7z") returned 0 [0074.026] lstrlenA (lpString="*.7z") returned 4 [0074.026] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.tar") returned 0 [0074.026] lstrlenA (lpString="*.tar") returned 5 [0074.026] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.gzip") returned 0 [0074.026] lstrlenA (lpString="*.gzip") returned 6 [0074.026] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.jpg") returned 0 [0074.027] lstrlenA (lpString="*.jpg") returned 5 [0074.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.jpeg") returned 0 [0074.027] lstrlenA (lpString="*.jpeg") returned 6 [0074.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.psd") returned 0 [0074.027] lstrlenA (lpString="*.psd") returned 5 [0074.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.cdr") returned 0 [0074.027] lstrlenA (lpString="*.cdr") returned 5 [0074.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.dwg") returned 0 [0074.027] lstrlenA (lpString="*.dwg") returned 5 [0074.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.max") returned 0 [0074.027] lstrlenA (lpString="*.max") returned 5 [0074.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.bmp") returned 0 [0074.027] lstrlenA (lpString="*.bmp") returned 5 [0074.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.gif") returned 1 [0074.027] lstrlenA (lpString="*.gif") returned 5 [0074.027] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" [0074.027] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" [0074.027] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF." [0074.027] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.BD" [0074.027] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.027] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x124a [0074.027] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbb84ffd, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0074.027] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.027] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x11ee, lpOverlapped=0x0) returned 1 [0074.029] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned="WB00516L.GIF" [0074.029] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.030] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x11ee, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x11ee, lpOverlapped=0x0) returned 1 [0074.030] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.030] CloseHandle (hObject=0x1d0) returned 1 [0074.030] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif.bd")) returned 1 [0074.030] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9dde846, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2017, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00531L.GIF", cAlternateFileName="")) returned 1 [0074.030] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.030] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB00531L.GIF") returned -1 [0074.030] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB00531L.GIF") returned -1 [0074.031] lstrcmpiA (lpString1="", lpString2="WB00531L.GIF") returned -1 [0074.031] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned="WB00516L.GIF" [0074.031] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0074.031] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0074.031] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0074.031] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0074.031] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB00531L.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" [0074.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.zip") returned 0 [0074.031] lstrlenA (lpString="*.zip") returned 5 [0074.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.rar") returned 0 [0074.031] lstrlenA (lpString="*.rar") returned 5 [0074.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.7z") returned 0 [0074.031] lstrlenA (lpString="*.7z") returned 4 [0074.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.tar") returned 0 [0074.031] lstrlenA (lpString="*.tar") returned 5 [0074.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.gzip") returned 0 [0074.031] lstrlenA (lpString="*.gzip") returned 6 [0074.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.jpg") returned 0 [0074.031] lstrlenA (lpString="*.jpg") returned 5 [0074.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.jpeg") returned 0 [0074.031] lstrlenA (lpString="*.jpeg") returned 6 [0074.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.psd") returned 0 [0074.031] lstrlenA (lpString="*.psd") returned 5 [0074.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.cdr") returned 0 [0074.031] lstrlenA (lpString="*.cdr") returned 5 [0074.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.dwg") returned 0 [0074.031] lstrlenA (lpString="*.dwg") returned 5 [0074.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.max") returned 0 [0074.031] lstrlenA (lpString="*.max") returned 5 [0074.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.bmp") returned 0 [0074.031] lstrlenA (lpString="*.bmp") returned 5 [0074.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.gif") returned 1 [0074.032] lstrlenA (lpString="*.gif") returned 5 [0074.032] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" [0074.032] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" [0074.032] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF." [0074.032] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.BD" [0074.032] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.032] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2017 [0074.032] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9dde846, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0074.032] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.032] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1fbb, lpOverlapped=0x0) returned 1 [0074.036] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned="WB00531L.GIF" [0074.036] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.036] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1fbb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1fbb, lpOverlapped=0x0) returned 1 [0074.036] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.036] CloseHandle (hObject=0x1d0) returned 1 [0074.036] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif.bd")) returned 1 [0074.037] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbb8d8a4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x20ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00673L.GIF", cAlternateFileName="")) returned 1 [0074.037] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.037] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB00673L.GIF") returned -1 [0074.037] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB00673L.GIF") returned -1 [0074.037] lstrcmpiA (lpString1="", lpString2="WB00673L.GIF") returned -1 [0074.037] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned="WB00531L.GIF" [0074.037] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0074.037] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0074.037] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0074.037] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0074.037] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB00673L.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" [0074.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.zip") returned 0 [0074.037] lstrlenA (lpString="*.zip") returned 5 [0074.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.rar") returned 0 [0074.037] lstrlenA (lpString="*.rar") returned 5 [0074.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.7z") returned 0 [0074.037] lstrlenA (lpString="*.7z") returned 4 [0074.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.tar") returned 0 [0074.037] lstrlenA (lpString="*.tar") returned 5 [0074.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.gzip") returned 0 [0074.037] lstrlenA (lpString="*.gzip") returned 6 [0074.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.jpg") returned 0 [0074.038] lstrlenA (lpString="*.jpg") returned 5 [0074.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.jpeg") returned 0 [0074.038] lstrlenA (lpString="*.jpeg") returned 6 [0074.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.psd") returned 0 [0074.038] lstrlenA (lpString="*.psd") returned 5 [0074.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.cdr") returned 0 [0074.038] lstrlenA (lpString="*.cdr") returned 5 [0074.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.dwg") returned 0 [0074.038] lstrlenA (lpString="*.dwg") returned 5 [0074.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.max") returned 0 [0074.038] lstrlenA (lpString="*.max") returned 5 [0074.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.bmp") returned 0 [0074.038] lstrlenA (lpString="*.bmp") returned 5 [0074.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.gif") returned 1 [0074.038] lstrlenA (lpString="*.gif") returned 5 [0074.038] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" [0074.038] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" [0074.038] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF." [0074.038] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.BD" [0074.038] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.038] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x20ee [0074.039] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbb8d8a4, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0074.039] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.039] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x2092, lpOverlapped=0x0) returned 1 [0074.040] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned="WB00673L.GIF" [0074.041] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.041] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x2092, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x2092, lpOverlapped=0x0) returned 1 [0074.041] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.041] CloseHandle (hObject=0x1d0) returned 1 [0074.041] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif.bd")) returned 1 [0074.041] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9de35f2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00703L.GIF", cAlternateFileName="")) returned 1 [0074.041] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.042] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB00703L.GIF") returned -1 [0074.042] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB00703L.GIF") returned -1 [0074.042] lstrcmpiA (lpString1="", lpString2="WB00703L.GIF") returned -1 [0074.042] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned="WB00673L.GIF" [0074.042] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0074.042] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0074.042] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0074.042] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0074.042] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB00703L.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" [0074.042] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.zip") returned 0 [0074.042] lstrlenA (lpString="*.zip") returned 5 [0074.042] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.rar") returned 0 [0074.042] lstrlenA (lpString="*.rar") returned 5 [0074.042] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.7z") returned 0 [0074.042] lstrlenA (lpString="*.7z") returned 4 [0074.042] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.tar") returned 0 [0074.042] lstrlenA (lpString="*.tar") returned 5 [0074.042] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.gzip") returned 0 [0074.042] lstrlenA (lpString="*.gzip") returned 6 [0074.042] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.jpg") returned 0 [0074.042] lstrlenA (lpString="*.jpg") returned 5 [0074.042] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.jpeg") returned 0 [0074.042] lstrlenA (lpString="*.jpeg") returned 6 [0074.042] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.psd") returned 0 [0074.042] lstrlenA (lpString="*.psd") returned 5 [0074.042] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.cdr") returned 0 [0074.042] lstrlenA (lpString="*.cdr") returned 5 [0074.042] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.dwg") returned 0 [0074.042] lstrlenA (lpString="*.dwg") returned 5 [0074.042] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.max") returned 0 [0074.042] lstrlenA (lpString="*.max") returned 5 [0074.043] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.bmp") returned 0 [0074.043] lstrlenA (lpString="*.bmp") returned 5 [0074.043] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.gif") returned 1 [0074.043] lstrlenA (lpString="*.gif") returned 5 [0074.043] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" [0074.043] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" [0074.043] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF." [0074.043] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.BD" [0074.043] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.043] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2026 [0074.043] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9de35f2, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0074.043] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.043] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1fca, lpOverlapped=0x0) returned 1 [0074.045] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned="WB00703L.GIF" [0074.045] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.045] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1fca, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1fca, lpOverlapped=0x0) returned 1 [0074.045] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.045] CloseHandle (hObject=0x1d0) returned 1 [0074.045] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif.bd")) returned 1 [0074.046] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9de97aa, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2313, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00760L.GIF", cAlternateFileName="")) returned 1 [0074.046] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.046] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB00760L.GIF") returned -1 [0074.046] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB00760L.GIF") returned -1 [0074.046] lstrcmpiA (lpString1="", lpString2="WB00760L.GIF") returned -1 [0074.046] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned="WB00703L.GIF" [0074.046] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0074.046] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0074.046] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0074.046] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0074.046] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB00760L.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" [0074.046] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.zip") returned 0 [0074.046] lstrlenA (lpString="*.zip") returned 5 [0074.046] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.rar") returned 0 [0074.046] lstrlenA (lpString="*.rar") returned 5 [0074.046] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.7z") returned 0 [0074.046] lstrlenA (lpString="*.7z") returned 4 [0074.046] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.tar") returned 0 [0074.046] lstrlenA (lpString="*.tar") returned 5 [0074.047] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.gzip") returned 0 [0074.047] lstrlenA (lpString="*.gzip") returned 6 [0074.047] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.jpg") returned 0 [0074.047] lstrlenA (lpString="*.jpg") returned 5 [0074.047] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.jpeg") returned 0 [0074.047] lstrlenA (lpString="*.jpeg") returned 6 [0074.047] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.psd") returned 0 [0074.047] lstrlenA (lpString="*.psd") returned 5 [0074.047] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.cdr") returned 0 [0074.047] lstrlenA (lpString="*.cdr") returned 5 [0074.047] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.dwg") returned 0 [0074.047] lstrlenA (lpString="*.dwg") returned 5 [0074.047] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.max") returned 0 [0074.047] lstrlenA (lpString="*.max") returned 5 [0074.047] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.bmp") returned 0 [0074.047] lstrlenA (lpString="*.bmp") returned 5 [0074.047] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.gif") returned 1 [0074.047] lstrlenA (lpString="*.gif") returned 5 [0074.047] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" [0074.047] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" [0074.047] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF." [0074.047] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.BD" [0074.047] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.047] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2313 [0074.048] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9de97aa, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0074.048] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.048] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x22b7, lpOverlapped=0x0) returned 1 [0074.050] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned="WB00760L.GIF" [0074.050] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.050] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x22b7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x22b7, lpOverlapped=0x0) returned 1 [0074.050] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.050] CloseHandle (hObject=0x1d0) returned 1 [0074.050] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif.bd")) returned 1 [0074.051] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbb9274a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1f8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00780L.GIF", cAlternateFileName="")) returned 1 [0074.051] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.051] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB00780L.GIF") returned -1 [0074.051] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB00780L.GIF") returned -1 [0074.051] lstrcmpiA (lpString1="", lpString2="WB00780L.GIF") returned -1 [0074.051] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned="WB00760L.GIF" [0074.051] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0074.051] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0074.051] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0074.051] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0074.051] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB00780L.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" [0074.051] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.zip") returned 0 [0074.051] lstrlenA (lpString="*.zip") returned 5 [0074.051] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.rar") returned 0 [0074.051] lstrlenA (lpString="*.rar") returned 5 [0074.052] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.7z") returned 0 [0074.052] lstrlenA (lpString="*.7z") returned 4 [0074.052] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.tar") returned 0 [0074.052] lstrlenA (lpString="*.tar") returned 5 [0074.052] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.gzip") returned 0 [0074.052] lstrlenA (lpString="*.gzip") returned 6 [0074.052] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.jpg") returned 0 [0074.052] lstrlenA (lpString="*.jpg") returned 5 [0074.052] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.jpeg") returned 0 [0074.052] lstrlenA (lpString="*.jpeg") returned 6 [0074.052] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.psd") returned 0 [0074.052] lstrlenA (lpString="*.psd") returned 5 [0074.052] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.cdr") returned 0 [0074.052] lstrlenA (lpString="*.cdr") returned 5 [0074.052] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.dwg") returned 0 [0074.052] lstrlenA (lpString="*.dwg") returned 5 [0074.052] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.max") returned 0 [0074.052] lstrlenA (lpString="*.max") returned 5 [0074.052] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.bmp") returned 0 [0074.052] lstrlenA (lpString="*.bmp") returned 5 [0074.052] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.gif") returned 1 [0074.052] lstrlenA (lpString="*.gif") returned 5 [0074.052] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" [0074.052] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" [0074.052] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF." [0074.052] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.BD" [0074.052] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.053] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f8f [0074.053] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbb9274a, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0074.053] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.053] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x1f33, lpOverlapped=0x0) returned 1 [0074.054] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned="WB00780L.GIF" [0074.055] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.055] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x1f33, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x1f33, lpOverlapped=0x0) returned 1 [0074.055] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.055] CloseHandle (hObject=0x1d0) returned 1 [0074.055] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif.bd")) returned 1 [0074.056] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbbe9193, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01741L.GIF", cAlternateFileName="")) returned 1 [0074.056] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.056] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB01741L.GIF") returned -1 [0074.056] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01741L.GIF") returned -1 [0074.056] lstrcmpiA (lpString1="", lpString2="WB01741L.GIF") returned -1 [0074.056] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned="WB00780L.GIF" [0074.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0074.056] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0074.056] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0074.056] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0074.056] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB01741L.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" [0074.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.zip") returned 0 [0074.056] lstrlenA (lpString="*.zip") returned 5 [0074.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.rar") returned 0 [0074.056] lstrlenA (lpString="*.rar") returned 5 [0074.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.7z") returned 0 [0074.056] lstrlenA (lpString="*.7z") returned 4 [0074.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.tar") returned 0 [0074.056] lstrlenA (lpString="*.tar") returned 5 [0074.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.gzip") returned 0 [0074.056] lstrlenA (lpString="*.gzip") returned 6 [0074.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.jpg") returned 0 [0074.056] lstrlenA (lpString="*.jpg") returned 5 [0074.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.jpeg") returned 0 [0074.057] lstrlenA (lpString="*.jpeg") returned 6 [0074.057] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.psd") returned 0 [0074.057] lstrlenA (lpString="*.psd") returned 5 [0074.057] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.cdr") returned 0 [0074.057] lstrlenA (lpString="*.cdr") returned 5 [0074.057] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.dwg") returned 0 [0074.057] lstrlenA (lpString="*.dwg") returned 5 [0074.057] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.max") returned 0 [0074.057] lstrlenA (lpString="*.max") returned 5 [0074.057] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.bmp") returned 0 [0074.057] lstrlenA (lpString="*.bmp") returned 5 [0074.057] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.gif") returned 1 [0074.057] lstrlenA (lpString="*.gif") returned 5 [0074.057] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" [0074.057] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" [0074.057] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF." [0074.057] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.BD" [0074.057] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.057] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe1d [0074.057] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbbe9193, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0074.057] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.057] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xdc1, lpOverlapped=0x0) returned 1 [0074.059] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned="WB01741L.GIF" [0074.059] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.059] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xdc1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xdc1, lpOverlapped=0x0) returned 1 [0074.059] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.059] CloseHandle (hObject=0x1d0) returned 1 [0074.059] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif.bd")) returned 1 [0074.060] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9e415ec, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02039_.GIF", cAlternateFileName="")) returned 1 [0074.060] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.060] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB02039_.GIF") returned -1 [0074.060] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02039_.GIF") returned -1 [0074.060] lstrcmpiA (lpString1="", lpString2="WB02039_.GIF") returned -1 [0074.060] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned="WB01741L.GIF" [0074.060] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0074.060] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0074.060] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0074.060] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0074.060] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02039_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" [0074.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.zip") returned 0 [0074.060] lstrlenA (lpString="*.zip") returned 5 [0074.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.rar") returned 0 [0074.060] lstrlenA (lpString="*.rar") returned 5 [0074.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.7z") returned 0 [0074.061] lstrlenA (lpString="*.7z") returned 4 [0074.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.tar") returned 0 [0074.061] lstrlenA (lpString="*.tar") returned 5 [0074.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.gzip") returned 0 [0074.061] lstrlenA (lpString="*.gzip") returned 6 [0074.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.jpg") returned 0 [0074.061] lstrlenA (lpString="*.jpg") returned 5 [0074.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.jpeg") returned 0 [0074.061] lstrlenA (lpString="*.jpeg") returned 6 [0074.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.psd") returned 0 [0074.061] lstrlenA (lpString="*.psd") returned 5 [0074.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.cdr") returned 0 [0074.061] lstrlenA (lpString="*.cdr") returned 5 [0074.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.dwg") returned 0 [0074.061] lstrlenA (lpString="*.dwg") returned 5 [0074.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.max") returned 0 [0074.061] lstrlenA (lpString="*.max") returned 5 [0074.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.bmp") returned 0 [0074.061] lstrlenA (lpString="*.bmp") returned 5 [0074.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.gif") returned 1 [0074.061] lstrlenA (lpString="*.gif") returned 5 [0074.061] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" [0074.061] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" [0074.061] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF." [0074.061] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.BD" [0074.061] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.062] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38c [0074.062] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9e415ec, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0074.062] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.062] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x330, lpOverlapped=0x0) returned 1 [0074.064] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned="WB02039_.GIF" [0074.064] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.064] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x330, lpOverlapped=0x0) returned 1 [0074.064] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.064] CloseHandle (hObject=0x1d0) returned 1 [0074.064] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif.bd")) returned 1 [0074.065] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbc21408, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x987, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02055_.GIF", cAlternateFileName="")) returned 1 [0074.065] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.065] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB02055_.GIF") returned -1 [0074.065] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02055_.GIF") returned -1 [0074.065] lstrcmpiA (lpString1="", lpString2="WB02055_.GIF") returned -1 [0074.065] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned="WB02039_.GIF" [0074.065] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0074.065] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0074.065] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0074.065] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0074.065] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02055_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" [0074.065] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.zip") returned 0 [0074.065] lstrlenA (lpString="*.zip") returned 5 [0074.065] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.rar") returned 0 [0074.065] lstrlenA (lpString="*.rar") returned 5 [0074.065] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.7z") returned 0 [0074.065] lstrlenA (lpString="*.7z") returned 4 [0074.065] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.tar") returned 0 [0074.065] lstrlenA (lpString="*.tar") returned 5 [0074.065] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.gzip") returned 0 [0074.065] lstrlenA (lpString="*.gzip") returned 6 [0074.065] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.jpg") returned 0 [0074.065] lstrlenA (lpString="*.jpg") returned 5 [0074.066] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.jpeg") returned 0 [0074.066] lstrlenA (lpString="*.jpeg") returned 6 [0074.066] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.psd") returned 0 [0074.066] lstrlenA (lpString="*.psd") returned 5 [0074.066] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.cdr") returned 0 [0074.066] lstrlenA (lpString="*.cdr") returned 5 [0074.066] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.dwg") returned 0 [0074.066] lstrlenA (lpString="*.dwg") returned 5 [0074.066] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.max") returned 0 [0074.066] lstrlenA (lpString="*.max") returned 5 [0074.066] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.bmp") returned 0 [0074.066] lstrlenA (lpString="*.bmp") returned 5 [0074.066] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.gif") returned 1 [0074.066] lstrlenA (lpString="*.gif") returned 5 [0074.066] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" [0074.066] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" [0074.066] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF." [0074.066] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.BD" [0074.066] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.067] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x987 [0074.067] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbc21408, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0074.067] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.067] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x92b, lpOverlapped=0x0) returned 1 [0074.068] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned="WB02055_.GIF" [0074.068] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.068] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x92b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x92b, lpOverlapped=0x0) returned 1 [0074.068] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.068] CloseHandle (hObject=0x1d0) returned 1 [0074.068] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif.bd")) returned 1 [0074.069] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbc26242, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x37d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02073_.GIF", cAlternateFileName="")) returned 1 [0074.069] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.069] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB02073_.GIF") returned -1 [0074.069] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02073_.GIF") returned -1 [0074.069] lstrcmpiA (lpString1="", lpString2="WB02073_.GIF") returned -1 [0074.069] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned="WB02055_.GIF" [0074.069] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0074.069] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0074.069] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0074.069] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0074.069] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02073_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" [0074.069] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.zip") returned 0 [0074.069] lstrlenA (lpString="*.zip") returned 5 [0074.069] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.rar") returned 0 [0074.070] lstrlenA (lpString="*.rar") returned 5 [0074.070] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.7z") returned 0 [0074.070] lstrlenA (lpString="*.7z") returned 4 [0074.070] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.tar") returned 0 [0074.070] lstrlenA (lpString="*.tar") returned 5 [0074.070] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.gzip") returned 0 [0074.070] lstrlenA (lpString="*.gzip") returned 6 [0074.070] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.jpg") returned 0 [0074.070] lstrlenA (lpString="*.jpg") returned 5 [0074.070] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.jpeg") returned 0 [0074.070] lstrlenA (lpString="*.jpeg") returned 6 [0074.070] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.psd") returned 0 [0074.070] lstrlenA (lpString="*.psd") returned 5 [0074.070] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.cdr") returned 0 [0074.070] lstrlenA (lpString="*.cdr") returned 5 [0074.070] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.dwg") returned 0 [0074.070] lstrlenA (lpString="*.dwg") returned 5 [0074.070] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.max") returned 0 [0074.070] lstrlenA (lpString="*.max") returned 5 [0074.070] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.bmp") returned 0 [0074.070] lstrlenA (lpString="*.bmp") returned 5 [0074.070] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.gif") returned 1 [0074.070] lstrlenA (lpString="*.gif") returned 5 [0074.070] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" [0074.070] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" [0074.070] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF." [0074.070] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.BD" [0074.070] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.071] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x37d [0074.071] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbc26242, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0074.071] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.071] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x321, lpOverlapped=0x0) returned 1 [0074.072] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned="WB02073_.GIF" [0074.072] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.072] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x321, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x321, lpOverlapped=0x0) returned 1 [0074.072] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.072] CloseHandle (hObject=0x1d0) returned 1 [0074.072] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif.bd")) returned 1 [0074.073] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9e463fe, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x516, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02074_.GIF", cAlternateFileName="")) returned 1 [0074.073] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.073] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB02074_.GIF") returned -1 [0074.073] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02074_.GIF") returned -1 [0074.073] lstrcmpiA (lpString1="", lpString2="WB02074_.GIF") returned -1 [0074.073] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned="WB02073_.GIF" [0074.073] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0074.073] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0074.073] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0074.073] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0074.073] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02074_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" [0074.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.zip") returned 0 [0074.073] lstrlenA (lpString="*.zip") returned 5 [0074.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.rar") returned 0 [0074.073] lstrlenA (lpString="*.rar") returned 5 [0074.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.7z") returned 0 [0074.074] lstrlenA (lpString="*.7z") returned 4 [0074.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.tar") returned 0 [0074.074] lstrlenA (lpString="*.tar") returned 5 [0074.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.gzip") returned 0 [0074.074] lstrlenA (lpString="*.gzip") returned 6 [0074.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.jpg") returned 0 [0074.074] lstrlenA (lpString="*.jpg") returned 5 [0074.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.jpeg") returned 0 [0074.074] lstrlenA (lpString="*.jpeg") returned 6 [0074.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.psd") returned 0 [0074.074] lstrlenA (lpString="*.psd") returned 5 [0074.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.cdr") returned 0 [0074.074] lstrlenA (lpString="*.cdr") returned 5 [0074.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.dwg") returned 0 [0074.074] lstrlenA (lpString="*.dwg") returned 5 [0074.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.max") returned 0 [0074.074] lstrlenA (lpString="*.max") returned 5 [0074.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.bmp") returned 0 [0074.074] lstrlenA (lpString="*.bmp") returned 5 [0074.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.gif") returned 1 [0074.074] lstrlenA (lpString="*.gif") returned 5 [0074.074] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" [0074.074] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" [0074.074] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF." [0074.074] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.BD" [0074.074] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.075] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x516 [0074.075] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9e463fe, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0074.075] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.075] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x4ba, lpOverlapped=0x0) returned 1 [0074.080] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned="WB02074_.GIF" [0074.080] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.080] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x4ba, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x4ba, lpOverlapped=0x0) returned 1 [0074.080] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.080] CloseHandle (hObject=0x1d0) returned 1 [0074.080] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif.bd")) returned 1 [0074.081] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbdb28dd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02077_.GIF", cAlternateFileName="")) returned 1 [0074.081] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.081] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB02077_.GIF") returned -1 [0074.081] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02077_.GIF") returned -1 [0074.081] lstrcmpiA (lpString1="", lpString2="WB02077_.GIF") returned -1 [0074.081] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned="WB02074_.GIF" [0074.081] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0074.081] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0074.081] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0074.081] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0074.081] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02077_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" [0074.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.zip") returned 0 [0074.101] lstrlenA (lpString="*.zip") returned 5 [0074.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.rar") returned 0 [0074.101] lstrlenA (lpString="*.rar") returned 5 [0074.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.7z") returned 0 [0074.101] lstrlenA (lpString="*.7z") returned 4 [0074.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.tar") returned 0 [0074.101] lstrlenA (lpString="*.tar") returned 5 [0074.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.gzip") returned 0 [0074.101] lstrlenA (lpString="*.gzip") returned 6 [0074.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.jpg") returned 0 [0074.101] lstrlenA (lpString="*.jpg") returned 5 [0074.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.jpeg") returned 0 [0074.101] lstrlenA (lpString="*.jpeg") returned 6 [0074.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.psd") returned 0 [0074.101] lstrlenA (lpString="*.psd") returned 5 [0074.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.cdr") returned 0 [0074.101] lstrlenA (lpString="*.cdr") returned 5 [0074.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.dwg") returned 0 [0074.101] lstrlenA (lpString="*.dwg") returned 5 [0074.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.max") returned 0 [0074.101] lstrlenA (lpString="*.max") returned 5 [0074.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.bmp") returned 0 [0074.101] lstrlenA (lpString="*.bmp") returned 5 [0074.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.gif") returned 1 [0074.101] lstrlenA (lpString="*.gif") returned 5 [0074.102] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" [0074.102] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" [0074.102] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF." [0074.102] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.BD" [0074.102] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.103] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fd [0074.103] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbdb28dd, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0074.103] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.103] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x2a1, lpOverlapped=0x0) returned 1 [0074.104] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned="WB02077_.GIF" [0074.104] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.104] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x2a1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x2a1, lpOverlapped=0x0) returned 1 [0074.105] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.105] CloseHandle (hObject=0x1d0) returned 1 [0074.105] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif.bd")) returned 1 [0074.105] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9e4b247, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x996, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02082_.GIF", cAlternateFileName="")) returned 1 [0074.105] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.105] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB02082_.GIF") returned -1 [0074.105] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02082_.GIF") returned -1 [0074.105] lstrcmpiA (lpString1="", lpString2="WB02082_.GIF") returned -1 [0074.105] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned="WB02077_.GIF" [0074.106] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0074.106] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0074.106] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0074.106] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0074.106] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02082_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" [0074.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.zip") returned 0 [0074.106] lstrlenA (lpString="*.zip") returned 5 [0074.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.rar") returned 0 [0074.106] lstrlenA (lpString="*.rar") returned 5 [0074.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.7z") returned 0 [0074.106] lstrlenA (lpString="*.7z") returned 4 [0074.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.tar") returned 0 [0074.106] lstrlenA (lpString="*.tar") returned 5 [0074.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.gzip") returned 0 [0074.106] lstrlenA (lpString="*.gzip") returned 6 [0074.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.jpg") returned 0 [0074.106] lstrlenA (lpString="*.jpg") returned 5 [0074.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.jpeg") returned 0 [0074.106] lstrlenA (lpString="*.jpeg") returned 6 [0074.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.psd") returned 0 [0074.106] lstrlenA (lpString="*.psd") returned 5 [0074.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.cdr") returned 0 [0074.106] lstrlenA (lpString="*.cdr") returned 5 [0074.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.dwg") returned 0 [0074.106] lstrlenA (lpString="*.dwg") returned 5 [0074.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.max") returned 0 [0074.106] lstrlenA (lpString="*.max") returned 5 [0074.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.bmp") returned 0 [0074.106] lstrlenA (lpString="*.bmp") returned 5 [0074.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.gif") returned 1 [0074.107] lstrlenA (lpString="*.gif") returned 5 [0074.107] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" [0074.107] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" [0074.107] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF." [0074.107] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.BD" [0074.107] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.107] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x996 [0074.107] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9e4b247, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0074.107] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.107] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x93a, lpOverlapped=0x0) returned 1 [0074.108] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned="WB02082_.GIF" [0074.109] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.109] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x93a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x93a, lpOverlapped=0x0) returned 1 [0074.109] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.109] CloseHandle (hObject=0x1d0) returned 1 [0074.109] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif.bd")) returned 1 [0074.110] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9e4ec9f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02085_.GIF", cAlternateFileName="")) returned 1 [0074.110] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.110] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB02085_.GIF") returned -1 [0074.110] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02085_.GIF") returned -1 [0074.110] lstrcmpiA (lpString1="", lpString2="WB02085_.GIF") returned -1 [0074.110] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned="WB02082_.GIF" [0074.110] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0074.110] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0074.110] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0074.110] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0074.110] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02085_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" [0074.110] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.zip") returned 0 [0074.110] lstrlenA (lpString="*.zip") returned 5 [0074.110] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.rar") returned 0 [0074.110] lstrlenA (lpString="*.rar") returned 5 [0074.110] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.7z") returned 0 [0074.110] lstrlenA (lpString="*.7z") returned 4 [0074.110] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.tar") returned 0 [0074.110] lstrlenA (lpString="*.tar") returned 5 [0074.110] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.gzip") returned 0 [0074.110] lstrlenA (lpString="*.gzip") returned 6 [0074.110] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.jpg") returned 0 [0074.110] lstrlenA (lpString="*.jpg") returned 5 [0074.110] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.jpeg") returned 0 [0074.110] lstrlenA (lpString="*.jpeg") returned 6 [0074.110] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.psd") returned 0 [0074.110] lstrlenA (lpString="*.psd") returned 5 [0074.110] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.cdr") returned 0 [0074.111] lstrlenA (lpString="*.cdr") returned 5 [0074.111] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.dwg") returned 0 [0074.111] lstrlenA (lpString="*.dwg") returned 5 [0074.111] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.max") returned 0 [0074.111] lstrlenA (lpString="*.max") returned 5 [0074.111] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.bmp") returned 0 [0074.111] lstrlenA (lpString="*.bmp") returned 5 [0074.111] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.gif") returned 1 [0074.111] lstrlenA (lpString="*.gif") returned 5 [0074.111] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" [0074.111] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" [0074.111] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF." [0074.111] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.BD" [0074.111] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.111] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x90c [0074.111] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9e4ec9f, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0074.111] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.111] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x8b0, lpOverlapped=0x0) returned 1 [0074.114] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned="WB02085_.GIF" [0074.114] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.114] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x8b0, lpOverlapped=0x0) returned 1 [0074.114] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.114] CloseHandle (hObject=0x1d0) returned 1 [0074.114] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif.bd")) returned 1 [0074.115] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9e54f35, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x581, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02097_.GIF", cAlternateFileName="")) returned 1 [0074.115] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.115] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB02097_.GIF") returned -1 [0074.115] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02097_.GIF") returned -1 [0074.115] lstrcmpiA (lpString1="", lpString2="WB02097_.GIF") returned -1 [0074.115] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned="WB02085_.GIF" [0074.115] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0074.115] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0074.115] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0074.115] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0074.115] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02097_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" [0074.115] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.zip") returned 0 [0074.115] lstrlenA (lpString="*.zip") returned 5 [0074.115] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.rar") returned 0 [0074.115] lstrlenA (lpString="*.rar") returned 5 [0074.115] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.7z") returned 0 [0074.115] lstrlenA (lpString="*.7z") returned 4 [0074.115] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.tar") returned 0 [0074.115] lstrlenA (lpString="*.tar") returned 5 [0074.115] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.gzip") returned 0 [0074.115] lstrlenA (lpString="*.gzip") returned 6 [0074.115] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.jpg") returned 0 [0074.116] lstrlenA (lpString="*.jpg") returned 5 [0074.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.jpeg") returned 0 [0074.116] lstrlenA (lpString="*.jpeg") returned 6 [0074.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.psd") returned 0 [0074.116] lstrlenA (lpString="*.psd") returned 5 [0074.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.cdr") returned 0 [0074.116] lstrlenA (lpString="*.cdr") returned 5 [0074.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.dwg") returned 0 [0074.116] lstrlenA (lpString="*.dwg") returned 5 [0074.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.max") returned 0 [0074.116] lstrlenA (lpString="*.max") returned 5 [0074.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.bmp") returned 0 [0074.116] lstrlenA (lpString="*.bmp") returned 5 [0074.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.gif") returned 1 [0074.116] lstrlenA (lpString="*.gif") returned 5 [0074.116] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" [0074.116] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" [0074.116] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF." [0074.116] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.BD" [0074.116] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.117] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x581 [0074.117] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9e54f35, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0074.117] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.117] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x525, lpOverlapped=0x0) returned 1 [0074.118] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned="WB02097_.GIF" [0074.118] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.118] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x525, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x525, lpOverlapped=0x0) returned 1 [0074.119] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.119] CloseHandle (hObject=0x1d0) returned 1 [0074.119] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif.bd")) returned 1 [0074.119] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbdb8699, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x15fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02106_.GIF", cAlternateFileName="")) returned 1 [0074.119] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.119] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB02106_.GIF") returned -1 [0074.119] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02106_.GIF") returned -1 [0074.119] lstrcmpiA (lpString1="", lpString2="WB02106_.GIF") returned -1 [0074.120] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned="WB02097_.GIF" [0074.120] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0074.120] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0074.120] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0074.120] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0074.120] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02106_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" [0074.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.zip") returned 0 [0074.120] lstrlenA (lpString="*.zip") returned 5 [0074.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.rar") returned 0 [0074.120] lstrlenA (lpString="*.rar") returned 5 [0074.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.7z") returned 0 [0074.120] lstrlenA (lpString="*.7z") returned 4 [0074.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.tar") returned 0 [0074.120] lstrlenA (lpString="*.tar") returned 5 [0074.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.gzip") returned 0 [0074.120] lstrlenA (lpString="*.gzip") returned 6 [0074.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.jpg") returned 0 [0074.120] lstrlenA (lpString="*.jpg") returned 5 [0074.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.jpeg") returned 0 [0074.120] lstrlenA (lpString="*.jpeg") returned 6 [0074.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.psd") returned 0 [0074.120] lstrlenA (lpString="*.psd") returned 5 [0074.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.cdr") returned 0 [0074.120] lstrlenA (lpString="*.cdr") returned 5 [0074.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.dwg") returned 0 [0074.120] lstrlenA (lpString="*.dwg") returned 5 [0074.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.max") returned 0 [0074.120] lstrlenA (lpString="*.max") returned 5 [0074.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.bmp") returned 0 [0074.120] lstrlenA (lpString="*.bmp") returned 5 [0074.121] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.gif") returned 1 [0074.121] lstrlenA (lpString="*.gif") returned 5 [0074.121] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" [0074.121] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" [0074.121] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF." [0074.121] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.BD" [0074.121] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.121] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15fa [0074.121] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbdb8699, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0074.121] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.121] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x159e, lpOverlapped=0x0) returned 1 [0074.123] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned="WB02106_.GIF" [0074.123] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.123] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x159e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x159e, lpOverlapped=0x0) returned 1 [0074.123] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.123] CloseHandle (hObject=0x1d0) returned 1 [0074.123] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif.bd")) returned 1 [0074.124] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9e59c6b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02116_.GIF", cAlternateFileName="")) returned 1 [0074.124] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.124] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB02116_.GIF") returned -1 [0074.124] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02116_.GIF") returned -1 [0074.124] lstrcmpiA (lpString1="", lpString2="WB02116_.GIF") returned -1 [0074.124] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned="WB02106_.GIF" [0074.124] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0074.124] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0074.124] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0074.124] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0074.124] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02116_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" [0074.124] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.zip") returned 0 [0074.124] lstrlenA (lpString="*.zip") returned 5 [0074.124] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.rar") returned 0 [0074.124] lstrlenA (lpString="*.rar") returned 5 [0074.124] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.7z") returned 0 [0074.124] lstrlenA (lpString="*.7z") returned 4 [0074.124] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.tar") returned 0 [0074.124] lstrlenA (lpString="*.tar") returned 5 [0074.124] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.gzip") returned 0 [0074.124] lstrlenA (lpString="*.gzip") returned 6 [0074.124] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.jpg") returned 0 [0074.125] lstrlenA (lpString="*.jpg") returned 5 [0074.125] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.jpeg") returned 0 [0074.125] lstrlenA (lpString="*.jpeg") returned 6 [0074.125] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.psd") returned 0 [0074.125] lstrlenA (lpString="*.psd") returned 5 [0074.125] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.cdr") returned 0 [0074.125] lstrlenA (lpString="*.cdr") returned 5 [0074.125] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.dwg") returned 0 [0074.125] lstrlenA (lpString="*.dwg") returned 5 [0074.125] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.max") returned 0 [0074.125] lstrlenA (lpString="*.max") returned 5 [0074.125] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.bmp") returned 0 [0074.125] lstrlenA (lpString="*.bmp") returned 5 [0074.125] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.gif") returned 1 [0074.125] lstrlenA (lpString="*.gif") returned 5 [0074.125] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" [0074.125] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" [0074.125] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF." [0074.125] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.BD" [0074.125] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.125] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ef [0074.125] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9e59c6b, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0074.126] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.126] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x393, lpOverlapped=0x0) returned 1 [0074.127] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned="WB02116_.GIF" [0074.127] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.127] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x393, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x393, lpOverlapped=0x0) returned 1 [0074.127] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.127] CloseHandle (hObject=0x1d0) returned 1 [0074.127] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif.bd")) returned 1 [0074.128] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbdc0f51, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x97f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02134_.GIF", cAlternateFileName="")) returned 1 [0074.128] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.128] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB02134_.GIF") returned -1 [0074.128] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02134_.GIF") returned -1 [0074.128] lstrcmpiA (lpString1="", lpString2="WB02134_.GIF") returned -1 [0074.128] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned="WB02116_.GIF" [0074.128] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0074.128] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0074.128] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0074.128] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0074.129] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02134_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" [0074.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.zip") returned 0 [0074.129] lstrlenA (lpString="*.zip") returned 5 [0074.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.rar") returned 0 [0074.129] lstrlenA (lpString="*.rar") returned 5 [0074.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.7z") returned 0 [0074.129] lstrlenA (lpString="*.7z") returned 4 [0074.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.tar") returned 0 [0074.129] lstrlenA (lpString="*.tar") returned 5 [0074.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.gzip") returned 0 [0074.129] lstrlenA (lpString="*.gzip") returned 6 [0074.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.jpg") returned 0 [0074.129] lstrlenA (lpString="*.jpg") returned 5 [0074.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.jpeg") returned 0 [0074.129] lstrlenA (lpString="*.jpeg") returned 6 [0074.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.psd") returned 0 [0074.129] lstrlenA (lpString="*.psd") returned 5 [0074.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.cdr") returned 0 [0074.129] lstrlenA (lpString="*.cdr") returned 5 [0074.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.dwg") returned 0 [0074.129] lstrlenA (lpString="*.dwg") returned 5 [0074.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.max") returned 0 [0074.129] lstrlenA (lpString="*.max") returned 5 [0074.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.bmp") returned 0 [0074.129] lstrlenA (lpString="*.bmp") returned 5 [0074.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.gif") returned 1 [0074.129] lstrlenA (lpString="*.gif") returned 5 [0074.129] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" [0074.129] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" [0074.129] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF." [0074.130] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.BD" [0074.130] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.130] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x97f [0074.130] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbdc0f51, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0074.130] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.130] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x923, lpOverlapped=0x0) returned 1 [0074.131] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned="WB02134_.GIF" [0074.131] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.131] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x923, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x923, lpOverlapped=0x0) returned 1 [0074.132] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.132] CloseHandle (hObject=0x1d0) returned 1 [0074.132] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif.bd")) returned 1 [0074.132] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbdc5d6f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x579, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02187_.GIF", cAlternateFileName="")) returned 1 [0074.132] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.132] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB02187_.GIF") returned -1 [0074.132] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02187_.GIF") returned -1 [0074.132] lstrcmpiA (lpString1="", lpString2="WB02187_.GIF") returned -1 [0074.132] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned="WB02134_.GIF" [0074.132] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0074.132] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0074.133] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0074.133] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0074.133] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02187_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" [0074.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.zip") returned 0 [0074.133] lstrlenA (lpString="*.zip") returned 5 [0074.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.rar") returned 0 [0074.133] lstrlenA (lpString="*.rar") returned 5 [0074.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.7z") returned 0 [0074.133] lstrlenA (lpString="*.7z") returned 4 [0074.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.tar") returned 0 [0074.133] lstrlenA (lpString="*.tar") returned 5 [0074.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.gzip") returned 0 [0074.133] lstrlenA (lpString="*.gzip") returned 6 [0074.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.jpg") returned 0 [0074.133] lstrlenA (lpString="*.jpg") returned 5 [0074.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.jpeg") returned 0 [0074.133] lstrlenA (lpString="*.jpeg") returned 6 [0074.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.psd") returned 0 [0074.133] lstrlenA (lpString="*.psd") returned 5 [0074.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.cdr") returned 0 [0074.133] lstrlenA (lpString="*.cdr") returned 5 [0074.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.dwg") returned 0 [0074.133] lstrlenA (lpString="*.dwg") returned 5 [0074.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.max") returned 0 [0074.133] lstrlenA (lpString="*.max") returned 5 [0074.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.bmp") returned 0 [0074.133] lstrlenA (lpString="*.bmp") returned 5 [0074.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.gif") returned 1 [0074.133] lstrlenA (lpString="*.gif") returned 5 [0074.133] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" [0074.133] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" [0074.134] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF." [0074.134] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.BD" [0074.134] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.134] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x579 [0074.134] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbdc5d6f, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0074.134] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.134] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x51d, lpOverlapped=0x0) returned 1 [0074.135] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned="WB02187_.GIF" [0074.135] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.135] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x51d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x51d, lpOverlapped=0x0) returned 1 [0074.136] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.136] CloseHandle (hObject=0x1d0) returned 1 [0074.136] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif.bd")) returned 1 [0074.136] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbdce68f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4abc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02198_.GIF", cAlternateFileName="")) returned 1 [0074.136] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.136] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB02198_.GIF") returned -1 [0074.136] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02198_.GIF") returned -1 [0074.136] lstrcmpiA (lpString1="", lpString2="WB02198_.GIF") returned -1 [0074.136] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned="WB02187_.GIF" [0074.137] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0074.137] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0074.137] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0074.137] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0074.137] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02198_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" [0074.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.zip") returned 0 [0074.137] lstrlenA (lpString="*.zip") returned 5 [0074.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.rar") returned 0 [0074.137] lstrlenA (lpString="*.rar") returned 5 [0074.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.7z") returned 0 [0074.137] lstrlenA (lpString="*.7z") returned 4 [0074.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.tar") returned 0 [0074.137] lstrlenA (lpString="*.tar") returned 5 [0074.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.gzip") returned 0 [0074.137] lstrlenA (lpString="*.gzip") returned 6 [0074.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.jpg") returned 0 [0074.137] lstrlenA (lpString="*.jpg") returned 5 [0074.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.jpeg") returned 0 [0074.137] lstrlenA (lpString="*.jpeg") returned 6 [0074.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.psd") returned 0 [0074.137] lstrlenA (lpString="*.psd") returned 5 [0074.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.cdr") returned 0 [0074.137] lstrlenA (lpString="*.cdr") returned 5 [0074.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.dwg") returned 0 [0074.137] lstrlenA (lpString="*.dwg") returned 5 [0074.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.max") returned 0 [0074.137] lstrlenA (lpString="*.max") returned 5 [0074.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.bmp") returned 0 [0074.137] lstrlenA (lpString="*.bmp") returned 5 [0074.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.gif") returned 1 [0074.138] lstrlenA (lpString="*.gif") returned 5 [0074.138] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" [0074.138] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" [0074.138] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF." [0074.138] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.BD" [0074.138] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.138] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4abc [0074.139] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbdce68f, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0074.139] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.139] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x4a60, lpOverlapped=0x0) returned 1 [0074.140] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned="WB02198_.GIF" [0074.141] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.141] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x4a60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x4a60, lpOverlapped=0x0) returned 1 [0074.141] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.141] CloseHandle (hObject=0x1d0) returned 1 [0074.141] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif.bd")) returned 1 [0074.141] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9e5fe4f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1653, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02201_.GIF", cAlternateFileName="")) returned 1 [0074.141] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.142] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB02201_.GIF") returned -1 [0074.142] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02201_.GIF") returned -1 [0074.142] lstrcmpiA (lpString1="", lpString2="WB02201_.GIF") returned -1 [0074.142] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned="WB02198_.GIF" [0074.142] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0074.142] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0074.142] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0074.142] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0074.142] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02201_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" [0074.142] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.zip") returned 0 [0074.142] lstrlenA (lpString="*.zip") returned 5 [0074.142] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.rar") returned 0 [0074.142] lstrlenA (lpString="*.rar") returned 5 [0074.142] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.7z") returned 0 [0074.142] lstrlenA (lpString="*.7z") returned 4 [0074.142] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.tar") returned 0 [0074.142] lstrlenA (lpString="*.tar") returned 5 [0074.142] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.gzip") returned 0 [0074.142] lstrlenA (lpString="*.gzip") returned 6 [0074.142] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.jpg") returned 0 [0074.142] lstrlenA (lpString="*.jpg") returned 5 [0074.142] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.jpeg") returned 0 [0074.142] lstrlenA (lpString="*.jpeg") returned 6 [0074.142] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.psd") returned 0 [0074.142] lstrlenA (lpString="*.psd") returned 5 [0074.142] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.cdr") returned 0 [0074.142] lstrlenA (lpString="*.cdr") returned 5 [0074.142] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.dwg") returned 0 [0074.142] lstrlenA (lpString="*.dwg") returned 5 [0074.142] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.max") returned 0 [0074.143] lstrlenA (lpString="*.max") returned 5 [0074.143] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.bmp") returned 0 [0074.143] lstrlenA (lpString="*.bmp") returned 5 [0074.143] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.gif") returned 1 [0074.143] lstrlenA (lpString="*.gif") returned 5 [0074.143] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" [0074.143] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" [0074.143] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF." [0074.143] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.BD" [0074.143] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.143] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1653 [0074.143] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9e5fe4f, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0074.143] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.143] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x15f7, lpOverlapped=0x0) returned 1 [0074.145] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned="WB02201_.GIF" [0074.145] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.145] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x15f7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x15f7, lpOverlapped=0x0) returned 1 [0074.145] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.145] CloseHandle (hObject=0x1d0) returned 1 [0074.145] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif.bd")) returned 1 [0074.146] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcbdd346b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x136b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02214_.GIF", cAlternateFileName="")) returned 1 [0074.146] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.146] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB02214_.GIF") returned -1 [0074.146] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02214_.GIF") returned -1 [0074.146] lstrcmpiA (lpString1="", lpString2="WB02214_.GIF") returned -1 [0074.146] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned="WB02201_.GIF" [0074.146] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0074.146] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0074.146] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0074.146] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0074.146] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02214_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" [0074.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.zip") returned 0 [0074.146] lstrlenA (lpString="*.zip") returned 5 [0074.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.rar") returned 0 [0074.146] lstrlenA (lpString="*.rar") returned 5 [0074.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.7z") returned 0 [0074.146] lstrlenA (lpString="*.7z") returned 4 [0074.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.tar") returned 0 [0074.146] lstrlenA (lpString="*.tar") returned 5 [0074.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.gzip") returned 0 [0074.147] lstrlenA (lpString="*.gzip") returned 6 [0074.147] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.jpg") returned 0 [0074.147] lstrlenA (lpString="*.jpg") returned 5 [0074.147] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.jpeg") returned 0 [0074.147] lstrlenA (lpString="*.jpeg") returned 6 [0074.147] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.psd") returned 0 [0074.147] lstrlenA (lpString="*.psd") returned 5 [0074.147] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.cdr") returned 0 [0074.147] lstrlenA (lpString="*.cdr") returned 5 [0074.147] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.dwg") returned 0 [0074.147] lstrlenA (lpString="*.dwg") returned 5 [0074.147] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.max") returned 0 [0074.147] lstrlenA (lpString="*.max") returned 5 [0074.147] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.bmp") returned 0 [0074.147] lstrlenA (lpString="*.bmp") returned 5 [0074.147] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.gif") returned 1 [0074.147] lstrlenA (lpString="*.gif") returned 5 [0074.147] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" [0074.147] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" [0074.147] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF." [0074.147] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.BD" [0074.147] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.147] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x136b [0074.147] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbdd346b, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0074.147] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.148] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x130f, lpOverlapped=0x0) returned 1 [0074.149] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned="WB02214_.GIF" [0074.149] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.149] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x130f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x130f, lpOverlapped=0x0) returned 1 [0074.149] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.149] CloseHandle (hObject=0x1d0) returned 1 [0074.150] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif.bd")) returned 1 [0074.150] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9e65ff3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02218_.GIF", cAlternateFileName="")) returned 1 [0074.150] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.150] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WB02218_.GIF") returned -1 [0074.150] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02218_.GIF") returned -1 [0074.150] lstrcmpiA (lpString1="", lpString2="WB02218_.GIF") returned -1 [0074.150] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned="WB02214_.GIF" [0074.150] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0074.150] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="" [0074.150] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" [0074.150] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20 [0074.151] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02218_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" [0074.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.zip") returned 0 [0074.151] lstrlenA (lpString="*.zip") returned 5 [0074.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.rar") returned 0 [0074.151] lstrlenA (lpString="*.rar") returned 5 [0074.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.7z") returned 0 [0074.151] lstrlenA (lpString="*.7z") returned 4 [0074.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.tar") returned 0 [0074.151] lstrlenA (lpString="*.tar") returned 5 [0074.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.gzip") returned 0 [0074.151] lstrlenA (lpString="*.gzip") returned 6 [0074.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.jpg") returned 0 [0074.151] lstrlenA (lpString="*.jpg") returned 5 [0074.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.jpeg") returned 0 [0074.151] lstrlenA (lpString="*.jpeg") returned 6 [0074.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.psd") returned 0 [0074.151] lstrlenA (lpString="*.psd") returned 5 [0074.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.cdr") returned 0 [0074.151] lstrlenA (lpString="*.cdr") returned 5 [0074.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.dwg") returned 0 [0074.151] lstrlenA (lpString="*.dwg") returned 5 [0074.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.max") returned 0 [0074.151] lstrlenA (lpString="*.max") returned 5 [0074.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.bmp") returned 0 [0074.151] lstrlenA (lpString="*.bmp") returned 5 [0074.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.gif") returned 1 [0074.151] lstrlenA (lpString="*.gif") returned 5 [0074.151] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" [0074.151] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" [0074.151] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF." [0074.151] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.", lpString2="BD" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.BD") returned="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.BD" [0074.151] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.152] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbc4 [0074.152] GetFileTime (in: hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0xb9e65ff3, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c1e1100, dwHighDateTime=0x1d0ca66)) returned 1 [0074.152] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.152] ReadFile (in: hFile=0x1d0, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0xb68, lpOverlapped=0x0) returned 1 [0074.153] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned="WB02218_.GIF" [0074.153] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.153] WriteFile (in: hFile=0x1d0, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0xb68, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0xb68, lpOverlapped=0x0) returned 1 [0074.154] SetFileTime (hFile=0x1d0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.154] CloseHandle (hObject=0x1d0) returned 1 [0074.154] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif.bd")) returned 1 [0074.154] FindNextFileA (in: hFindFile=0x6365b0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9e65ff3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02218_.GIF", cAlternateFileName="")) returned 0 [0074.154] FindClose (in: hFindFile=0x6365b0 | out: hFindFile=0x6365b0) returned 1 [0074.154] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadf39748, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0xcbdd346b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xcbdd346b, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0 [0074.154] FindClose (in: hFindFile=0x636970 | out: hFindFile=0x636970) returned 1 [0074.154] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadf383a4, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0xadf39748, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xadf39748, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0074.155] FindClose (in: hFindFile=0x6366f0 | out: hFindFile=0x6366f0) returned 1 [0074.155] FindNextFileA (in: hFindFile=0x636930, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9581407, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0xcab38f98, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xcab38f98, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Themes 16", cAlternateFileName="DOCUME~1")) returned 1 [0074.155] lstrcmpA (lpString1=".", lpString2="Document Themes 16") returned -1 [0074.155] lstrcmpA (lpString1="..", lpString2="Document Themes 16") returned -1 [0074.155] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\*.*") returned="*.*" [0074.155] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\", lpString2="Document Themes 16" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16" [0074.155] lstrlenA (lpString="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16") returned 58 [0074.155] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\*.*" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\*.*"), lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9581407, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0xcab38f98, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xcab38f98, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName=".", cAlternateFileName="")) returned 0x636ab0 [0074.157] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.157] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9581407, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0xcab38f98, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xcab38f98, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="..", cAlternateFileName="")) returned 1 [0074.157] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.157] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.157] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaca40b47, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb447d, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="Facet.thmx", cAlternateFileName="FACET~1.THM")) returned 1 [0074.157] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0074.157] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Facet.thmx") returned -1 [0074.157] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Facet.thmx") returned 1 [0074.157] lstrcmpiA (lpString1="", lpString2="Facet.thmx") returned -1 [0074.157] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\*.*") returned="*.*" [0074.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\" [0074.157] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\") returned="" [0074.157] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\HOW TO DECRYPT FILES.txt" [0074.157] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\how to decrypt files.txt")) returned 0xffffffff [0074.157] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0074.158] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0074.158] WriteFile (in: hFile=0x1c8, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0074.159] SetFileTime (hFile=0x1c8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.159] CloseHandle (hObject=0x1c8) returned 1 [0074.159] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\", lpString2="Facet.thmx" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx" [0074.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.zip") returned 0 [0074.159] lstrlenA (lpString="*.zip") returned 5 [0074.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.rar") returned 0 [0074.159] lstrlenA (lpString="*.rar") returned 5 [0074.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.7z") returned 0 [0074.159] lstrlenA (lpString="*.7z") returned 4 [0074.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.tar") returned 0 [0074.159] lstrlenA (lpString="*.tar") returned 5 [0074.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.gzip") returned 0 [0074.159] lstrlenA (lpString="*.gzip") returned 6 [0074.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.jpg") returned 0 [0074.160] lstrlenA (lpString="*.jpg") returned 5 [0074.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.jpeg") returned 0 [0074.160] lstrlenA (lpString="*.jpeg") returned 6 [0074.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.psd") returned 0 [0074.160] lstrlenA (lpString="*.psd") returned 5 [0074.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.cdr") returned 0 [0074.160] lstrlenA (lpString="*.cdr") returned 5 [0074.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.dwg") returned 0 [0074.160] lstrlenA (lpString="*.dwg") returned 5 [0074.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.max") returned 0 [0074.160] lstrlenA (lpString="*.max") returned 5 [0074.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.bmp") returned 0 [0074.160] lstrlenA (lpString="*.bmp") returned 5 [0074.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.gif") returned 0 [0074.160] lstrlenA (lpString="*.gif") returned 5 [0074.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.png") returned 0 [0074.160] lstrlenA (lpString="*.png") returned 5 [0074.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.doc") returned 0 [0074.160] lstrlenA (lpString="*.doc") returned 5 [0074.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.docx") returned 0 [0074.160] lstrlenA (lpString="*.docx") returned 6 [0074.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.xls") returned 0 [0074.160] lstrlenA (lpString="*.xls") returned 5 [0074.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.xlsx") returned 0 [0074.160] lstrlenA (lpString="*.xlsx") returned 6 [0074.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.ppt") returned 0 [0074.160] lstrlenA (lpString="*.ppt") returned 5 [0074.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.pptx") returned 0 [0074.160] lstrlenA (lpString="*.pptx") returned 6 [0074.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.txt") returned 0 [0074.160] lstrlenA (lpString="*.txt") returned 5 [0074.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.pdf") returned 0 [0074.160] lstrlenA (lpString="*.pdf") returned 5 [0074.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.djvu") returned 0 [0074.161] lstrlenA (lpString="*.djvu") returned 6 [0074.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.htm") returned 0 [0074.161] lstrlenA (lpString="*.htm") returned 5 [0074.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.html") returned 0 [0074.161] lstrlenA (lpString="*.html") returned 6 [0074.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.mdb") returned 0 [0074.161] lstrlenA (lpString="*.mdb") returned 5 [0074.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.cer") returned 0 [0074.161] lstrlenA (lpString="*.cer") returned 5 [0074.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.p12") returned 0 [0074.161] lstrlenA (lpString="*.p12") returned 5 [0074.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.pfx") returned 0 [0074.161] lstrlenA (lpString="*.pfx") returned 5 [0074.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.kwm") returned 0 [0074.161] lstrlenA (lpString="*.kwm") returned 5 [0074.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.pwm") returned 0 [0074.161] lstrlenA (lpString="*.pwm") returned 5 [0074.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.1cd") returned 0 [0074.161] lstrlenA (lpString="*.1cd") returned 5 [0074.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.md") returned 0 [0074.161] lstrlenA (lpString="*.md") returned 4 [0074.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.mdf") returned 0 [0074.161] lstrlenA (lpString="*.mdf") returned 5 [0074.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.dbf") returned 0 [0074.161] lstrlenA (lpString="*.dbf") returned 5 [0074.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.odt") returned 0 [0074.161] lstrlenA (lpString="*.odt") returned 5 [0074.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.vob") returned 0 [0074.161] lstrlenA (lpString="*.vob") returned 5 [0074.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.ifo") returned 0 [0074.161] lstrlenA (lpString="*.ifo") returned 5 [0074.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.lnk") returned 0 [0074.161] lstrlenA (lpString="*.lnk") returned 5 [0074.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.torrent") returned 0 [0074.161] lstrlenA (lpString="*.torrent") returned 9 [0074.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.mov") returned 0 [0074.162] lstrlenA (lpString="*.mov") returned 5 [0074.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.m2v") returned 0 [0074.162] lstrlenA (lpString="*.m2v") returned 5 [0074.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.3gp") returned 0 [0074.162] lstrlenA (lpString="*.3gp") returned 5 [0074.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.mpeg") returned 0 [0074.162] lstrlenA (lpString="*.mpeg") returned 6 [0074.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.mpg") returned 0 [0074.162] lstrlenA (lpString="*.mpg") returned 5 [0074.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.flv") returned 0 [0074.162] lstrlenA (lpString="*.flv") returned 5 [0074.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.avi") returned 0 [0074.162] lstrlenA (lpString="*.avi") returned 5 [0074.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.mp4") returned 0 [0074.162] lstrlenA (lpString="*.mp4") returned 5 [0074.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.wmv") returned 0 [0074.162] lstrlenA (lpString="*.wmv") returned 5 [0074.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.divx") returned 0 [0074.162] lstrlenA (lpString="*.divx") returned 6 [0074.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.mkv") returned 0 [0074.162] lstrlenA (lpString="*.mkv") returned 5 [0074.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.mp3") returned 0 [0074.162] lstrlenA (lpString="*.mp3") returned 5 [0074.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.wav") returned 0 [0074.162] lstrlenA (lpString="*.wav") returned 5 [0074.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.flac") returned 0 [0074.162] lstrlenA (lpString="*.flac") returned 6 [0074.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.ape") returned 0 [0074.162] lstrlenA (lpString="*.ape") returned 5 [0074.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.wma") returned 0 [0074.162] lstrlenA (lpString="*.wma") returned 5 [0074.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx", pszSpec="*.ac3") returned 0 [0074.162] lstrlenA (lpString="*.ac3") returned 5 [0074.162] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc2fe7650, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3495ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Integral.thmx", cAlternateFileName="INTEGR~1.THM")) returned 1 [0074.163] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0074.163] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Integral.thmx") returned -1 [0074.163] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Integral.thmx") returned -1 [0074.163] lstrcmpiA (lpString1="", lpString2="Integral.thmx") returned -1 [0074.163] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Facet.thmx") returned="Facet.thmx" [0074.163] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\" [0074.163] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\") returned="" [0074.163] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\HOW TO DECRYPT FILES.txt" [0074.163] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\how to decrypt files.txt")) returned 0x20 [0074.163] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\", lpString2="Integral.thmx" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx" [0074.163] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.zip") returned 0 [0074.163] lstrlenA (lpString="*.zip") returned 5 [0074.163] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.rar") returned 0 [0074.163] lstrlenA (lpString="*.rar") returned 5 [0074.163] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.7z") returned 0 [0074.163] lstrlenA (lpString="*.7z") returned 4 [0074.163] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.tar") returned 0 [0074.163] lstrlenA (lpString="*.tar") returned 5 [0074.163] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.gzip") returned 0 [0074.163] lstrlenA (lpString="*.gzip") returned 6 [0074.163] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.jpg") returned 0 [0074.163] lstrlenA (lpString="*.jpg") returned 5 [0074.163] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.jpeg") returned 0 [0074.163] lstrlenA (lpString="*.jpeg") returned 6 [0074.163] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.psd") returned 0 [0074.163] lstrlenA (lpString="*.psd") returned 5 [0074.163] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.cdr") returned 0 [0074.163] lstrlenA (lpString="*.cdr") returned 5 [0074.163] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.dwg") returned 0 [0074.163] lstrlenA (lpString="*.dwg") returned 5 [0074.163] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.max") returned 0 [0074.163] lstrlenA (lpString="*.max") returned 5 [0074.164] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.bmp") returned 0 [0074.164] lstrlenA (lpString="*.bmp") returned 5 [0074.164] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.gif") returned 0 [0074.164] lstrlenA (lpString="*.gif") returned 5 [0074.164] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.png") returned 0 [0074.164] lstrlenA (lpString="*.png") returned 5 [0074.164] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.doc") returned 0 [0074.164] lstrlenA (lpString="*.doc") returned 5 [0074.164] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.docx") returned 0 [0074.164] lstrlenA (lpString="*.docx") returned 6 [0074.164] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.xls") returned 0 [0074.164] lstrlenA (lpString="*.xls") returned 5 [0074.164] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.xlsx") returned 0 [0074.164] lstrlenA (lpString="*.xlsx") returned 6 [0074.164] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.ppt") returned 0 [0074.164] lstrlenA (lpString="*.ppt") returned 5 [0074.164] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.pptx") returned 0 [0074.164] lstrlenA (lpString="*.pptx") returned 6 [0074.164] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.txt") returned 0 [0074.164] lstrlenA (lpString="*.txt") returned 5 [0074.164] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.pdf") returned 0 [0074.164] lstrlenA (lpString="*.pdf") returned 5 [0074.164] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.djvu") returned 0 [0074.164] lstrlenA (lpString="*.djvu") returned 6 [0074.164] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.htm") returned 0 [0074.164] lstrlenA (lpString="*.htm") returned 5 [0074.164] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.html") returned 0 [0074.164] lstrlenA (lpString="*.html") returned 6 [0074.164] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.mdb") returned 0 [0074.164] lstrlenA (lpString="*.mdb") returned 5 [0074.164] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.cer") returned 0 [0074.164] lstrlenA (lpString="*.cer") returned 5 [0074.164] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.p12") returned 0 [0074.164] lstrlenA (lpString="*.p12") returned 5 [0074.164] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.pfx") returned 0 [0074.165] lstrlenA (lpString="*.pfx") returned 5 [0074.165] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.kwm") returned 0 [0074.165] lstrlenA (lpString="*.kwm") returned 5 [0074.165] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.pwm") returned 0 [0074.165] lstrlenA (lpString="*.pwm") returned 5 [0074.165] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.1cd") returned 0 [0074.165] lstrlenA (lpString="*.1cd") returned 5 [0074.165] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.md") returned 0 [0074.165] lstrlenA (lpString="*.md") returned 4 [0074.165] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.mdf") returned 0 [0074.165] lstrlenA (lpString="*.mdf") returned 5 [0074.165] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.dbf") returned 0 [0074.165] lstrlenA (lpString="*.dbf") returned 5 [0074.165] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.odt") returned 0 [0074.165] lstrlenA (lpString="*.odt") returned 5 [0074.165] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.vob") returned 0 [0074.165] lstrlenA (lpString="*.vob") returned 5 [0074.165] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.ifo") returned 0 [0074.165] lstrlenA (lpString="*.ifo") returned 5 [0074.165] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.lnk") returned 0 [0074.165] lstrlenA (lpString="*.lnk") returned 5 [0074.165] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.torrent") returned 0 [0074.165] lstrlenA (lpString="*.torrent") returned 9 [0074.165] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.mov") returned 0 [0074.165] lstrlenA (lpString="*.mov") returned 5 [0074.165] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.m2v") returned 0 [0074.165] lstrlenA (lpString="*.m2v") returned 5 [0074.165] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.3gp") returned 0 [0074.165] lstrlenA (lpString="*.3gp") returned 5 [0074.165] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.mpeg") returned 0 [0074.165] lstrlenA (lpString="*.mpeg") returned 6 [0074.165] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.mpg") returned 0 [0074.165] lstrlenA (lpString="*.mpg") returned 5 [0074.166] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.flv") returned 0 [0074.166] lstrlenA (lpString="*.flv") returned 5 [0074.166] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.avi") returned 0 [0074.166] lstrlenA (lpString="*.avi") returned 5 [0074.166] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.mp4") returned 0 [0074.166] lstrlenA (lpString="*.mp4") returned 5 [0074.166] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.wmv") returned 0 [0074.166] lstrlenA (lpString="*.wmv") returned 5 [0074.166] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.divx") returned 0 [0074.166] lstrlenA (lpString="*.divx") returned 6 [0074.166] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.mkv") returned 0 [0074.166] lstrlenA (lpString="*.mkv") returned 5 [0074.166] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.mp3") returned 0 [0074.166] lstrlenA (lpString="*.mp3") returned 5 [0074.166] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.wav") returned 0 [0074.166] lstrlenA (lpString="*.wav") returned 5 [0074.166] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.flac") returned 0 [0074.166] lstrlenA (lpString="*.flac") returned 6 [0074.166] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.ape") returned 0 [0074.166] lstrlenA (lpString="*.ape") returned 5 [0074.166] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.wma") returned 0 [0074.166] lstrlenA (lpString="*.wma") returned 5 [0074.166] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx", pszSpec="*.ac3") returned 0 [0074.166] lstrlenA (lpString="*.ac3") returned 5 [0074.166] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadc1ffd6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1855eb, dwReserved0=0x74, dwReserved1=0x0, cFileName="Ion Boardroom.thmx", cAlternateFileName="IONBOA~1.THM")) returned 1 [0074.166] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0074.166] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Ion Boardroom.thmx") returned -1 [0074.166] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Ion Boardroom.thmx") returned -1 [0074.166] lstrcmpiA (lpString1="", lpString2="Ion Boardroom.thmx") returned -1 [0074.166] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Integral.thmx") returned="Integral.thmx" [0074.166] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\" [0074.166] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\") returned="" [0074.166] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\HOW TO DECRYPT FILES.txt" [0074.167] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\how to decrypt files.txt")) returned 0x20 [0074.167] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\", lpString2="Ion Boardroom.thmx" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx" [0074.167] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.zip") returned 0 [0074.167] lstrlenA (lpString="*.zip") returned 5 [0074.167] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.rar") returned 0 [0074.167] lstrlenA (lpString="*.rar") returned 5 [0074.167] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.7z") returned 0 [0074.167] lstrlenA (lpString="*.7z") returned 4 [0074.167] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.tar") returned 0 [0074.167] lstrlenA (lpString="*.tar") returned 5 [0074.167] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.gzip") returned 0 [0074.167] lstrlenA (lpString="*.gzip") returned 6 [0074.167] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.jpg") returned 0 [0074.167] lstrlenA (lpString="*.jpg") returned 5 [0074.167] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.jpeg") returned 0 [0074.167] lstrlenA (lpString="*.jpeg") returned 6 [0074.167] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.psd") returned 0 [0074.167] lstrlenA (lpString="*.psd") returned 5 [0074.167] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.cdr") returned 0 [0074.167] lstrlenA (lpString="*.cdr") returned 5 [0074.167] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.dwg") returned 0 [0074.167] lstrlenA (lpString="*.dwg") returned 5 [0074.167] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.max") returned 0 [0074.167] lstrlenA (lpString="*.max") returned 5 [0074.167] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.bmp") returned 0 [0074.167] lstrlenA (lpString="*.bmp") returned 5 [0074.167] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.gif") returned 0 [0074.167] lstrlenA (lpString="*.gif") returned 5 [0074.167] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.png") returned 0 [0074.167] lstrlenA (lpString="*.png") returned 5 [0074.167] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.doc") returned 0 [0074.167] lstrlenA (lpString="*.doc") returned 5 [0074.168] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.docx") returned 0 [0074.168] lstrlenA (lpString="*.docx") returned 6 [0074.168] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.xls") returned 0 [0074.168] lstrlenA (lpString="*.xls") returned 5 [0074.168] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.xlsx") returned 0 [0074.168] lstrlenA (lpString="*.xlsx") returned 6 [0074.168] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.ppt") returned 0 [0074.168] lstrlenA (lpString="*.ppt") returned 5 [0074.168] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.pptx") returned 0 [0074.168] lstrlenA (lpString="*.pptx") returned 6 [0074.168] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.txt") returned 0 [0074.168] lstrlenA (lpString="*.txt") returned 5 [0074.168] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.pdf") returned 0 [0074.168] lstrlenA (lpString="*.pdf") returned 5 [0074.168] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.djvu") returned 0 [0074.168] lstrlenA (lpString="*.djvu") returned 6 [0074.168] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.htm") returned 0 [0074.168] lstrlenA (lpString="*.htm") returned 5 [0074.168] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.html") returned 0 [0074.168] lstrlenA (lpString="*.html") returned 6 [0074.168] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.mdb") returned 0 [0074.168] lstrlenA (lpString="*.mdb") returned 5 [0074.168] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.cer") returned 0 [0074.168] lstrlenA (lpString="*.cer") returned 5 [0074.168] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.p12") returned 0 [0074.168] lstrlenA (lpString="*.p12") returned 5 [0074.168] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.pfx") returned 0 [0074.168] lstrlenA (lpString="*.pfx") returned 5 [0074.168] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.kwm") returned 0 [0074.168] lstrlenA (lpString="*.kwm") returned 5 [0074.168] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.pwm") returned 0 [0074.168] lstrlenA (lpString="*.pwm") returned 5 [0074.168] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.1cd") returned 0 [0074.168] lstrlenA (lpString="*.1cd") returned 5 [0074.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.md") returned 0 [0074.169] lstrlenA (lpString="*.md") returned 4 [0074.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.mdf") returned 0 [0074.169] lstrlenA (lpString="*.mdf") returned 5 [0074.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.dbf") returned 0 [0074.169] lstrlenA (lpString="*.dbf") returned 5 [0074.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.odt") returned 0 [0074.169] lstrlenA (lpString="*.odt") returned 5 [0074.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.vob") returned 0 [0074.169] lstrlenA (lpString="*.vob") returned 5 [0074.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.ifo") returned 0 [0074.169] lstrlenA (lpString="*.ifo") returned 5 [0074.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.lnk") returned 0 [0074.169] lstrlenA (lpString="*.lnk") returned 5 [0074.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.torrent") returned 0 [0074.169] lstrlenA (lpString="*.torrent") returned 9 [0074.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.mov") returned 0 [0074.169] lstrlenA (lpString="*.mov") returned 5 [0074.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.m2v") returned 0 [0074.169] lstrlenA (lpString="*.m2v") returned 5 [0074.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.3gp") returned 0 [0074.169] lstrlenA (lpString="*.3gp") returned 5 [0074.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.mpeg") returned 0 [0074.169] lstrlenA (lpString="*.mpeg") returned 6 [0074.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.mpg") returned 0 [0074.169] lstrlenA (lpString="*.mpg") returned 5 [0074.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.flv") returned 0 [0074.169] lstrlenA (lpString="*.flv") returned 5 [0074.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.avi") returned 0 [0074.169] lstrlenA (lpString="*.avi") returned 5 [0074.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.mp4") returned 0 [0074.169] lstrlenA (lpString="*.mp4") returned 5 [0074.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.wmv") returned 0 [0074.169] lstrlenA (lpString="*.wmv") returned 5 [0074.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.divx") returned 0 [0074.170] lstrlenA (lpString="*.divx") returned 6 [0074.170] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.mkv") returned 0 [0074.170] lstrlenA (lpString="*.mkv") returned 5 [0074.170] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.mp3") returned 0 [0074.170] lstrlenA (lpString="*.mp3") returned 5 [0074.170] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.wav") returned 0 [0074.170] lstrlenA (lpString="*.wav") returned 5 [0074.170] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.flac") returned 0 [0074.170] lstrlenA (lpString="*.flac") returned 6 [0074.170] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.ape") returned 0 [0074.170] lstrlenA (lpString="*.ape") returned 5 [0074.170] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.wma") returned 0 [0074.170] lstrlenA (lpString="*.wma") returned 5 [0074.170] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.ac3") returned 0 [0074.170] lstrlenA (lpString="*.ac3") returned 5 [0074.170] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc30e06f1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1c09db, dwReserved0=0x74, dwReserved1=0x0, cFileName="Ion.thmx", cAlternateFileName="ION~1.THM")) returned 1 [0074.170] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0074.170] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Ion.thmx") returned -1 [0074.170] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Ion.thmx") returned -1 [0074.170] lstrcmpiA (lpString1="", lpString2="Ion.thmx") returned -1 [0074.170] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion Boardroom.thmx") returned="Ion Boardroom.thmx" [0074.170] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\" [0074.170] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\") returned="" [0074.170] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\HOW TO DECRYPT FILES.txt" [0074.170] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\how to decrypt files.txt")) returned 0x20 [0074.170] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\", lpString2="Ion.thmx" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx" [0074.170] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.zip") returned 0 [0074.170] lstrlenA (lpString="*.zip") returned 5 [0074.170] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.rar") returned 0 [0074.171] lstrlenA (lpString="*.rar") returned 5 [0074.171] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.7z") returned 0 [0074.171] lstrlenA (lpString="*.7z") returned 4 [0074.171] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.tar") returned 0 [0074.171] lstrlenA (lpString="*.tar") returned 5 [0074.171] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.gzip") returned 0 [0074.171] lstrlenA (lpString="*.gzip") returned 6 [0074.171] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.jpg") returned 0 [0074.171] lstrlenA (lpString="*.jpg") returned 5 [0074.171] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.jpeg") returned 0 [0074.171] lstrlenA (lpString="*.jpeg") returned 6 [0074.171] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.psd") returned 0 [0074.171] lstrlenA (lpString="*.psd") returned 5 [0074.171] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.cdr") returned 0 [0074.171] lstrlenA (lpString="*.cdr") returned 5 [0074.171] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.dwg") returned 0 [0074.171] lstrlenA (lpString="*.dwg") returned 5 [0074.171] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.max") returned 0 [0074.171] lstrlenA (lpString="*.max") returned 5 [0074.171] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.bmp") returned 0 [0074.171] lstrlenA (lpString="*.bmp") returned 5 [0074.171] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.gif") returned 0 [0074.171] lstrlenA (lpString="*.gif") returned 5 [0074.171] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.png") returned 0 [0074.171] lstrlenA (lpString="*.png") returned 5 [0074.171] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.doc") returned 0 [0074.171] lstrlenA (lpString="*.doc") returned 5 [0074.171] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.docx") returned 0 [0074.171] lstrlenA (lpString="*.docx") returned 6 [0074.171] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.xls") returned 0 [0074.171] lstrlenA (lpString="*.xls") returned 5 [0074.171] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.xlsx") returned 0 [0074.171] lstrlenA (lpString="*.xlsx") returned 6 [0074.171] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.ppt") returned 0 [0074.172] lstrlenA (lpString="*.ppt") returned 5 [0074.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.pptx") returned 0 [0074.172] lstrlenA (lpString="*.pptx") returned 6 [0074.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.txt") returned 0 [0074.172] lstrlenA (lpString="*.txt") returned 5 [0074.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.pdf") returned 0 [0074.172] lstrlenA (lpString="*.pdf") returned 5 [0074.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.djvu") returned 0 [0074.172] lstrlenA (lpString="*.djvu") returned 6 [0074.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.htm") returned 0 [0074.172] lstrlenA (lpString="*.htm") returned 5 [0074.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.html") returned 0 [0074.172] lstrlenA (lpString="*.html") returned 6 [0074.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.mdb") returned 0 [0074.172] lstrlenA (lpString="*.mdb") returned 5 [0074.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.cer") returned 0 [0074.172] lstrlenA (lpString="*.cer") returned 5 [0074.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.p12") returned 0 [0074.172] lstrlenA (lpString="*.p12") returned 5 [0074.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.pfx") returned 0 [0074.172] lstrlenA (lpString="*.pfx") returned 5 [0074.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.kwm") returned 0 [0074.172] lstrlenA (lpString="*.kwm") returned 5 [0074.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.pwm") returned 0 [0074.172] lstrlenA (lpString="*.pwm") returned 5 [0074.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.1cd") returned 0 [0074.172] lstrlenA (lpString="*.1cd") returned 5 [0074.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.md") returned 0 [0074.172] lstrlenA (lpString="*.md") returned 4 [0074.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.mdf") returned 0 [0074.172] lstrlenA (lpString="*.mdf") returned 5 [0074.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.dbf") returned 0 [0074.172] lstrlenA (lpString="*.dbf") returned 5 [0074.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.odt") returned 0 [0074.172] lstrlenA (lpString="*.odt") returned 5 [0074.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.vob") returned 0 [0074.173] lstrlenA (lpString="*.vob") returned 5 [0074.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.ifo") returned 0 [0074.173] lstrlenA (lpString="*.ifo") returned 5 [0074.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.lnk") returned 0 [0074.173] lstrlenA (lpString="*.lnk") returned 5 [0074.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.torrent") returned 0 [0074.173] lstrlenA (lpString="*.torrent") returned 9 [0074.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.mov") returned 0 [0074.173] lstrlenA (lpString="*.mov") returned 5 [0074.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.m2v") returned 0 [0074.173] lstrlenA (lpString="*.m2v") returned 5 [0074.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.3gp") returned 0 [0074.173] lstrlenA (lpString="*.3gp") returned 5 [0074.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.mpeg") returned 0 [0074.173] lstrlenA (lpString="*.mpeg") returned 6 [0074.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.mpg") returned 0 [0074.173] lstrlenA (lpString="*.mpg") returned 5 [0074.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.flv") returned 0 [0074.173] lstrlenA (lpString="*.flv") returned 5 [0074.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.avi") returned 0 [0074.173] lstrlenA (lpString="*.avi") returned 5 [0074.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.mp4") returned 0 [0074.173] lstrlenA (lpString="*.mp4") returned 5 [0074.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.wmv") returned 0 [0074.173] lstrlenA (lpString="*.wmv") returned 5 [0074.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.divx") returned 0 [0074.173] lstrlenA (lpString="*.divx") returned 6 [0074.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.mkv") returned 0 [0074.173] lstrlenA (lpString="*.mkv") returned 5 [0074.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.mp3") returned 0 [0074.173] lstrlenA (lpString="*.mp3") returned 5 [0074.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.wav") returned 0 [0074.173] lstrlenA (lpString="*.wav") returned 5 [0074.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.flac") returned 0 [0074.174] lstrlenA (lpString="*.flac") returned 6 [0074.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.ape") returned 0 [0074.174] lstrlenA (lpString="*.ape") returned 5 [0074.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.wma") returned 0 [0074.174] lstrlenA (lpString="*.wma") returned 5 [0074.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx", pszSpec="*.ac3") returned 0 [0074.174] lstrlenA (lpString="*.ac3") returned 5 [0074.174] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf47afa00, ftCreationTime.dwHighDateTime=0x1d0cb1b, ftLastAccessTime.dwLowDateTime=0xc9d92211, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xf47afa00, ftLastWriteTime.dwHighDateTime=0x1d0cb1b, nFileSizeHigh=0x0, nFileSizeLow=0x4f98b, dwReserved0=0x74, dwReserved1=0x0, cFileName="Office Theme.thmx", cAlternateFileName="OFFICE~1.THM")) returned 1 [0074.174] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0074.174] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Office Theme.thmx") returned -1 [0074.174] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office Theme.thmx") returned -1 [0074.174] lstrcmpiA (lpString1="", lpString2="Office Theme.thmx") returned -1 [0074.174] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Ion.thmx") returned="Ion.thmx" [0074.174] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\" [0074.174] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\") returned="" [0074.174] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\HOW TO DECRYPT FILES.txt" [0074.174] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\how to decrypt files.txt")) returned 0x20 [0074.174] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\", lpString2="Office Theme.thmx" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Office Theme.thmx") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Office Theme.thmx" [0074.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Office Theme.thmx", pszSpec="*.zip") returned 0 [0074.174] lstrlenA (lpString="*.zip") returned 5 [0074.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Office Theme.thmx", pszSpec="*.rar") returned 0 [0074.174] lstrlenA (lpString="*.rar") returned 5 [0074.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Office Theme.thmx", pszSpec="*.7z") returned 0 [0074.174] lstrlenA (lpString="*.7z") returned 4 [0074.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Office Theme.thmx", pszSpec="*.tar") returned 0 [0074.174] lstrlenA (lpString="*.tar") returned 5 [0074.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Office Theme.thmx", pszSpec="*.gzip") returned 0 [0074.174] lstrlenA (lpString="*.gzip") returned 6 [0074.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Office Theme.thmx", pszSpec="*.jpg") returned 0 [0074.174] lstrlenA (lpString="*.jpg") returned 5 [0074.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Office Theme.thmx", pszSpec="*.jpeg") returned 0 [0074.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Office Theme.thmx", pszSpec="*.psd") returned 0 [0074.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Office Theme.thmx", pszSpec="*.cdr") returned 0 [0074.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Office Theme.thmx", pszSpec="*.dwg") returned 0 [0074.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Office Theme.thmx", pszSpec="*.max") returned 0 [0074.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Office Theme.thmx", pszSpec="*.bmp") returned 0 [0074.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Office Theme.thmx", pszSpec="*.gif") returned 0 [0074.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Office Theme.thmx", pszSpec="*.png") returned 0 [0074.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Office Theme.thmx", pszSpec="*.doc") returned 0 [0074.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Office Theme.thmx", pszSpec="*.docx") returned 0 [0074.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Office Theme.thmx", pszSpec="*.xls") returned 0 [0074.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Office Theme.thmx", pszSpec="*.xlsx") returned 0 [0074.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Office Theme.thmx", pszSpec="*.ppt") returned 0 [0074.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Office Theme.thmx", pszSpec="*.pptx") returned 0 [0074.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Office Theme.thmx", pszSpec="*.txt") returned 0 [0074.176] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb6b2c222, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x84d621, dwReserved0=0x74, dwReserved1=0x0, cFileName="Organic.thmx", cAlternateFileName="ORGANI~1.THM")) returned 1 [0074.176] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0074.176] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Organic.thmx") returned -1 [0074.176] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Organic.thmx") returned -1 [0074.176] lstrcmpiA (lpString1="", lpString2="Organic.thmx") returned -1 [0074.176] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Office Theme.thmx") returned="Office Theme.thmx" [0074.176] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\" [0074.176] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\") returned="" [0074.176] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\HOW TO DECRYPT FILES.txt" [0074.176] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\how to decrypt files.txt")) returned 0x20 [0074.176] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\", lpString2="Organic.thmx" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Organic.thmx") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Organic.thmx" [0074.176] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcab627cf, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x18c4dc, dwReserved0=0x74, dwReserved1=0x0, cFileName="Retrospect.thmx", cAlternateFileName="RETROS~1.THM")) returned 1 [0074.176] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0074.176] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Retrospect.thmx") returned -1 [0074.176] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Retrospect.thmx") returned -1 [0074.176] lstrcmpiA (lpString1="", lpString2="Retrospect.thmx") returned -1 [0074.176] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Organic.thmx") returned="Organic.thmx" [0074.176] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\" [0074.176] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\") returned="" [0074.176] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\HOW TO DECRYPT FILES.txt" [0074.176] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\how to decrypt files.txt")) returned 0x20 [0074.176] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\", lpString2="Retrospect.thmx" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Retrospect.thmx") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Retrospect.thmx" [0074.176] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9277454, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd322a, dwReserved0=0x74, dwReserved1=0x0, cFileName="Slice.thmx", cAlternateFileName="SLICE~1.THM")) returned 1 [0074.176] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0074.176] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Slice.thmx") returned -1 [0074.176] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Slice.thmx") returned -1 [0074.177] lstrcmpiA (lpString1="", lpString2="Slice.thmx") returned -1 [0074.177] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Retrospect.thmx") returned="Retrospect.thmx" [0074.177] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\" [0074.177] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\") returned="" [0074.177] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\HOW TO DECRYPT FILES.txt" [0074.177] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\how to decrypt files.txt")) returned 0x20 [0074.177] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\", lpString2="Slice.thmx" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Slice.thmx") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Slice.thmx" [0074.177] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaa86ca8f, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0xcc3cf3e9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xcc3cf3e9, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName="Theme Colors", cAlternateFileName="THEMEC~1")) returned 1 [0074.177] lstrcmpA (lpString1=".", lpString2="Theme Colors") returned -1 [0074.177] lstrcmpA (lpString1="..", lpString2="Theme Colors") returned -1 [0074.177] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Slice.thmx") returned="Slice.thmx" [0074.177] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\", lpString2="Theme Colors" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors" [0074.177] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\*.*" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme colors\\*.*"), lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaa86ca8f, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0xcc3cf3e9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xcc3cf3e9, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0xb0, cFileName=".", cAlternateFileName="")) returned 0x636970 [0074.181] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.181] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaa86ca8f, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0xcc3cf3e9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xcc3cf3e9, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0xb0, cFileName="..", cAlternateFileName="")) returned 1 [0074.181] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.181] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.181] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xbf26c598, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x77792cf0, dwReserved1=0xb0, cFileName="Aspect.xml", cAlternateFileName="")) returned 1 [0074.181] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.181] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Aspect.xml") returned 1 [0074.181] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Aspect.xml") returned 1 [0074.181] lstrcmpiA (lpString1="", lpString2="Aspect.xml") returned -1 [0074.181] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\*.*") returned="*.*" [0074.181] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" [0074.181] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="" [0074.181] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" [0074.181] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme colors\\how to decrypt files.txt")) returned 0xffffffff [0074.181] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme colors\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0074.182] WriteFile (in: hFile=0x1cc, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0074.183] SetFileTime (hFile=0x1cc, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.183] CloseHandle (hObject=0x1cc) returned 1 [0074.183] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="Aspect.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Aspect.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Aspect.xml" [0074.183] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc086c692, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="Blue Green.xml", cAlternateFileName="BLUEGR~1.XML")) returned 1 [0074.183] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.183] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Blue Green.xml") returned 1 [0074.183] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Blue Green.xml") returned 1 [0074.183] lstrcmpiA (lpString1="", lpString2="Blue Green.xml") returned -1 [0074.183] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Aspect.xml") returned="Aspect.xml" [0074.183] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" [0074.183] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="" [0074.183] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" [0074.183] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme colors\\how to decrypt files.txt")) returned 0x20 [0074.183] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="Blue Green.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Blue Green.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Blue Green.xml" [0074.184] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc0892771, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2e5, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Blue II.xml", cAlternateFileName="BLUEII~1.XML")) returned 1 [0074.184] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.184] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Blue II.xml") returned 1 [0074.184] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Blue II.xml") returned 1 [0074.184] lstrcmpiA (lpString1="", lpString2="Blue II.xml") returned -1 [0074.184] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Blue Green.xml") returned="Blue Green.xml" [0074.184] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" [0074.184] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="" [0074.184] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" [0074.184] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme colors\\how to decrypt files.txt")) returned 0x20 [0074.184] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="Blue II.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Blue II.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Blue II.xml" [0074.184] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc0892771, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2e7, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Blue Warm.xml", cAlternateFileName="BLUEWA~1.XML")) returned 1 [0074.184] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.184] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Blue Warm.xml") returned 1 [0074.184] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Blue Warm.xml") returned 1 [0074.184] lstrcmpiA (lpString1="", lpString2="Blue Warm.xml") returned -1 [0074.184] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Blue II.xml") returned="Blue II.xml" [0074.184] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" [0074.184] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="" [0074.184] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" [0074.184] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme colors\\how to decrypt files.txt")) returned 0x20 [0074.184] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="Blue Warm.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Blue Warm.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Blue Warm.xml" [0074.184] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaa86f1d5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Blue.xml", cAlternateFileName="")) returned 1 [0074.184] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.184] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Blue.xml") returned 1 [0074.184] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Blue.xml") returned 1 [0074.185] lstrcmpiA (lpString1="", lpString2="Blue.xml") returned -1 [0074.185] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Blue Warm.xml") returned="Blue Warm.xml" [0074.185] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" [0074.185] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="" [0074.185] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" [0074.185] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme colors\\how to decrypt files.txt")) returned 0x20 [0074.185] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="Blue.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Blue.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Blue.xml" [0074.185] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xacfac9f6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2e7, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Grayscale.xml", cAlternateFileName="GRAYSC~1.XML")) returned 1 [0074.185] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.185] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Grayscale.xml") returned -1 [0074.185] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Grayscale.xml") returned 1 [0074.185] lstrcmpiA (lpString1="", lpString2="Grayscale.xml") returned -1 [0074.185] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Blue.xml") returned="Blue.xml" [0074.185] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" [0074.185] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="" [0074.185] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" [0074.185] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme colors\\how to decrypt files.txt")) returned 0x20 [0074.185] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="Grayscale.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Grayscale.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Grayscale.xml" [0074.185] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xacfb8d42, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2ea, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Green Yellow.xml", cAlternateFileName="GREENY~1.XML")) returned 1 [0074.185] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.185] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Green Yellow.xml") returned -1 [0074.185] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Green Yellow.xml") returned 1 [0074.186] lstrcmpiA (lpString1="", lpString2="Green Yellow.xml") returned -1 [0074.186] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Grayscale.xml") returned="Grayscale.xml" [0074.186] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" [0074.186] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="" [0074.186] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" [0074.186] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme colors\\how to decrypt files.txt")) returned 0x20 [0074.186] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="Green Yellow.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Green Yellow.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Green Yellow.xml" [0074.186] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xacfb193e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2e3, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Green.xml", cAlternateFileName="")) returned 1 [0074.186] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.186] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Green.xml") returned -1 [0074.186] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Green.xml") returned 1 [0074.186] lstrcmpiA (lpString1="", lpString2="Green.xml") returned -1 [0074.186] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Green Yellow.xml") returned="Green Yellow.xml" [0074.186] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" [0074.186] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="" [0074.186] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" [0074.186] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme colors\\how to decrypt files.txt")) returned 0x20 [0074.186] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="Green.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Green.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Green.xml" [0074.186] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb0f2d882, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Marquee.xml", cAlternateFileName="")) returned 1 [0074.186] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.186] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Marquee.xml") returned -1 [0074.186] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Marquee.xml") returned -1 [0074.186] lstrcmpiA (lpString1="", lpString2="Marquee.xml") returned -1 [0074.186] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Green.xml") returned="Green.xml" [0074.186] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" [0074.187] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="" [0074.187] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" [0074.187] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme colors\\how to decrypt files.txt")) returned 0x20 [0074.187] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="Marquee.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Marquee.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Marquee.xml" [0074.187] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb10dc5c3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Median.xml", cAlternateFileName="")) returned 1 [0074.187] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.187] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Median.xml") returned -1 [0074.187] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Median.xml") returned -1 [0074.187] lstrcmpiA (lpString1="", lpString2="Median.xml") returned -1 [0074.187] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Marquee.xml") returned="Marquee.xml" [0074.187] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" [0074.187] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="" [0074.187] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" [0074.187] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme colors\\how to decrypt files.txt")) returned 0x20 [0074.187] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="Median.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Median.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Median.xml" [0074.187] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb67119d6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2ee, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Office 2007 - 2010.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0074.187] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.187] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Office 2007 - 2010.xml") returned -1 [0074.187] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office 2007 - 2010.xml") returned -1 [0074.187] lstrcmpiA (lpString1="", lpString2="Office 2007 - 2010.xml") returned -1 [0074.187] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Median.xml") returned="Median.xml" [0074.187] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" [0074.187] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="" [0074.187] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" [0074.188] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme colors\\how to decrypt files.txt")) returned 0x20 [0074.188] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="Office 2007 - 2010.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Office 2007 - 2010.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Office 2007 - 2010.xml" [0074.188] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca01f314, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Orange Red.xml", cAlternateFileName="ORANGE~1.XML")) returned 1 [0074.188] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.188] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Orange Red.xml") returned -1 [0074.188] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Orange Red.xml") returned -1 [0074.188] lstrcmpiA (lpString1="", lpString2="Orange Red.xml") returned -1 [0074.188] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Office 2007 - 2010.xml") returned="Office 2007 - 2010.xml" [0074.188] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" [0074.188] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="" [0074.188] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" [0074.188] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme colors\\how to decrypt files.txt")) returned 0x20 [0074.188] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="Orange Red.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Orange Red.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Orange Red.xml" [0074.188] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb69cb8c7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Orange.xml", cAlternateFileName="")) returned 1 [0074.188] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.188] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Orange.xml") returned -1 [0074.188] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Orange.xml") returned -1 [0074.188] lstrcmpiA (lpString1="", lpString2="Orange.xml") returned -1 [0074.188] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Orange Red.xml") returned="Orange Red.xml" [0074.188] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" [0074.188] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="" [0074.188] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" [0074.188] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme colors\\how to decrypt files.txt")) returned 0x20 [0074.188] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="Orange.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Orange.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Orange.xml" [0074.189] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8144171, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2e3, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Paper.xml", cAlternateFileName="")) returned 1 [0074.189] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.189] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Paper.xml") returned -1 [0074.189] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Paper.xml") returned -1 [0074.189] lstrcmpiA (lpString1="", lpString2="Paper.xml") returned -1 [0074.189] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Orange.xml") returned="Orange.xml" [0074.189] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" [0074.189] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="" [0074.189] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" [0074.189] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme colors\\how to decrypt files.txt")) returned 0x20 [0074.189] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="Paper.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Paper.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Paper.xml" [0074.189] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8aa7c21, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Red Orange.xml", cAlternateFileName="REDORA~1.XML")) returned 1 [0074.189] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.189] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Red Orange.xml") returned -1 [0074.189] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Red Orange.xml") returned -1 [0074.189] lstrcmpiA (lpString1="", lpString2="Red Orange.xml") returned -1 [0074.189] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Paper.xml") returned="Paper.xml" [0074.189] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" [0074.189] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="" [0074.189] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" [0074.189] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme colors\\how to decrypt files.txt")) returned 0x20 [0074.189] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="Red Orange.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Red Orange.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Red Orange.xml" [0074.189] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8aaca30, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Red Violet.xml", cAlternateFileName="REDVIO~1.XML")) returned 1 [0074.190] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.190] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Red Violet.xml") returned -1 [0074.190] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Red Violet.xml") returned -1 [0074.190] lstrcmpiA (lpString1="", lpString2="Red Violet.xml") returned -1 [0074.190] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Red Orange.xml") returned="Red Orange.xml" [0074.190] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" [0074.190] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="" [0074.190] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" [0074.190] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme colors\\how to decrypt files.txt")) returned 0x20 [0074.190] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="Red Violet.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Red Violet.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Red Violet.xml" [0074.190] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcab03392, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Red.xml", cAlternateFileName="")) returned 1 [0074.190] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.190] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Red.xml") returned -1 [0074.190] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Red.xml") returned -1 [0074.190] lstrcmpiA (lpString1="", lpString2="Red.xml") returned -1 [0074.190] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Red Violet.xml") returned="Red Violet.xml" [0074.190] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" [0074.190] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="" [0074.190] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" [0074.190] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme colors\\how to decrypt files.txt")) returned 0x20 [0074.190] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="Red.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Red.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Red.xml" [0074.190] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb927c292, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Slipstream.xml", cAlternateFileName="SLIPST~1.XML")) returned 1 [0074.190] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.191] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Slipstream.xml") returned -1 [0074.191] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Slipstream.xml") returned -1 [0074.191] lstrcmpiA (lpString1="", lpString2="Slipstream.xml") returned -1 [0074.191] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Red.xml") returned="Red.xml" [0074.191] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" [0074.191] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="" [0074.191] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" [0074.191] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme colors\\how to decrypt files.txt")) returned 0x20 [0074.191] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="Slipstream.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Slipstream.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Slipstream.xml" [0074.191] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcba0a2d3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2e7, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Violet II.xml", cAlternateFileName="VIOLET~1.XML")) returned 1 [0074.191] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.191] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Violet II.xml") returned -1 [0074.191] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Violet II.xml") returned -1 [0074.191] lstrcmpiA (lpString1="", lpString2="Violet II.xml") returned -1 [0074.191] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Slipstream.xml") returned="Slipstream.xml" [0074.191] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" [0074.191] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="" [0074.191] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" [0074.191] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme colors\\how to decrypt files.txt")) returned 0x20 [0074.191] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="Violet II.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Violet II.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Violet II.xml" [0074.191] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9b8c5b2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Violet.xml", cAlternateFileName="")) returned 1 [0074.191] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.191] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Violet.xml") returned -1 [0074.191] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Violet.xml") returned -1 [0074.191] lstrcmpiA (lpString1="", lpString2="Violet.xml") returned -1 [0074.191] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Violet II.xml") returned="Violet II.xml" [0074.191] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" [0074.192] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="" [0074.192] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" [0074.192] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme colors\\how to decrypt files.txt")) returned 0x20 [0074.192] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="Violet.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Violet.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Violet.xml" [0074.192] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcc3cf3e9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2eb, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Yellow Orange.xml", cAlternateFileName="YELLOW~1.XML")) returned 1 [0074.192] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.192] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Yellow Orange.xml") returned -1 [0074.192] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Yellow Orange.xml") returned -1 [0074.192] lstrcmpiA (lpString1="", lpString2="Yellow Orange.xml") returned -1 [0074.192] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Violet.xml") returned="Violet.xml" [0074.192] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" [0074.192] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="" [0074.192] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" [0074.192] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme colors\\how to decrypt files.txt")) returned 0x20 [0074.192] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="Yellow Orange.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Yellow Orange.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Yellow Orange.xml" [0074.196] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xbc2dd99f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Yellow.xml", cAlternateFileName="")) returned 1 [0074.196] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.196] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Yellow.xml") returned -1 [0074.196] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Yellow.xml") returned -1 [0074.196] lstrcmpiA (lpString1="", lpString2="Yellow.xml") returned -1 [0074.196] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Yellow Orange.xml") returned="Yellow Orange.xml" [0074.196] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" [0074.196] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\") returned="" [0074.196] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" [0074.196] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme colors\\how to decrypt files.txt")) returned 0x20 [0074.196] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\", lpString2="Yellow.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Yellow.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Colors\\Yellow.xml" [0074.197] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xbc2dd99f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Yellow.xml", cAlternateFileName="")) returned 0 [0074.197] FindClose (in: hFindFile=0x636970 | out: hFindFile=0x636970) returned 1 [0074.197] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaa784dab, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0xcb5827d6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xcb5827d6, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1 [0074.197] lstrcmpA (lpString1=".", lpString2="Theme Effects") returned -1 [0074.197] lstrcmpA (lpString1="..", lpString2="Theme Effects") returned -1 [0074.197] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\*.*") returned="*.*" [0074.197] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\", lpString2="Theme Effects" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects" [0074.197] lstrlenA (lpString="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects") returned 72 [0074.197] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\*.*" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme effects\\*.*"), lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaa784dab, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0xcb5827d6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xcb5827d6, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x590052, dwReserved1=0x540050, cFileName=".", cAlternateFileName="")) returned 0x636970 [0074.199] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.199] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaa784dab, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0xcb5827d6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xcb5827d6, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="..", cAlternateFileName="")) returned 1 [0074.199] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.199] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.199] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaa78738b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xbaeb, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Banded Edge.eftx", cAlternateFileName="BANDED~1.EFT")) returned 1 [0074.199] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.199] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Banded Edge.eftx") returned 1 [0074.199] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Banded Edge.eftx") returned 1 [0074.199] lstrcmpiA (lpString1="", lpString2="Banded Edge.eftx") returned -1 [0074.199] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\*.*") returned="*.*" [0074.200] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" [0074.200] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\") returned="" [0074.200] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" [0074.200] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme effects\\how to decrypt files.txt")) returned 0xffffffff [0074.200] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme effects\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0074.200] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0074.200] WriteFile (in: hFile=0x1cc, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0074.201] SetFileTime (hFile=0x1cc, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.201] CloseHandle (hObject=0x1cc) returned 1 [0074.201] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\", lpString2="Banded Edge.eftx" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" [0074.201] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.zip") returned 0 [0074.202] lstrlenA (lpString="*.zip") returned 5 [0074.202] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.rar") returned 0 [0074.202] lstrlenA (lpString="*.rar") returned 5 [0074.202] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.7z") returned 0 [0074.202] lstrlenA (lpString="*.7z") returned 4 [0074.202] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.tar") returned 0 [0074.202] lstrlenA (lpString="*.tar") returned 5 [0074.202] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.gzip") returned 0 [0074.202] lstrlenA (lpString="*.gzip") returned 6 [0074.202] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.jpg") returned 0 [0074.202] lstrlenA (lpString="*.jpg") returned 5 [0074.202] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.jpeg") returned 0 [0074.202] lstrlenA (lpString="*.jpeg") returned 6 [0074.202] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.psd") returned 0 [0074.202] lstrlenA (lpString="*.psd") returned 5 [0074.202] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.cdr") returned 0 [0074.202] lstrlenA (lpString="*.cdr") returned 5 [0074.202] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.dwg") returned 0 [0074.202] lstrlenA (lpString="*.dwg") returned 5 [0074.202] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.max") returned 0 [0074.202] lstrlenA (lpString="*.max") returned 5 [0074.202] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.bmp") returned 0 [0074.202] lstrlenA (lpString="*.bmp") returned 5 [0074.202] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.gif") returned 0 [0074.202] lstrlenA (lpString="*.gif") returned 5 [0074.202] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.png") returned 0 [0074.202] lstrlenA (lpString="*.png") returned 5 [0074.202] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.doc") returned 0 [0074.202] lstrlenA (lpString="*.doc") returned 5 [0074.202] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.docx") returned 0 [0074.202] lstrlenA (lpString="*.docx") returned 6 [0074.202] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.xls") returned 0 [0074.202] lstrlenA (lpString="*.xls") returned 5 [0074.202] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.xlsx") returned 0 [0074.202] lstrlenA (lpString="*.xlsx") returned 6 [0074.202] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.ppt") returned 0 [0074.203] lstrlenA (lpString="*.ppt") returned 5 [0074.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.pptx") returned 0 [0074.203] lstrlenA (lpString="*.pptx") returned 6 [0074.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.txt") returned 0 [0074.203] lstrlenA (lpString="*.txt") returned 5 [0074.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.pdf") returned 0 [0074.203] lstrlenA (lpString="*.pdf") returned 5 [0074.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.djvu") returned 0 [0074.203] lstrlenA (lpString="*.djvu") returned 6 [0074.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.htm") returned 0 [0074.203] lstrlenA (lpString="*.htm") returned 5 [0074.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.html") returned 0 [0074.203] lstrlenA (lpString="*.html") returned 6 [0074.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.mdb") returned 0 [0074.203] lstrlenA (lpString="*.mdb") returned 5 [0074.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.cer") returned 0 [0074.203] lstrlenA (lpString="*.cer") returned 5 [0074.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.p12") returned 0 [0074.203] lstrlenA (lpString="*.p12") returned 5 [0074.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.pfx") returned 0 [0074.203] lstrlenA (lpString="*.pfx") returned 5 [0074.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.kwm") returned 0 [0074.203] lstrlenA (lpString="*.kwm") returned 5 [0074.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.pwm") returned 0 [0074.203] lstrlenA (lpString="*.pwm") returned 5 [0074.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.1cd") returned 0 [0074.203] lstrlenA (lpString="*.1cd") returned 5 [0074.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.md") returned 0 [0074.203] lstrlenA (lpString="*.md") returned 4 [0074.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.mdf") returned 0 [0074.203] lstrlenA (lpString="*.mdf") returned 5 [0074.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.dbf") returned 0 [0074.203] lstrlenA (lpString="*.dbf") returned 5 [0074.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.odt") returned 0 [0074.204] lstrlenA (lpString="*.odt") returned 5 [0074.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.vob") returned 0 [0074.204] lstrlenA (lpString="*.vob") returned 5 [0074.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.ifo") returned 0 [0074.204] lstrlenA (lpString="*.ifo") returned 5 [0074.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.lnk") returned 0 [0074.204] lstrlenA (lpString="*.lnk") returned 5 [0074.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.torrent") returned 0 [0074.204] lstrlenA (lpString="*.torrent") returned 9 [0074.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.mov") returned 0 [0074.204] lstrlenA (lpString="*.mov") returned 5 [0074.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.m2v") returned 0 [0074.204] lstrlenA (lpString="*.m2v") returned 5 [0074.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.3gp") returned 0 [0074.204] lstrlenA (lpString="*.3gp") returned 5 [0074.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.mpeg") returned 0 [0074.204] lstrlenA (lpString="*.mpeg") returned 6 [0074.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.mpg") returned 0 [0074.204] lstrlenA (lpString="*.mpg") returned 5 [0074.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.flv") returned 0 [0074.204] lstrlenA (lpString="*.flv") returned 5 [0074.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.avi") returned 0 [0074.204] lstrlenA (lpString="*.avi") returned 5 [0074.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.mp4") returned 0 [0074.204] lstrlenA (lpString="*.mp4") returned 5 [0074.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.wmv") returned 0 [0074.204] lstrlenA (lpString="*.wmv") returned 5 [0074.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.divx") returned 0 [0074.204] lstrlenA (lpString="*.divx") returned 6 [0074.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.mkv") returned 0 [0074.204] lstrlenA (lpString="*.mkv") returned 5 [0074.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.mp3") returned 0 [0074.204] lstrlenA (lpString="*.mp3") returned 5 [0074.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.wav") returned 0 [0074.205] lstrlenA (lpString="*.wav") returned 5 [0074.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.flac") returned 0 [0074.205] lstrlenA (lpString="*.flac") returned 6 [0074.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.ape") returned 0 [0074.205] lstrlenA (lpString="*.ape") returned 5 [0074.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.wma") returned 0 [0074.205] lstrlenA (lpString="*.wma") returned 5 [0074.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.ac3") returned 0 [0074.205] lstrlenA (lpString="*.ac3") returned 5 [0074.205] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaca08886, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x530f9, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="Extreme Shadow.eftx", cAlternateFileName="EXTREM~1.EFT")) returned 1 [0074.205] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.205] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Extreme Shadow.eftx") returned -1 [0074.205] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Extreme Shadow.eftx") returned 1 [0074.205] lstrcmpiA (lpString1="", lpString2="Extreme Shadow.eftx") returned -1 [0074.205] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned="Banded Edge.eftx" [0074.205] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" [0074.205] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\") returned="" [0074.205] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" [0074.205] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme effects\\how to decrypt files.txt")) returned 0x20 [0074.205] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\", lpString2="Extreme Shadow.eftx" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" [0074.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.zip") returned 0 [0074.205] lstrlenA (lpString="*.zip") returned 5 [0074.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.rar") returned 0 [0074.205] lstrlenA (lpString="*.rar") returned 5 [0074.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.7z") returned 0 [0074.205] lstrlenA (lpString="*.7z") returned 4 [0074.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.tar") returned 0 [0074.205] lstrlenA (lpString="*.tar") returned 5 [0074.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.gzip") returned 0 [0074.206] lstrlenA (lpString="*.gzip") returned 6 [0074.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.jpg") returned 0 [0074.206] lstrlenA (lpString="*.jpg") returned 5 [0074.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.jpeg") returned 0 [0074.206] lstrlenA (lpString="*.jpeg") returned 6 [0074.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.psd") returned 0 [0074.206] lstrlenA (lpString="*.psd") returned 5 [0074.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.cdr") returned 0 [0074.206] lstrlenA (lpString="*.cdr") returned 5 [0074.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.dwg") returned 0 [0074.206] lstrlenA (lpString="*.dwg") returned 5 [0074.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.max") returned 0 [0074.206] lstrlenA (lpString="*.max") returned 5 [0074.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.bmp") returned 0 [0074.206] lstrlenA (lpString="*.bmp") returned 5 [0074.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.gif") returned 0 [0074.206] lstrlenA (lpString="*.gif") returned 5 [0074.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.png") returned 0 [0074.206] lstrlenA (lpString="*.png") returned 5 [0074.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.doc") returned 0 [0074.206] lstrlenA (lpString="*.doc") returned 5 [0074.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.docx") returned 0 [0074.206] lstrlenA (lpString="*.docx") returned 6 [0074.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.xls") returned 0 [0074.206] lstrlenA (lpString="*.xls") returned 5 [0074.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.xlsx") returned 0 [0074.206] lstrlenA (lpString="*.xlsx") returned 6 [0074.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.ppt") returned 0 [0074.206] lstrlenA (lpString="*.ppt") returned 5 [0074.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.pptx") returned 0 [0074.207] lstrlenA (lpString="*.pptx") returned 6 [0074.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.txt") returned 0 [0074.207] lstrlenA (lpString="*.txt") returned 5 [0074.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.pdf") returned 0 [0074.207] lstrlenA (lpString="*.pdf") returned 5 [0074.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.djvu") returned 0 [0074.207] lstrlenA (lpString="*.djvu") returned 6 [0074.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.htm") returned 0 [0074.207] lstrlenA (lpString="*.htm") returned 5 [0074.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.html") returned 0 [0074.207] lstrlenA (lpString="*.html") returned 6 [0074.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.mdb") returned 0 [0074.207] lstrlenA (lpString="*.mdb") returned 5 [0074.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.cer") returned 0 [0074.207] lstrlenA (lpString="*.cer") returned 5 [0074.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.p12") returned 0 [0074.207] lstrlenA (lpString="*.p12") returned 5 [0074.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.pfx") returned 0 [0074.207] lstrlenA (lpString="*.pfx") returned 5 [0074.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.kwm") returned 0 [0074.207] lstrlenA (lpString="*.kwm") returned 5 [0074.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.pwm") returned 0 [0074.207] lstrlenA (lpString="*.pwm") returned 5 [0074.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.1cd") returned 0 [0074.207] lstrlenA (lpString="*.1cd") returned 5 [0074.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.md") returned 0 [0074.207] lstrlenA (lpString="*.md") returned 4 [0074.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.mdf") returned 0 [0074.207] lstrlenA (lpString="*.mdf") returned 5 [0074.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.dbf") returned 0 [0074.207] lstrlenA (lpString="*.dbf") returned 5 [0074.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.odt") returned 0 [0074.207] lstrlenA (lpString="*.odt") returned 5 [0074.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.vob") returned 0 [0074.208] lstrlenA (lpString="*.vob") returned 5 [0074.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.ifo") returned 0 [0074.208] lstrlenA (lpString="*.ifo") returned 5 [0074.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.lnk") returned 0 [0074.208] lstrlenA (lpString="*.lnk") returned 5 [0074.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.torrent") returned 0 [0074.208] lstrlenA (lpString="*.torrent") returned 9 [0074.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.mov") returned 0 [0074.208] lstrlenA (lpString="*.mov") returned 5 [0074.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.m2v") returned 0 [0074.208] lstrlenA (lpString="*.m2v") returned 5 [0074.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.3gp") returned 0 [0074.208] lstrlenA (lpString="*.3gp") returned 5 [0074.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.mpeg") returned 0 [0074.208] lstrlenA (lpString="*.mpeg") returned 6 [0074.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.mpg") returned 0 [0074.208] lstrlenA (lpString="*.mpg") returned 5 [0074.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.flv") returned 0 [0074.208] lstrlenA (lpString="*.flv") returned 5 [0074.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.avi") returned 0 [0074.208] lstrlenA (lpString="*.avi") returned 5 [0074.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.mp4") returned 0 [0074.208] lstrlenA (lpString="*.mp4") returned 5 [0074.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.wmv") returned 0 [0074.208] lstrlenA (lpString="*.wmv") returned 5 [0074.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.divx") returned 0 [0074.208] lstrlenA (lpString="*.divx") returned 6 [0074.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.mkv") returned 0 [0074.208] lstrlenA (lpString="*.mkv") returned 5 [0074.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.mp3") returned 0 [0074.208] lstrlenA (lpString="*.mp3") returned 5 [0074.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.wav") returned 0 [0074.208] lstrlenA (lpString="*.wav") returned 5 [0074.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.flac") returned 0 [0074.209] lstrlenA (lpString="*.flac") returned 6 [0074.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.ape") returned 0 [0074.209] lstrlenA (lpString="*.ape") returned 5 [0074.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.wma") returned 0 [0074.209] lstrlenA (lpString="*.wma") returned 5 [0074.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.ac3") returned 0 [0074.209] lstrlenA (lpString="*.ac3") returned 5 [0074.209] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc1aaaea7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x51933, dwReserved0=0x520043, dwReserved1=0x500059, cFileName="Frosted Glass.eftx", cAlternateFileName="FROSTE~1.EFT")) returned 1 [0074.209] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.209] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Frosted Glass.eftx") returned -1 [0074.209] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Frosted Glass.eftx") returned 1 [0074.209] lstrcmpiA (lpString1="", lpString2="Frosted Glass.eftx") returned -1 [0074.209] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned="Extreme Shadow.eftx" [0074.209] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" [0074.209] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\") returned="" [0074.209] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" [0074.209] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme effects\\how to decrypt files.txt")) returned 0x20 [0074.209] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\", lpString2="Frosted Glass.eftx" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" [0074.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.zip") returned 0 [0074.209] lstrlenA (lpString="*.zip") returned 5 [0074.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.rar") returned 0 [0074.209] lstrlenA (lpString="*.rar") returned 5 [0074.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.7z") returned 0 [0074.209] lstrlenA (lpString="*.7z") returned 4 [0074.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.tar") returned 0 [0074.210] lstrlenA (lpString="*.tar") returned 5 [0074.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.gzip") returned 0 [0074.210] lstrlenA (lpString="*.gzip") returned 6 [0074.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.jpg") returned 0 [0074.210] lstrlenA (lpString="*.jpg") returned 5 [0074.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.jpeg") returned 0 [0074.210] lstrlenA (lpString="*.jpeg") returned 6 [0074.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.psd") returned 0 [0074.210] lstrlenA (lpString="*.psd") returned 5 [0074.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.cdr") returned 0 [0074.210] lstrlenA (lpString="*.cdr") returned 5 [0074.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.dwg") returned 0 [0074.210] lstrlenA (lpString="*.dwg") returned 5 [0074.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.max") returned 0 [0074.210] lstrlenA (lpString="*.max") returned 5 [0074.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.bmp") returned 0 [0074.210] lstrlenA (lpString="*.bmp") returned 5 [0074.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.gif") returned 0 [0074.210] lstrlenA (lpString="*.gif") returned 5 [0074.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.png") returned 0 [0074.210] lstrlenA (lpString="*.png") returned 5 [0074.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.doc") returned 0 [0074.210] lstrlenA (lpString="*.doc") returned 5 [0074.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.docx") returned 0 [0074.210] lstrlenA (lpString="*.docx") returned 6 [0074.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.xls") returned 0 [0074.210] lstrlenA (lpString="*.xls") returned 5 [0074.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.xlsx") returned 0 [0074.211] lstrlenA (lpString="*.xlsx") returned 6 [0074.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.ppt") returned 0 [0074.211] lstrlenA (lpString="*.ppt") returned 5 [0074.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.pptx") returned 0 [0074.211] lstrlenA (lpString="*.pptx") returned 6 [0074.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.txt") returned 0 [0074.211] lstrlenA (lpString="*.txt") returned 5 [0074.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.pdf") returned 0 [0074.211] lstrlenA (lpString="*.pdf") returned 5 [0074.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.djvu") returned 0 [0074.211] lstrlenA (lpString="*.djvu") returned 6 [0074.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.htm") returned 0 [0074.211] lstrlenA (lpString="*.htm") returned 5 [0074.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.html") returned 0 [0074.211] lstrlenA (lpString="*.html") returned 6 [0074.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.mdb") returned 0 [0074.211] lstrlenA (lpString="*.mdb") returned 5 [0074.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.cer") returned 0 [0074.211] lstrlenA (lpString="*.cer") returned 5 [0074.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.p12") returned 0 [0074.211] lstrlenA (lpString="*.p12") returned 5 [0074.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.pfx") returned 0 [0074.211] lstrlenA (lpString="*.pfx") returned 5 [0074.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.kwm") returned 0 [0074.211] lstrlenA (lpString="*.kwm") returned 5 [0074.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.pwm") returned 0 [0074.211] lstrlenA (lpString="*.pwm") returned 5 [0074.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.1cd") returned 0 [0074.211] lstrlenA (lpString="*.1cd") returned 5 [0074.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.md") returned 0 [0074.212] lstrlenA (lpString="*.md") returned 4 [0074.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.mdf") returned 0 [0074.212] lstrlenA (lpString="*.mdf") returned 5 [0074.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.dbf") returned 0 [0074.212] lstrlenA (lpString="*.dbf") returned 5 [0074.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.odt") returned 0 [0074.212] lstrlenA (lpString="*.odt") returned 5 [0074.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.vob") returned 0 [0074.212] lstrlenA (lpString="*.vob") returned 5 [0074.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.ifo") returned 0 [0074.212] lstrlenA (lpString="*.ifo") returned 5 [0074.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.lnk") returned 0 [0074.212] lstrlenA (lpString="*.lnk") returned 5 [0074.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.torrent") returned 0 [0074.212] lstrlenA (lpString="*.torrent") returned 9 [0074.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.mov") returned 0 [0074.212] lstrlenA (lpString="*.mov") returned 5 [0074.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.m2v") returned 0 [0074.212] lstrlenA (lpString="*.m2v") returned 5 [0074.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.3gp") returned 0 [0074.212] lstrlenA (lpString="*.3gp") returned 5 [0074.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.mpeg") returned 0 [0074.212] lstrlenA (lpString="*.mpeg") returned 6 [0074.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.mpg") returned 0 [0074.212] lstrlenA (lpString="*.mpg") returned 5 [0074.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.flv") returned 0 [0074.212] lstrlenA (lpString="*.flv") returned 5 [0074.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.avi") returned 0 [0074.212] lstrlenA (lpString="*.avi") returned 5 [0074.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.mp4") returned 0 [0074.212] lstrlenA (lpString="*.mp4") returned 5 [0074.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.wmv") returned 0 [0074.212] lstrlenA (lpString="*.wmv") returned 5 [0074.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.divx") returned 0 [0074.213] lstrlenA (lpString="*.divx") returned 6 [0074.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.mkv") returned 0 [0074.213] lstrlenA (lpString="*.mkv") returned 5 [0074.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.mp3") returned 0 [0074.213] lstrlenA (lpString="*.mp3") returned 5 [0074.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.wav") returned 0 [0074.213] lstrlenA (lpString="*.wav") returned 5 [0074.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.flac") returned 0 [0074.213] lstrlenA (lpString="*.flac") returned 6 [0074.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.ape") returned 0 [0074.213] lstrlenA (lpString="*.ape") returned 5 [0074.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.wma") returned 0 [0074.213] lstrlenA (lpString="*.wma") returned 5 [0074.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.ac3") returned 0 [0074.213] lstrlenA (lpString="*.ac3") returned 5 [0074.213] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc20b6bd2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x51cbe, dwReserved0=0x520043, dwReserved1=0x500059, cFileName="Glossy.eftx", cAlternateFileName="GLOSSY~1.EFT")) returned 1 [0074.213] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.213] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Glossy.eftx") returned -1 [0074.213] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Glossy.eftx") returned 1 [0074.213] lstrcmpiA (lpString1="", lpString2="Glossy.eftx") returned -1 [0074.213] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned="Frosted Glass.eftx" [0074.213] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" [0074.213] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\") returned="" [0074.213] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" [0074.213] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme effects\\how to decrypt files.txt")) returned 0x20 [0074.213] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\", lpString2="Glossy.eftx" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx" [0074.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.zip") returned 0 [0074.213] lstrlenA (lpString="*.zip") returned 5 [0074.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.rar") returned 0 [0074.213] lstrlenA (lpString="*.rar") returned 5 [0074.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.7z") returned 0 [0074.214] lstrlenA (lpString="*.7z") returned 4 [0074.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.tar") returned 0 [0074.214] lstrlenA (lpString="*.tar") returned 5 [0074.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.gzip") returned 0 [0074.214] lstrlenA (lpString="*.gzip") returned 6 [0074.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.jpg") returned 0 [0074.214] lstrlenA (lpString="*.jpg") returned 5 [0074.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.jpeg") returned 0 [0074.214] lstrlenA (lpString="*.jpeg") returned 6 [0074.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.psd") returned 0 [0074.214] lstrlenA (lpString="*.psd") returned 5 [0074.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.cdr") returned 0 [0074.214] lstrlenA (lpString="*.cdr") returned 5 [0074.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.dwg") returned 0 [0074.214] lstrlenA (lpString="*.dwg") returned 5 [0074.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.max") returned 0 [0074.214] lstrlenA (lpString="*.max") returned 5 [0074.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.bmp") returned 0 [0074.214] lstrlenA (lpString="*.bmp") returned 5 [0074.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.gif") returned 0 [0074.214] lstrlenA (lpString="*.gif") returned 5 [0074.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.png") returned 0 [0074.214] lstrlenA (lpString="*.png") returned 5 [0074.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.doc") returned 0 [0074.214] lstrlenA (lpString="*.doc") returned 5 [0074.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.docx") returned 0 [0074.214] lstrlenA (lpString="*.docx") returned 6 [0074.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.xls") returned 0 [0074.214] lstrlenA (lpString="*.xls") returned 5 [0074.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.xlsx") returned 0 [0074.214] lstrlenA (lpString="*.xlsx") returned 6 [0074.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.ppt") returned 0 [0074.214] lstrlenA (lpString="*.ppt") returned 5 [0074.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.pptx") returned 0 [0074.215] lstrlenA (lpString="*.pptx") returned 6 [0074.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.txt") returned 0 [0074.215] lstrlenA (lpString="*.txt") returned 5 [0074.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.pdf") returned 0 [0074.215] lstrlenA (lpString="*.pdf") returned 5 [0074.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.djvu") returned 0 [0074.215] lstrlenA (lpString="*.djvu") returned 6 [0074.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.htm") returned 0 [0074.215] lstrlenA (lpString="*.htm") returned 5 [0074.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.html") returned 0 [0074.215] lstrlenA (lpString="*.html") returned 6 [0074.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.mdb") returned 0 [0074.215] lstrlenA (lpString="*.mdb") returned 5 [0074.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.cer") returned 0 [0074.215] lstrlenA (lpString="*.cer") returned 5 [0074.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.p12") returned 0 [0074.215] lstrlenA (lpString="*.p12") returned 5 [0074.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.pfx") returned 0 [0074.215] lstrlenA (lpString="*.pfx") returned 5 [0074.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.kwm") returned 0 [0074.215] lstrlenA (lpString="*.kwm") returned 5 [0074.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.pwm") returned 0 [0074.215] lstrlenA (lpString="*.pwm") returned 5 [0074.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.1cd") returned 0 [0074.215] lstrlenA (lpString="*.1cd") returned 5 [0074.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.md") returned 0 [0074.215] lstrlenA (lpString="*.md") returned 4 [0074.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.mdf") returned 0 [0074.215] lstrlenA (lpString="*.mdf") returned 5 [0074.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.dbf") returned 0 [0074.215] lstrlenA (lpString="*.dbf") returned 5 [0074.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.odt") returned 0 [0074.216] lstrlenA (lpString="*.odt") returned 5 [0074.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.vob") returned 0 [0074.216] lstrlenA (lpString="*.vob") returned 5 [0074.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.ifo") returned 0 [0074.216] lstrlenA (lpString="*.ifo") returned 5 [0074.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.lnk") returned 0 [0074.216] lstrlenA (lpString="*.lnk") returned 5 [0074.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.torrent") returned 0 [0074.216] lstrlenA (lpString="*.torrent") returned 9 [0074.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.mov") returned 0 [0074.216] lstrlenA (lpString="*.mov") returned 5 [0074.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.m2v") returned 0 [0074.216] lstrlenA (lpString="*.m2v") returned 5 [0074.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.3gp") returned 0 [0074.216] lstrlenA (lpString="*.3gp") returned 5 [0074.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.mpeg") returned 0 [0074.216] lstrlenA (lpString="*.mpeg") returned 6 [0074.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.mpg") returned 0 [0074.216] lstrlenA (lpString="*.mpg") returned 5 [0074.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.flv") returned 0 [0074.216] lstrlenA (lpString="*.flv") returned 5 [0074.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.avi") returned 0 [0074.216] lstrlenA (lpString="*.avi") returned 5 [0074.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.mp4") returned 0 [0074.216] lstrlenA (lpString="*.mp4") returned 5 [0074.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.wmv") returned 0 [0074.216] lstrlenA (lpString="*.wmv") returned 5 [0074.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.divx") returned 0 [0074.216] lstrlenA (lpString="*.divx") returned 6 [0074.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.mkv") returned 0 [0074.216] lstrlenA (lpString="*.mkv") returned 5 [0074.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.mp3") returned 0 [0074.216] lstrlenA (lpString="*.mp3") returned 5 [0074.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.wav") returned 0 [0074.217] lstrlenA (lpString="*.wav") returned 5 [0074.217] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.flac") returned 0 [0074.217] lstrlenA (lpString="*.flac") returned 6 [0074.217] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.ape") returned 0 [0074.217] lstrlenA (lpString="*.ape") returned 5 [0074.217] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.wma") returned 0 [0074.217] lstrlenA (lpString="*.wma") returned 5 [0074.217] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.ac3") returned 0 [0074.217] lstrlenA (lpString="*.ac3") returned 5 [0074.217] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc20bccef, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd44b, dwReserved0=0x520043, dwReserved1=0x500059, cFileName="Glow Edge.eftx", cAlternateFileName="GLOWED~1.EFT")) returned 1 [0074.217] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.217] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Glow Edge.eftx") returned -1 [0074.217] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Glow Edge.eftx") returned 1 [0074.217] lstrcmpiA (lpString1="", lpString2="Glow Edge.eftx") returned -1 [0074.217] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned="Glossy.eftx" [0074.217] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" [0074.217] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\") returned="" [0074.217] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" [0074.217] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme effects\\how to decrypt files.txt")) returned 0x20 [0074.217] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\", lpString2="Glow Edge.eftx" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" [0074.217] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glow Edge.eftx", pszSpec="*.zip") returned 0 [0074.217] lstrlenA (lpString="*.zip") returned 5 [0074.217] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glow Edge.eftx", pszSpec="*.rar") returned 0 [0074.217] lstrlenA (lpString="*.rar") returned 5 [0074.217] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glow Edge.eftx", pszSpec="*.7z") returned 0 [0074.217] lstrlenA (lpString="*.7z") returned 4 [0074.217] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glow Edge.eftx", pszSpec="*.tar") returned 0 [0074.217] lstrlenA (lpString="*.tar") returned 5 [0074.217] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glow Edge.eftx", pszSpec="*.gzip") returned 0 [0074.217] lstrlenA (lpString="*.gzip") returned 6 [0074.218] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glow Edge.eftx", pszSpec="*.jpg") returned 0 [0074.218] lstrlenA (lpString="*.jpg") returned 5 [0074.218] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glow Edge.eftx", pszSpec="*.jpeg") returned 0 [0074.218] lstrlenA (lpString="*.jpeg") returned 6 [0074.218] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glow Edge.eftx", pszSpec="*.psd") returned 0 [0074.218] lstrlenA (lpString="*.psd") returned 5 [0074.218] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glow Edge.eftx", pszSpec="*.cdr") returned 0 [0074.218] lstrlenA (lpString="*.cdr") returned 5 [0074.218] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glow Edge.eftx", pszSpec="*.dwg") returned 0 [0074.218] lstrlenA (lpString="*.dwg") returned 5 [0074.218] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glow Edge.eftx", pszSpec="*.max") returned 0 [0074.218] lstrlenA (lpString="*.max") returned 5 [0074.218] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glow Edge.eftx", pszSpec="*.bmp") returned 0 [0074.218] lstrlenA (lpString="*.bmp") returned 5 [0074.218] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glow Edge.eftx", pszSpec="*.gif") returned 0 [0074.218] lstrlenA (lpString="*.gif") returned 5 [0074.218] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glow Edge.eftx", pszSpec="*.png") returned 0 [0074.218] lstrlenA (lpString="*.png") returned 5 [0074.218] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glow Edge.eftx", pszSpec="*.doc") returned 0 [0074.218] lstrlenA (lpString="*.doc") returned 5 [0074.218] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glow Edge.eftx", pszSpec="*.docx") returned 0 [0074.218] lstrlenA (lpString="*.docx") returned 6 [0074.218] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glow Edge.eftx", pszSpec="*.xls") returned 0 [0074.218] lstrlenA (lpString="*.xls") returned 5 [0074.218] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glow Edge.eftx", pszSpec="*.xlsx") returned 0 [0074.218] lstrlenA (lpString="*.xlsx") returned 6 [0074.218] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glow Edge.eftx", pszSpec="*.ppt") returned 0 [0074.218] lstrlenA (lpString="*.ppt") returned 5 [0074.218] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glow Edge.eftx", pszSpec="*.pptx") returned 0 [0074.218] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glow Edge.eftx", pszSpec="*.txt") returned 0 [0074.219] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xad32ac88, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x56208, dwReserved0=0x520043, dwReserved1=0x500059, cFileName="Grunge Texture.eftx", cAlternateFileName="GRUNGE~1.EFT")) returned 1 [0074.219] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.219] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Grunge Texture.eftx") returned -1 [0074.219] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Grunge Texture.eftx") returned 1 [0074.219] lstrcmpiA (lpString1="", lpString2="Grunge Texture.eftx") returned -1 [0074.219] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned="Glow Edge.eftx" [0074.219] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" [0074.219] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\") returned="" [0074.219] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" [0074.219] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme effects\\how to decrypt files.txt")) returned 0x20 [0074.219] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\", lpString2="Grunge Texture.eftx" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" [0074.219] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc2f37a03, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xafab, dwReserved0=0x520043, dwReserved1=0x500059, cFileName="Inset.eftx", cAlternateFileName="INSET~1.EFT")) returned 1 [0074.219] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.219] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Inset.eftx") returned -1 [0074.219] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Inset.eftx") returned -1 [0074.219] lstrcmpiA (lpString1="", lpString2="Inset.eftx") returned -1 [0074.219] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned="Grunge Texture.eftx" [0074.219] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" [0074.219] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\") returned="" [0074.219] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" [0074.219] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme effects\\how to decrypt files.txt")) returned 0x20 [0074.219] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\", lpString2="Inset.eftx" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Inset.eftx") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Inset.eftx" [0074.220] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc65dbb4d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb543, dwReserved0=0x520043, dwReserved1=0x500059, cFileName="Milk Glass.eftx", cAlternateFileName="MILKGL~1.EFT")) returned 1 [0074.220] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.220] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Milk Glass.eftx") returned -1 [0074.220] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Milk Glass.eftx") returned -1 [0074.220] lstrcmpiA (lpString1="", lpString2="Milk Glass.eftx") returned -1 [0074.220] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Inset.eftx") returned="Inset.eftx" [0074.220] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" [0074.220] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\") returned="" [0074.220] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" [0074.220] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme effects\\how to decrypt files.txt")) returned 0x20 [0074.220] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\", lpString2="Milk Glass.eftx" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" [0074.220] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb67119d6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb0ad, dwReserved0=0x520043, dwReserved1=0x500059, cFileName="Office 2007 - 2010.eftx", cAlternateFileName="OFFICE~1.EFT")) returned 1 [0074.220] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.220] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Office 2007 - 2010.eftx") returned -1 [0074.220] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office 2007 - 2010.eftx") returned -1 [0074.220] lstrcmpiA (lpString1="", lpString2="Office 2007 - 2010.eftx") returned -1 [0074.220] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned="Milk Glass.eftx" [0074.220] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" [0074.220] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\") returned="" [0074.220] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" [0074.220] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme effects\\how to decrypt files.txt")) returned 0x20 [0074.220] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\", lpString2="Office 2007 - 2010.eftx" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" [0074.221] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcab09547, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xbcee, dwReserved0=0x520043, dwReserved1=0x500059, cFileName="Reflection.eftx", cAlternateFileName="REFLEC~1.EFT")) returned 1 [0074.221] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.221] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Reflection.eftx") returned -1 [0074.221] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Reflection.eftx") returned -1 [0074.221] lstrcmpiA (lpString1="", lpString2="Reflection.eftx") returned -1 [0074.221] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned="Office 2007 - 2010.eftx" [0074.221] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" [0074.221] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\") returned="" [0074.221] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" [0074.221] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme effects\\how to decrypt files.txt")) returned 0x20 [0074.221] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\", lpString2="Reflection.eftx" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Reflection.eftx" [0074.221] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8aec1c2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x480a2, dwReserved0=0x520043, dwReserved1=0x500059, cFileName="Riblet.eftx", cAlternateFileName="RIBLET~1.EFT")) returned 1 [0074.221] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.221] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Riblet.eftx") returned -1 [0074.221] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Riblet.eftx") returned -1 [0074.221] lstrcmpiA (lpString1="", lpString2="Riblet.eftx") returned -1 [0074.221] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned="Reflection.eftx" [0074.221] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" [0074.221] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\") returned="" [0074.221] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" [0074.221] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme effects\\how to decrypt files.txt")) returned 0x20 [0074.221] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\", lpString2="Riblet.eftx" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Riblet.eftx" [0074.221] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb254478, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2d753, dwReserved0=0x520043, dwReserved1=0x500059, cFileName="Smokey Glass.eftx", cAlternateFileName="SMOKEY~1.EFT")) returned 1 [0074.221] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.222] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Smokey Glass.eftx") returned -1 [0074.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Smokey Glass.eftx") returned -1 [0074.222] lstrcmpiA (lpString1="", lpString2="Smokey Glass.eftx") returned -1 [0074.222] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned="Riblet.eftx" [0074.225] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" [0074.225] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\") returned="" [0074.225] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" [0074.226] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme effects\\how to decrypt files.txt")) returned 0x20 [0074.226] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\", lpString2="Smokey Glass.eftx" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" [0074.226] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb583b90, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb17b, dwReserved0=0x520043, dwReserved1=0x500059, cFileName="Subtle Solids.eftx", cAlternateFileName="SUBTLE~1.EFT")) returned 1 [0074.226] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.226] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Subtle Solids.eftx") returned -1 [0074.226] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Subtle Solids.eftx") returned -1 [0074.226] lstrcmpiA (lpString1="", lpString2="Subtle Solids.eftx") returned -1 [0074.226] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned="Smokey Glass.eftx" [0074.226] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" [0074.226] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\") returned="" [0074.226] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" [0074.226] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme effects\\how to decrypt files.txt")) returned 0x20 [0074.226] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\", lpString2="Subtle Solids.eftx" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" [0074.226] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb97a4758, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xde70, dwReserved0=0x520043, dwReserved1=0x500059, cFileName="Top Shadow.eftx", cAlternateFileName="TOPSHA~1.EFT")) returned 1 [0074.226] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.226] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Top Shadow.eftx") returned -1 [0074.226] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Top Shadow.eftx") returned -1 [0074.226] lstrcmpiA (lpString1="", lpString2="Top Shadow.eftx") returned -1 [0074.226] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned="Subtle Solids.eftx" [0074.226] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" [0074.226] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\") returned="" [0074.226] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" [0074.226] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme effects\\how to decrypt files.txt")) returned 0x20 [0074.227] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\", lpString2="Top Shadow.eftx" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" [0074.227] FindNextFileA (in: hFindFile=0x636970, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb97a4758, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xde70, dwReserved0=0x520043, dwReserved1=0x500059, cFileName="Top Shadow.eftx", cAlternateFileName="TOPSHA~1.EFT")) returned 0 [0074.227] FindClose (in: hFindFile=0x636970 | out: hFindFile=0x636970) returned 1 [0074.227] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9581407, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0xcb8cb980, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xcb8cb980, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1 [0074.227] lstrcmpA (lpString1=".", lpString2="Theme Fonts") returned -1 [0074.227] lstrcmpA (lpString1="..", lpString2="Theme Fonts") returned -1 [0074.227] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\*.*") returned="*.*" [0074.227] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\", lpString2="Theme Fonts" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts" [0074.227] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\*.*" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme fonts\\*.*"), lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9581407, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0xcb8cb980, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xcb8cb980, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520043, dwReserved1=0x500059, cFileName=".", cAlternateFileName="")) returned 0x636870 [0074.270] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.270] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9581407, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0xcb8cb980, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xcb8cb980, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520043, dwReserved1=0x500059, cFileName="..", cAlternateFileName="")) returned 1 [0074.283] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.283] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.283] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xa9594c97, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xdc9, dwReserved0=0x520043, dwReserved1=0x500059, cFileName="Arial Black-Arial.xml", cAlternateFileName="ARIALB~1.XML")) returned 1 [0074.283] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.283] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Arial Black-Arial.xml") returned 1 [0074.283] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Arial Black-Arial.xml") returned 1 [0074.283] lstrcmpiA (lpString1="", lpString2="Arial Black-Arial.xml") returned -1 [0074.284] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\*.*") returned="*.*" [0074.284] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" [0074.284] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="" [0074.284] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" [0074.284] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme fonts\\how to decrypt files.txt")) returned 0xffffffff [0074.284] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme fonts\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0074.285] WriteFile (in: hFile=0x1cc, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0074.286] SetFileTime (hFile=0x1cc, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.286] CloseHandle (hObject=0x1cc) returned 1 [0074.286] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="Arial Black-Arial.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml" [0074.286] lstrlenA (lpString="*.zip") returned 5 [0074.286] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.rar") returned 0 [0074.286] lstrlenA (lpString="*.rar") returned 5 [0074.287] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.7z") returned 0 [0074.287] lstrlenA (lpString="*.7z") returned 4 [0074.287] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.tar") returned 0 [0074.287] lstrlenA (lpString="*.tar") returned 5 [0074.287] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.gzip") returned 0 [0074.287] lstrlenA (lpString="*.gzip") returned 6 [0074.287] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.jpg") returned 0 [0074.287] lstrlenA (lpString="*.jpg") returned 5 [0074.287] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.jpeg") returned 0 [0074.287] lstrlenA (lpString="*.jpeg") returned 6 [0074.287] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.psd") returned 0 [0074.287] lstrlenA (lpString="*.psd") returned 5 [0074.287] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.cdr") returned 0 [0074.287] lstrlenA (lpString="*.cdr") returned 5 [0074.287] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.dwg") returned 0 [0074.287] lstrlenA (lpString="*.dwg") returned 5 [0074.287] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.max") returned 0 [0074.287] lstrlenA (lpString="*.max") returned 5 [0074.287] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.bmp") returned 0 [0074.287] lstrlenA (lpString="*.bmp") returned 5 [0074.287] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.gif") returned 0 [0074.287] lstrlenA (lpString="*.gif") returned 5 [0074.287] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.png") returned 0 [0074.287] lstrlenA (lpString="*.png") returned 5 [0074.287] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.doc") returned 0 [0074.287] lstrlenA (lpString="*.doc") returned 5 [0074.287] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.docx") returned 0 [0074.287] lstrlenA (lpString="*.docx") returned 6 [0074.287] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.xls") returned 0 [0074.287] lstrlenA (lpString="*.xls") returned 5 [0074.288] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.xlsx") returned 0 [0074.288] lstrlenA (lpString="*.xlsx") returned 6 [0074.288] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.ppt") returned 0 [0074.288] lstrlenA (lpString="*.ppt") returned 5 [0074.288] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.pptx") returned 0 [0074.288] lstrlenA (lpString="*.pptx") returned 6 [0074.288] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.txt") returned 0 [0074.288] lstrlenA (lpString="*.txt") returned 5 [0074.288] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.pdf") returned 0 [0074.288] lstrlenA (lpString="*.pdf") returned 5 [0074.288] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.djvu") returned 0 [0074.288] lstrlenA (lpString="*.djvu") returned 6 [0074.288] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.htm") returned 0 [0074.288] lstrlenA (lpString="*.htm") returned 5 [0074.288] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.html") returned 0 [0074.288] lstrlenA (lpString="*.html") returned 6 [0074.288] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.mdb") returned 0 [0074.288] lstrlenA (lpString="*.mdb") returned 5 [0074.288] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.cer") returned 0 [0074.288] lstrlenA (lpString="*.cer") returned 5 [0074.288] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.p12") returned 0 [0074.288] lstrlenA (lpString="*.p12") returned 5 [0074.288] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.pfx") returned 0 [0074.288] lstrlenA (lpString="*.pfx") returned 5 [0074.288] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.kwm") returned 0 [0074.288] lstrlenA (lpString="*.kwm") returned 5 [0074.288] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.pwm") returned 0 [0074.288] lstrlenA (lpString="*.pwm") returned 5 [0074.288] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.1cd") returned 0 [0074.288] lstrlenA (lpString="*.1cd") returned 5 [0074.288] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.md") returned 0 [0074.288] lstrlenA (lpString="*.md") returned 4 [0074.288] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.mdf") returned 0 [0074.288] lstrlenA (lpString="*.mdf") returned 5 [0074.288] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.dbf") returned 0 [0074.289] lstrlenA (lpString="*.dbf") returned 5 [0074.289] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.odt") returned 0 [0074.289] lstrlenA (lpString="*.odt") returned 5 [0074.289] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.vob") returned 0 [0074.289] lstrlenA (lpString="*.vob") returned 5 [0074.289] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.ifo") returned 0 [0074.289] lstrlenA (lpString="*.ifo") returned 5 [0074.289] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.lnk") returned 0 [0074.289] lstrlenA (lpString="*.lnk") returned 5 [0074.289] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.torrent") returned 0 [0074.289] lstrlenA (lpString="*.torrent") returned 9 [0074.289] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.mov") returned 0 [0074.289] lstrlenA (lpString="*.mov") returned 5 [0074.289] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.m2v") returned 0 [0074.289] lstrlenA (lpString="*.m2v") returned 5 [0074.289] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.3gp") returned 0 [0074.289] lstrlenA (lpString="*.3gp") returned 5 [0074.289] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.mpeg") returned 0 [0074.289] lstrlenA (lpString="*.mpeg") returned 6 [0074.289] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.mpg") returned 0 [0074.289] lstrlenA (lpString="*.mpg") returned 5 [0074.289] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.flv") returned 0 [0074.289] lstrlenA (lpString="*.flv") returned 5 [0074.289] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.avi") returned 0 [0074.289] lstrlenA (lpString="*.avi") returned 5 [0074.289] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.mp4") returned 0 [0074.289] lstrlenA (lpString="*.mp4") returned 5 [0074.289] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.wmv") returned 0 [0074.289] lstrlenA (lpString="*.wmv") returned 5 [0074.289] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.divx") returned 0 [0074.289] lstrlenA (lpString="*.divx") returned 6 [0074.289] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.mkv") returned 0 [0074.289] lstrlenA (lpString="*.mkv") returned 5 [0074.289] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.mp3") returned 0 [0074.289] lstrlenA (lpString="*.mp3") returned 5 [0074.290] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.wav") returned 0 [0074.290] lstrlenA (lpString="*.wav") returned 5 [0074.290] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.flac") returned 0 [0074.290] lstrlenA (lpString="*.flac") returned 6 [0074.290] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.ape") returned 0 [0074.290] lstrlenA (lpString="*.ape") returned 5 [0074.290] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.wma") returned 0 [0074.290] lstrlenA (lpString="*.wma") returned 5 [0074.290] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.ac3") returned 0 [0074.290] lstrlenA (lpString="*.ac3") returned 5 [0074.290] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xa95a71b0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xde1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Arial-Times New Roman.xml", cAlternateFileName="ARIAL-~1.XML")) returned 1 [0074.290] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.290] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Arial-Times New Roman.xml") returned 1 [0074.290] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Arial-Times New Roman.xml") returned 1 [0074.290] lstrcmpiA (lpString1="", lpString2="Arial-Times New Roman.xml") returned -1 [0074.290] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml") returned="Arial Black-Arial.xml" [0074.290] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" [0074.290] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="" [0074.290] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" [0074.290] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme fonts\\how to decrypt files.txt")) returned 0x20 [0074.290] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="Arial-Times New Roman.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml" [0074.290] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.zip") returned 0 [0074.290] lstrlenA (lpString="*.zip") returned 5 [0074.290] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.rar") returned 0 [0074.290] lstrlenA (lpString="*.rar") returned 5 [0074.290] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.7z") returned 0 [0074.290] lstrlenA (lpString="*.7z") returned 4 [0074.290] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.tar") returned 0 [0074.290] lstrlenA (lpString="*.tar") returned 5 [0074.290] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.gzip") returned 0 [0074.291] lstrlenA (lpString="*.gzip") returned 6 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.jpg") returned 0 [0074.291] lstrlenA (lpString="*.jpg") returned 5 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.jpeg") returned 0 [0074.291] lstrlenA (lpString="*.jpeg") returned 6 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.psd") returned 0 [0074.291] lstrlenA (lpString="*.psd") returned 5 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.cdr") returned 0 [0074.291] lstrlenA (lpString="*.cdr") returned 5 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.dwg") returned 0 [0074.291] lstrlenA (lpString="*.dwg") returned 5 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.max") returned 0 [0074.291] lstrlenA (lpString="*.max") returned 5 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.bmp") returned 0 [0074.291] lstrlenA (lpString="*.bmp") returned 5 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.gif") returned 0 [0074.291] lstrlenA (lpString="*.gif") returned 5 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.png") returned 0 [0074.291] lstrlenA (lpString="*.png") returned 5 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.doc") returned 0 [0074.291] lstrlenA (lpString="*.doc") returned 5 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.docx") returned 0 [0074.291] lstrlenA (lpString="*.docx") returned 6 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.xls") returned 0 [0074.291] lstrlenA (lpString="*.xls") returned 5 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.xlsx") returned 0 [0074.291] lstrlenA (lpString="*.xlsx") returned 6 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.ppt") returned 0 [0074.291] lstrlenA (lpString="*.ppt") returned 5 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.pptx") returned 0 [0074.291] lstrlenA (lpString="*.pptx") returned 6 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.txt") returned 0 [0074.291] lstrlenA (lpString="*.txt") returned 5 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.pdf") returned 0 [0074.292] lstrlenA (lpString="*.pdf") returned 5 [0074.292] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.djvu") returned 0 [0074.292] lstrlenA (lpString="*.djvu") returned 6 [0074.292] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.htm") returned 0 [0074.292] lstrlenA (lpString="*.htm") returned 5 [0074.292] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.html") returned 0 [0074.292] lstrlenA (lpString="*.html") returned 6 [0074.292] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.mdb") returned 0 [0074.292] lstrlenA (lpString="*.mdb") returned 5 [0074.292] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.cer") returned 0 [0074.292] lstrlenA (lpString="*.cer") returned 5 [0074.292] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.p12") returned 0 [0074.292] lstrlenA (lpString="*.p12") returned 5 [0074.292] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.pfx") returned 0 [0074.292] lstrlenA (lpString="*.pfx") returned 5 [0074.292] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.kwm") returned 0 [0074.292] lstrlenA (lpString="*.kwm") returned 5 [0074.292] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.pwm") returned 0 [0074.292] lstrlenA (lpString="*.pwm") returned 5 [0074.292] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.1cd") returned 0 [0074.292] lstrlenA (lpString="*.1cd") returned 5 [0074.292] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.md") returned 0 [0074.292] lstrlenA (lpString="*.md") returned 4 [0074.292] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.mdf") returned 0 [0074.292] lstrlenA (lpString="*.mdf") returned 5 [0074.292] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.dbf") returned 0 [0074.292] lstrlenA (lpString="*.dbf") returned 5 [0074.292] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.odt") returned 0 [0074.292] lstrlenA (lpString="*.odt") returned 5 [0074.292] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.vob") returned 0 [0074.292] lstrlenA (lpString="*.vob") returned 5 [0074.292] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.ifo") returned 0 [0074.292] lstrlenA (lpString="*.ifo") returned 5 [0074.293] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.lnk") returned 0 [0074.293] lstrlenA (lpString="*.lnk") returned 5 [0074.293] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.torrent") returned 0 [0074.293] lstrlenA (lpString="*.torrent") returned 9 [0074.293] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.mov") returned 0 [0074.293] lstrlenA (lpString="*.mov") returned 5 [0074.293] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.m2v") returned 0 [0074.293] lstrlenA (lpString="*.m2v") returned 5 [0074.293] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.3gp") returned 0 [0074.293] lstrlenA (lpString="*.3gp") returned 5 [0074.293] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.mpeg") returned 0 [0074.293] lstrlenA (lpString="*.mpeg") returned 6 [0074.293] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.mpg") returned 0 [0074.293] lstrlenA (lpString="*.mpg") returned 5 [0074.293] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.flv") returned 0 [0074.293] lstrlenA (lpString="*.flv") returned 5 [0074.293] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.avi") returned 0 [0074.293] lstrlenA (lpString="*.avi") returned 5 [0074.293] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.mp4") returned 0 [0074.293] lstrlenA (lpString="*.mp4") returned 5 [0074.293] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.wmv") returned 0 [0074.293] lstrlenA (lpString="*.wmv") returned 5 [0074.293] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.divx") returned 0 [0074.293] lstrlenA (lpString="*.divx") returned 6 [0074.293] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.mkv") returned 0 [0074.293] lstrlenA (lpString="*.mkv") returned 5 [0074.293] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.mp3") returned 0 [0074.293] lstrlenA (lpString="*.mp3") returned 5 [0074.293] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.wav") returned 0 [0074.293] lstrlenA (lpString="*.wav") returned 5 [0074.293] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.flac") returned 0 [0074.293] lstrlenA (lpString="*.flac") returned 6 [0074.293] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.ape") returned 0 [0074.294] lstrlenA (lpString="*.ape") returned 5 [0074.294] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.wma") returned 0 [0074.294] lstrlenA (lpString="*.wma") returned 5 [0074.294] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.ac3") returned 0 [0074.294] lstrlenA (lpString="*.ac3") returned 5 [0074.294] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xa958d757, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xdb0, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Arial.xml", cAlternateFileName="")) returned 1 [0074.294] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.294] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Arial.xml") returned 1 [0074.294] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Arial.xml") returned 1 [0074.294] lstrcmpiA (lpString1="", lpString2="Arial.xml") returned -1 [0074.294] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml") returned="Arial-Times New Roman.xml" [0074.294] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" [0074.294] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="" [0074.294] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" [0074.294] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme fonts\\how to decrypt files.txt")) returned 0x20 [0074.294] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="Arial.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml" [0074.294] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.zip") returned 0 [0074.294] lstrlenA (lpString="*.zip") returned 5 [0074.294] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.rar") returned 0 [0074.294] lstrlenA (lpString="*.rar") returned 5 [0074.294] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.7z") returned 0 [0074.294] lstrlenA (lpString="*.7z") returned 4 [0074.294] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.tar") returned 0 [0074.294] lstrlenA (lpString="*.tar") returned 5 [0074.294] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.gzip") returned 0 [0074.294] lstrlenA (lpString="*.gzip") returned 6 [0074.294] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.jpg") returned 0 [0074.294] lstrlenA (lpString="*.jpg") returned 5 [0074.294] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.jpeg") returned 0 [0074.294] lstrlenA (lpString="*.jpeg") returned 6 [0074.294] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.psd") returned 0 [0074.295] lstrlenA (lpString="*.psd") returned 5 [0074.295] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.cdr") returned 0 [0074.295] lstrlenA (lpString="*.cdr") returned 5 [0074.295] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.dwg") returned 0 [0074.295] lstrlenA (lpString="*.dwg") returned 5 [0074.295] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.max") returned 0 [0074.295] lstrlenA (lpString="*.max") returned 5 [0074.295] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.bmp") returned 0 [0074.295] lstrlenA (lpString="*.bmp") returned 5 [0074.295] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.gif") returned 0 [0074.295] lstrlenA (lpString="*.gif") returned 5 [0074.295] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.png") returned 0 [0074.295] lstrlenA (lpString="*.png") returned 5 [0074.295] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.doc") returned 0 [0074.295] lstrlenA (lpString="*.doc") returned 5 [0074.295] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.docx") returned 0 [0074.295] lstrlenA (lpString="*.docx") returned 6 [0074.295] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.xls") returned 0 [0074.295] lstrlenA (lpString="*.xls") returned 5 [0074.295] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.xlsx") returned 0 [0074.295] lstrlenA (lpString="*.xlsx") returned 6 [0074.295] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.ppt") returned 0 [0074.295] lstrlenA (lpString="*.ppt") returned 5 [0074.295] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.pptx") returned 0 [0074.295] lstrlenA (lpString="*.pptx") returned 6 [0074.295] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.txt") returned 0 [0074.295] lstrlenA (lpString="*.txt") returned 5 [0074.295] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.pdf") returned 0 [0074.295] lstrlenA (lpString="*.pdf") returned 5 [0074.295] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.djvu") returned 0 [0074.295] lstrlenA (lpString="*.djvu") returned 6 [0074.295] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.htm") returned 0 [0074.295] lstrlenA (lpString="*.htm") returned 5 [0074.295] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.html") returned 0 [0074.296] lstrlenA (lpString="*.html") returned 6 [0074.296] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.mdb") returned 0 [0074.296] lstrlenA (lpString="*.mdb") returned 5 [0074.296] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.cer") returned 0 [0074.296] lstrlenA (lpString="*.cer") returned 5 [0074.296] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.p12") returned 0 [0074.296] lstrlenA (lpString="*.p12") returned 5 [0074.296] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.pfx") returned 0 [0074.296] lstrlenA (lpString="*.pfx") returned 5 [0074.296] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.kwm") returned 0 [0074.296] lstrlenA (lpString="*.kwm") returned 5 [0074.296] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.pwm") returned 0 [0074.296] lstrlenA (lpString="*.pwm") returned 5 [0074.296] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.1cd") returned 0 [0074.296] lstrlenA (lpString="*.1cd") returned 5 [0074.296] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.md") returned 0 [0074.296] lstrlenA (lpString="*.md") returned 4 [0074.296] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.mdf") returned 0 [0074.296] lstrlenA (lpString="*.mdf") returned 5 [0074.296] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.dbf") returned 0 [0074.296] lstrlenA (lpString="*.dbf") returned 5 [0074.296] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.odt") returned 0 [0074.296] lstrlenA (lpString="*.odt") returned 5 [0074.296] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.vob") returned 0 [0074.296] lstrlenA (lpString="*.vob") returned 5 [0074.296] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.ifo") returned 0 [0074.296] lstrlenA (lpString="*.ifo") returned 5 [0074.296] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.lnk") returned 0 [0074.296] lstrlenA (lpString="*.lnk") returned 5 [0074.296] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.torrent") returned 0 [0074.296] lstrlenA (lpString="*.torrent") returned 9 [0074.296] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.mov") returned 0 [0074.296] lstrlenA (lpString="*.mov") returned 5 [0074.297] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.m2v") returned 0 [0074.297] lstrlenA (lpString="*.m2v") returned 5 [0074.297] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.3gp") returned 0 [0074.297] lstrlenA (lpString="*.3gp") returned 5 [0074.297] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.mpeg") returned 0 [0074.297] lstrlenA (lpString="*.mpeg") returned 6 [0074.297] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.mpg") returned 0 [0074.297] lstrlenA (lpString="*.mpg") returned 5 [0074.297] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.flv") returned 0 [0074.297] lstrlenA (lpString="*.flv") returned 5 [0074.297] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.avi") returned 0 [0074.297] lstrlenA (lpString="*.avi") returned 5 [0074.297] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.mp4") returned 0 [0074.297] lstrlenA (lpString="*.mp4") returned 5 [0074.297] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.wmv") returned 0 [0074.297] lstrlenA (lpString="*.wmv") returned 5 [0074.297] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.divx") returned 0 [0074.297] lstrlenA (lpString="*.divx") returned 6 [0074.297] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.mkv") returned 0 [0074.297] lstrlenA (lpString="*.mkv") returned 5 [0074.297] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.mp3") returned 0 [0074.297] lstrlenA (lpString="*.mp3") returned 5 [0074.297] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.wav") returned 0 [0074.297] lstrlenA (lpString="*.wav") returned 5 [0074.297] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.flac") returned 0 [0074.297] lstrlenA (lpString="*.flac") returned 6 [0074.297] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.ape") returned 0 [0074.297] lstrlenA (lpString="*.ape") returned 5 [0074.297] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.wma") returned 0 [0074.297] lstrlenA (lpString="*.wma") returned 5 [0074.297] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.ac3") returned 0 [0074.297] lstrlenA (lpString="*.ac3") returned 5 [0074.297] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaa93d699, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xdff, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Calibri Light-Constantia.xml", cAlternateFileName="CALIBR~1.XML")) returned 1 [0074.298] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.298] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Calibri Light-Constantia.xml") returned 1 [0074.298] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Calibri Light-Constantia.xml") returned 1 [0074.298] lstrcmpiA (lpString1="", lpString2="Calibri Light-Constantia.xml") returned -1 [0074.298] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Arial.xml") returned="Arial.xml" [0074.298] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" [0074.298] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="" [0074.298] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" [0074.298] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme fonts\\how to decrypt files.txt")) returned 0x20 [0074.298] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="Calibri Light-Constantia.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml" [0074.298] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.zip") returned 0 [0074.298] lstrlenA (lpString="*.zip") returned 5 [0074.298] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.rar") returned 0 [0074.298] lstrlenA (lpString="*.rar") returned 5 [0074.298] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.7z") returned 0 [0074.298] lstrlenA (lpString="*.7z") returned 4 [0074.298] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.tar") returned 0 [0074.298] lstrlenA (lpString="*.tar") returned 5 [0074.298] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.gzip") returned 0 [0074.298] lstrlenA (lpString="*.gzip") returned 6 [0074.298] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.jpg") returned 0 [0074.298] lstrlenA (lpString="*.jpg") returned 5 [0074.298] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.jpeg") returned 0 [0074.298] lstrlenA (lpString="*.jpeg") returned 6 [0074.298] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.psd") returned 0 [0074.298] lstrlenA (lpString="*.psd") returned 5 [0074.298] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.cdr") returned 0 [0074.298] lstrlenA (lpString="*.cdr") returned 5 [0074.298] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.dwg") returned 0 [0074.298] lstrlenA (lpString="*.dwg") returned 5 [0074.299] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.max") returned 0 [0074.299] lstrlenA (lpString="*.max") returned 5 [0074.299] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.bmp") returned 0 [0074.299] lstrlenA (lpString="*.bmp") returned 5 [0074.299] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.gif") returned 0 [0074.299] lstrlenA (lpString="*.gif") returned 5 [0074.299] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.png") returned 0 [0074.299] lstrlenA (lpString="*.png") returned 5 [0074.299] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.doc") returned 0 [0074.299] lstrlenA (lpString="*.doc") returned 5 [0074.299] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.docx") returned 0 [0074.299] lstrlenA (lpString="*.docx") returned 6 [0074.299] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.xls") returned 0 [0074.299] lstrlenA (lpString="*.xls") returned 5 [0074.299] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.xlsx") returned 0 [0074.299] lstrlenA (lpString="*.xlsx") returned 6 [0074.299] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.ppt") returned 0 [0074.299] lstrlenA (lpString="*.ppt") returned 5 [0074.299] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.pptx") returned 0 [0074.299] lstrlenA (lpString="*.pptx") returned 6 [0074.299] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.txt") returned 0 [0074.299] lstrlenA (lpString="*.txt") returned 5 [0074.299] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.pdf") returned 0 [0074.299] lstrlenA (lpString="*.pdf") returned 5 [0074.299] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.djvu") returned 0 [0074.299] lstrlenA (lpString="*.djvu") returned 6 [0074.299] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.htm") returned 0 [0074.299] lstrlenA (lpString="*.htm") returned 5 [0074.299] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.html") returned 0 [0074.299] lstrlenA (lpString="*.html") returned 6 [0074.299] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.mdb") returned 0 [0074.299] lstrlenA (lpString="*.mdb") returned 5 [0074.299] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.cer") returned 0 [0074.300] lstrlenA (lpString="*.cer") returned 5 [0074.300] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.p12") returned 0 [0074.300] lstrlenA (lpString="*.p12") returned 5 [0074.300] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.pfx") returned 0 [0074.300] lstrlenA (lpString="*.pfx") returned 5 [0074.300] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.kwm") returned 0 [0074.300] lstrlenA (lpString="*.kwm") returned 5 [0074.300] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.pwm") returned 0 [0074.300] lstrlenA (lpString="*.pwm") returned 5 [0074.300] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.1cd") returned 0 [0074.300] lstrlenA (lpString="*.1cd") returned 5 [0074.300] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.md") returned 0 [0074.300] lstrlenA (lpString="*.md") returned 4 [0074.300] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.mdf") returned 0 [0074.300] lstrlenA (lpString="*.mdf") returned 5 [0074.300] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.dbf") returned 0 [0074.300] lstrlenA (lpString="*.dbf") returned 5 [0074.300] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.odt") returned 0 [0074.300] lstrlenA (lpString="*.odt") returned 5 [0074.300] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.vob") returned 0 [0074.301] lstrlenA (lpString="*.vob") returned 5 [0074.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.ifo") returned 0 [0074.301] lstrlenA (lpString="*.ifo") returned 5 [0074.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.lnk") returned 0 [0074.301] lstrlenA (lpString="*.lnk") returned 5 [0074.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.torrent") returned 0 [0074.301] lstrlenA (lpString="*.torrent") returned 9 [0074.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.mov") returned 0 [0074.301] lstrlenA (lpString="*.mov") returned 5 [0074.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.m2v") returned 0 [0074.301] lstrlenA (lpString="*.m2v") returned 5 [0074.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.3gp") returned 0 [0074.301] lstrlenA (lpString="*.3gp") returned 5 [0074.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.mpeg") returned 0 [0074.301] lstrlenA (lpString="*.mpeg") returned 6 [0074.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.mpg") returned 0 [0074.301] lstrlenA (lpString="*.mpg") returned 5 [0074.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.flv") returned 0 [0074.301] lstrlenA (lpString="*.flv") returned 5 [0074.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.avi") returned 0 [0074.301] lstrlenA (lpString="*.avi") returned 5 [0074.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.mp4") returned 0 [0074.301] lstrlenA (lpString="*.mp4") returned 5 [0074.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.wmv") returned 0 [0074.301] lstrlenA (lpString="*.wmv") returned 5 [0074.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.divx") returned 0 [0074.301] lstrlenA (lpString="*.divx") returned 6 [0074.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.mkv") returned 0 [0074.301] lstrlenA (lpString="*.mkv") returned 5 [0074.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.mp3") returned 0 [0074.301] lstrlenA (lpString="*.mp3") returned 5 [0074.302] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.wav") returned 0 [0074.302] lstrlenA (lpString="*.wav") returned 5 [0074.302] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.flac") returned 0 [0074.302] lstrlenA (lpString="*.flac") returned 6 [0074.302] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.ape") returned 0 [0074.302] lstrlenA (lpString="*.ape") returned 5 [0074.302] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.wma") returned 0 [0074.302] lstrlenA (lpString="*.wma") returned 5 [0074.302] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.ac3") returned 0 [0074.302] lstrlenA (lpString="*.ac3") returned 5 [0074.302] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc09c2a8a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xdd6, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Calibri-Cambria.xml", cAlternateFileName="CALIBR~2.XML")) returned 1 [0074.302] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.302] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Calibri-Cambria.xml") returned 1 [0074.302] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Calibri-Cambria.xml") returned 1 [0074.302] lstrcmpiA (lpString1="", lpString2="Calibri-Cambria.xml") returned -1 [0074.302] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml") returned="Calibri Light-Constantia.xml" [0074.302] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" [0074.302] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="" [0074.302] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" [0074.302] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme fonts\\how to decrypt files.txt")) returned 0x20 [0074.302] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="Calibri-Cambria.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml" [0074.302] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml", pszSpec="*.zip") returned 0 [0074.302] lstrlenA (lpString="*.zip") returned 5 [0074.302] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml", pszSpec="*.rar") returned 0 [0074.302] lstrlenA (lpString="*.rar") returned 5 [0074.302] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml", pszSpec="*.7z") returned 0 [0074.302] lstrlenA (lpString="*.7z") returned 4 [0074.302] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml", pszSpec="*.tar") returned 0 [0074.302] lstrlenA (lpString="*.tar") returned 5 [0074.302] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml", pszSpec="*.gzip") returned 0 [0074.303] lstrlenA (lpString="*.gzip") returned 6 [0074.303] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml", pszSpec="*.jpg") returned 0 [0074.303] lstrlenA (lpString="*.jpg") returned 5 [0074.303] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml", pszSpec="*.jpeg") returned 0 [0074.303] lstrlenA (lpString="*.jpeg") returned 6 [0074.303] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml", pszSpec="*.psd") returned 0 [0074.303] lstrlenA (lpString="*.psd") returned 5 [0074.303] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml", pszSpec="*.cdr") returned 0 [0074.303] lstrlenA (lpString="*.cdr") returned 5 [0074.303] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml", pszSpec="*.dwg") returned 0 [0074.303] lstrlenA (lpString="*.dwg") returned 5 [0074.303] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml", pszSpec="*.max") returned 0 [0074.303] lstrlenA (lpString="*.max") returned 5 [0074.303] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml", pszSpec="*.bmp") returned 0 [0074.303] lstrlenA (lpString="*.bmp") returned 5 [0074.303] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml", pszSpec="*.gif") returned 0 [0074.303] lstrlenA (lpString="*.gif") returned 5 [0074.303] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml", pszSpec="*.png") returned 0 [0074.303] lstrlenA (lpString="*.png") returned 5 [0074.303] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml", pszSpec="*.doc") returned 0 [0074.303] lstrlenA (lpString="*.doc") returned 5 [0074.303] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml", pszSpec="*.docx") returned 0 [0074.303] lstrlenA (lpString="*.docx") returned 6 [0074.303] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml", pszSpec="*.xls") returned 0 [0074.303] lstrlenA (lpString="*.xls") returned 5 [0074.303] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml", pszSpec="*.xlsx") returned 0 [0074.303] lstrlenA (lpString="*.xlsx") returned 6 [0074.303] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml", pszSpec="*.ppt") returned 0 [0074.303] lstrlenA (lpString="*.ppt") returned 5 [0074.303] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml", pszSpec="*.pptx") returned 0 [0074.303] lstrlenA (lpString="*.pptx") returned 6 [0074.303] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml", pszSpec="*.txt") returned 0 [0074.303] lstrlenA (lpString="*.txt") returned 5 [0074.303] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml", pszSpec="*.pdf") returned 0 [0074.304] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaa939ef0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xdac, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Calibri.xml", cAlternateFileName="")) returned 1 [0074.304] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.304] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Calibri.xml") returned 1 [0074.304] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Calibri.xml") returned 1 [0074.304] lstrcmpiA (lpString1="", lpString2="Calibri.xml") returned -1 [0074.304] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml") returned="Calibri-Cambria.xml" [0074.304] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" [0074.304] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="" [0074.304] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" [0074.304] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme fonts\\how to decrypt files.txt")) returned 0x20 [0074.304] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="Calibri.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri.xml" [0074.304] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc0a00e16, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Cambria.xml", cAlternateFileName="")) returned 1 [0074.304] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.304] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Cambria.xml") returned 1 [0074.304] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Cambria.xml") returned 1 [0074.304] lstrcmpiA (lpString1="", lpString2="Cambria.xml") returned -1 [0074.304] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Calibri.xml") returned="Calibri.xml" [0074.304] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" [0074.304] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="" [0074.304] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" [0074.304] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme fonts\\how to decrypt files.txt")) returned 0x20 [0074.305] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="Cambria.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Cambria.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Cambria.xml" [0074.305] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaa9844cb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xdc0, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Candara.xml", cAlternateFileName="")) returned 1 [0074.305] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.305] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Candara.xml") returned 1 [0074.305] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Candara.xml") returned 1 [0074.305] lstrcmpiA (lpString1="", lpString2="Candara.xml") returned -1 [0074.305] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Cambria.xml") returned="Cambria.xml" [0074.305] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" [0074.305] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="" [0074.305] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" [0074.305] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme fonts\\how to decrypt files.txt")) returned 0x20 [0074.305] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="Candara.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Candara.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Candara.xml" [0074.305] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc0a21d8f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe38, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Century Gothic-Palatino Linotype.xml", cAlternateFileName="CENTUR~3.XML")) returned 1 [0074.305] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.305] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Century Gothic-Palatino Linotype.xml") returned 1 [0074.305] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Century Gothic-Palatino Linotype.xml") returned 1 [0074.305] lstrcmpiA (lpString1="", lpString2="Century Gothic-Palatino Linotype.xml") returned -1 [0074.305] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Candara.xml") returned="Candara.xml" [0074.305] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" [0074.305] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="" [0074.305] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" [0074.305] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme fonts\\how to decrypt files.txt")) returned 0x20 [0074.305] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="Century Gothic-Palatino Linotype.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Century Gothic-Palatino Linotype.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Century Gothic-Palatino Linotype.xml" [0074.305] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc0a1cf46, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xdd7, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Century Gothic.xml", cAlternateFileName="CENTUR~2.XML")) returned 1 [0074.306] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.306] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Century Gothic.xml") returned 1 [0074.306] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Century Gothic.xml") returned 1 [0074.306] lstrcmpiA (lpString1="", lpString2="Century Gothic.xml") returned -1 [0074.306] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Century Gothic-Palatino Linotype.xml") returned="Century Gothic-Palatino Linotype.xml" [0074.306] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" [0074.306] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="" [0074.306] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" [0074.306] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme fonts\\how to decrypt files.txt")) returned 0x20 [0074.306] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="Century Gothic.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Century Gothic.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Century Gothic.xml" [0074.306] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaa9e851a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe1f, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Century Schoolbook.xml", cAlternateFileName="CENTUR~1.XML")) returned 1 [0074.306] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.306] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Century Schoolbook.xml") returned 1 [0074.306] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Century Schoolbook.xml") returned 1 [0074.306] lstrcmpiA (lpString1="", lpString2="Century Schoolbook.xml") returned -1 [0074.306] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Century Gothic.xml") returned="Century Gothic.xml" [0074.306] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" [0074.306] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="" [0074.306] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" [0074.306] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme fonts\\how to decrypt files.txt")) returned 0x20 [0074.306] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="Century Schoolbook.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Century Schoolbook.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Century Schoolbook.xml" [0074.306] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc0df89f7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Consolas-Verdana.xml", cAlternateFileName="CONSOL~1.XML")) returned 1 [0074.306] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.306] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Consolas-Verdana.xml") returned 1 [0074.306] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Consolas-Verdana.xml") returned 1 [0074.307] lstrcmpiA (lpString1="", lpString2="Consolas-Verdana.xml") returned -1 [0074.307] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Century Schoolbook.xml") returned="Century Schoolbook.xml" [0074.307] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" [0074.307] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="" [0074.307] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" [0074.307] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme fonts\\how to decrypt files.txt")) returned 0x20 [0074.307] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="Consolas-Verdana.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Consolas-Verdana.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Consolas-Verdana.xml" [0074.307] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaaba7159, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xdf6, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Constantia-Franklin Gothic Book.xml", cAlternateFileName="CONSTA~1.XML")) returned 1 [0074.307] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.307] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Constantia-Franklin Gothic Book.xml") returned 1 [0074.307] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Constantia-Franklin Gothic Book.xml") returned 1 [0074.307] lstrcmpiA (lpString1="", lpString2="Constantia-Franklin Gothic Book.xml") returned -1 [0074.307] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Consolas-Verdana.xml") returned="Consolas-Verdana.xml" [0074.307] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" [0074.307] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="" [0074.307] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" [0074.307] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme fonts\\how to decrypt files.txt")) returned 0x20 [0074.307] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="Constantia-Franklin Gothic Book.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Constantia-Franklin Gothic Book.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Constantia-Franklin Gothic Book.xml" [0074.307] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc0e6e97d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xdbd, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Corbel.xml", cAlternateFileName="")) returned 1 [0074.307] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.307] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Corbel.xml") returned 1 [0074.307] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Corbel.xml") returned 1 [0074.307] lstrcmpiA (lpString1="", lpString2="Corbel.xml") returned -1 [0074.307] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Constantia-Franklin Gothic Book.xml") returned="Constantia-Franklin Gothic Book.xml" [0074.307] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" [0074.307] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="" [0074.308] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" [0074.308] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme fonts\\how to decrypt files.txt")) returned 0x20 [0074.308] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="Corbel.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Corbel.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Corbel.xml" [0074.308] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc1a8ee94, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xde3, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Franklin Gothic.xml", cAlternateFileName="FRANKL~1.XML")) returned 1 [0074.308] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.308] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Franklin Gothic.xml") returned -1 [0074.308] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Franklin Gothic.xml") returned 1 [0074.308] lstrcmpiA (lpString1="", lpString2="Franklin Gothic.xml") returned -1 [0074.308] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Corbel.xml") returned="Corbel.xml" [0074.308] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" [0074.308] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="" [0074.308] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" [0074.308] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme fonts\\how to decrypt files.txt")) returned 0x20 [0074.308] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="Franklin Gothic.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Franklin Gothic.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Franklin Gothic.xml" [0074.308] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc1ad46dc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xdd4, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Garamond-TrebuchetMs.xml", cAlternateFileName="GARAMO~1.XML")) returned 1 [0074.308] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.308] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Garamond-TrebuchetMs.xml") returned -1 [0074.308] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Garamond-TrebuchetMs.xml") returned 1 [0074.308] lstrcmpiA (lpString1="", lpString2="Garamond-TrebuchetMs.xml") returned -1 [0074.308] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Franklin Gothic.xml") returned="Franklin Gothic.xml" [0074.308] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" [0074.308] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="" [0074.308] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" [0074.308] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme fonts\\how to decrypt files.txt")) returned 0x20 [0074.308] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="Garamond-TrebuchetMs.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Garamond-TrebuchetMs.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Garamond-TrebuchetMs.xml" [0074.309] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc1ace524, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xdbd, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Garamond.xml", cAlternateFileName="")) returned 1 [0074.309] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.309] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Garamond.xml") returned -1 [0074.309] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Garamond.xml") returned 1 [0074.309] lstrcmpiA (lpString1="", lpString2="Garamond.xml") returned -1 [0074.309] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Garamond-TrebuchetMs.xml") returned="Garamond-TrebuchetMs.xml" [0074.309] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" [0074.309] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="" [0074.309] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" [0074.309] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme fonts\\how to decrypt files.txt")) returned 0x20 [0074.309] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="Garamond.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Garamond.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Garamond.xml" [0074.309] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc1ae1d5f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xdc2, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Georgia.xml", cAlternateFileName="")) returned 1 [0074.309] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.309] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Georgia.xml") returned -1 [0074.309] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Georgia.xml") returned 1 [0074.309] lstrcmpiA (lpString1="", lpString2="Georgia.xml") returned -1 [0074.309] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Garamond.xml") returned="Garamond.xml" [0074.309] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" [0074.309] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="" [0074.309] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" [0074.309] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme fonts\\how to decrypt files.txt")) returned 0x20 [0074.309] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="Georgia.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Georgia.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Georgia.xml" [0074.309] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xace2e8cd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xea1, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Gill Sans MT.xml", cAlternateFileName="GILLSA~1.XML")) returned 1 [0074.309] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.310] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Gill Sans MT.xml") returned -1 [0074.310] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Gill Sans MT.xml") returned 1 [0074.310] lstrcmpiA (lpString1="", lpString2="Gill Sans MT.xml") returned -1 [0074.310] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Georgia.xml") returned="Georgia.xml" [0074.310] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" [0074.310] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="" [0074.310] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" [0074.310] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme fonts\\how to decrypt files.txt")) returned 0x20 [0074.310] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="Gill Sans MT.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Gill Sans MT.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Gill Sans MT.xml" [0074.310] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9d77458, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe35, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Office 2007 - 2010.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0074.310] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.310] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Office 2007 - 2010.xml") returned -1 [0074.310] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office 2007 - 2010.xml") returned -1 [0074.310] lstrcmpiA (lpString1="", lpString2="Office 2007 - 2010.xml") returned -1 [0074.310] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Gill Sans MT.xml") returned="Gill Sans MT.xml" [0074.310] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" [0074.310] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="" [0074.310] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" [0074.310] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme fonts\\how to decrypt files.txt")) returned 0x20 [0074.310] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="Office 2007 - 2010.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Office 2007 - 2010.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Office 2007 - 2010.xml" [0074.310] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb83911b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xde1, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Times New Roman-Arial.xml", cAlternateFileName="TIMESN~1.XML")) returned 1 [0074.310] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.310] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Times New Roman-Arial.xml") returned -1 [0074.310] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Times New Roman-Arial.xml") returned -1 [0074.310] lstrcmpiA (lpString1="", lpString2="Times New Roman-Arial.xml") returned -1 [0074.310] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Office 2007 - 2010.xml") returned="Office 2007 - 2010.xml" [0074.311] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" [0074.311] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="" [0074.311] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" [0074.311] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme fonts\\how to decrypt files.txt")) returned 0x20 [0074.311] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="Times New Roman-Arial.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Times New Roman-Arial.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Times New Roman-Arial.xml" [0074.311] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb97c4358, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xdd7, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="TrebuchetMs.xml", cAlternateFileName="TREBUC~1.XML")) returned 1 [0074.311] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.311] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TrebuchetMs.xml") returned -1 [0074.311] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TrebuchetMs.xml") returned -1 [0074.311] lstrcmpiA (lpString1="", lpString2="TrebuchetMs.xml") returned -1 [0074.311] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Times New Roman-Arial.xml") returned="Times New Roman-Arial.xml" [0074.311] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" [0074.311] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="" [0074.311] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" [0074.311] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme fonts\\how to decrypt files.txt")) returned 0x20 [0074.311] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="TrebuchetMs.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\TrebuchetMs.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\TrebuchetMs.xml" [0074.311] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb8cb980, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe9e, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Tw Cen MT-Rockwell.xml", cAlternateFileName="TWCENM~2.XML")) returned 1 [0074.311] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.311] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Tw Cen MT-Rockwell.xml") returned -1 [0074.311] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Tw Cen MT-Rockwell.xml") returned -1 [0074.311] lstrcmpiA (lpString1="", lpString2="Tw Cen MT-Rockwell.xml") returned -1 [0074.311] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\TrebuchetMs.xml") returned="TrebuchetMs.xml" [0074.311] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" [0074.311] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="" [0074.311] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" [0074.312] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme fonts\\how to decrypt files.txt")) returned 0x20 [0074.312] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="Tw Cen MT-Rockwell.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Tw Cen MT-Rockwell.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Tw Cen MT-Rockwell.xml" [0074.312] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb8c6b65, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xea0, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Tw Cen MT.xml", cAlternateFileName="TWCENM~1.XML")) returned 1 [0074.312] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.312] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Tw Cen MT.xml") returned -1 [0074.312] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Tw Cen MT.xml") returned -1 [0074.312] lstrcmpiA (lpString1="", lpString2="Tw Cen MT.xml") returned -1 [0074.312] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Tw Cen MT-Rockwell.xml") returned="Tw Cen MT-Rockwell.xml" [0074.312] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" [0074.312] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\") returned="" [0074.312] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" [0074.312] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\theme fonts\\how to decrypt files.txt")) returned 0x20 [0074.312] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\", lpString2="Tw Cen MT.xml" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Tw Cen MT.xml") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Theme Fonts\\Tw Cen MT.xml" [0074.312] FindNextFileA (in: hFindFile=0x636870, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb8c6b65, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xea0, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Tw Cen MT.xml", cAlternateFileName="TWCENM~1.XML")) returned 0 [0074.312] FindClose (in: hFindFile=0x636870 | out: hFindFile=0x636870) returned 1 [0074.312] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xba06a56d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xbc7c1, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="Wisp.thmx", cAlternateFileName="WISP~1.THM")) returned 1 [0074.312] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0074.312] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Wisp.thmx") returned -1 [0074.312] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Wisp.thmx") returned -1 [0074.312] lstrcmpiA (lpString1="", lpString2="Wisp.thmx") returned -1 [0074.312] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\*.*") returned="*.*" [0074.312] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\" [0074.313] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\") returned="" [0074.313] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\HOW TO DECRYPT FILES.txt" [0074.313] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\document themes 16\\how to decrypt files.txt")) returned 0x20 [0074.313] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\", lpString2="Wisp.thmx" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Wisp.thmx") returned="C:\\Program Files (x86)\\Microsoft Office\\Document Themes 16\\Wisp.thmx" [0074.313] FindNextFileA (in: hFindFile=0x636ab0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xba06a56d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xbc7c1, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="Wisp.thmx", cAlternateFileName="WISP~1.THM")) returned 0 [0074.313] FindClose (in: hFindFile=0x636ab0 | out: hFindFile=0x636ab0) returned 1 [0074.313] FindNextFileA (in: hFindFile=0x636930, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55dba40, ftCreationTime.dwHighDateTime=0x1d8a6c4, ftLastAccessTime.dwLowDateTime=0x14a9f2a0, ftLastAccessTime.dwHighDateTime=0x1d8aa2a, ftLastWriteTime.dwLowDateTime=0x14a9f2a0, ftLastWriteTime.dwHighDateTime=0x1d8aa2a, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="fling.exe", cAlternateFileName="")) returned 1 [0074.313] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0074.313] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="fling.exe") returned -1 [0074.313] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="fling.exe") returned 1 [0074.313] lstrcmpiA (lpString1="", lpString2="fling.exe") returned -1 [0074.313] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\*.*") returned="*.*" [0074.313] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\") returned="C:\\Program Files (x86)\\Microsoft Office\\" [0074.313] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\") returned="" [0074.313] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\HOW TO DECRYPT FILES.txt" [0074.313] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\how to decrypt files.txt")) returned 0xffffffff [0074.313] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0074.314] WriteFile (in: hFile=0x1c4, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0074.315] SetFileTime (hFile=0x1c4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.315] CloseHandle (hObject=0x1c4) returned 1 [0074.315] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\", lpString2="fling.exe" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\fling.exe") returned="C:\\Program Files (x86)\\Microsoft Office\\fling.exe" [0074.315] FindNextFileA (in: hFindFile=0x636930, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x456ba425, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0xcc0fc9f2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xcc0fc9f2, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="Office16", cAlternateFileName="")) returned 1 [0074.315] lstrcmpA (lpString1=".", lpString2="Office16") returned -1 [0074.315] lstrcmpA (lpString1="..", lpString2="Office16") returned -1 [0074.315] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\fling.exe") returned="fling.exe" [0074.315] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\", lpString2="Office16" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16" [0074.315] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\*.*" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\*.*"), lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x456ba425, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0xcc0fc9f2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xcc0fc9f2, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19fab8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636630 [0074.318] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.318] FindNextFileA (in: hFindFile=0x636630, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x456ba425, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0xcc0fc9f2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xcc0fc9f2, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19fab8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.320] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.320] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.320] FindNextFileA (in: hFindFile=0x636630, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4f0accdf, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x64f44a4c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x64f44a4c, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19fab8, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0074.320] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0074.320] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0074.320] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\*.*") returned="*.*" [0074.320] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\", lpString2="1033" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033" [0074.320] lstrlenA (lpString="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033") returned 53 [0074.320] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\*.*" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\*.*"), lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4f0accdf, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x64f44a4c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x64f44a4c, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6508e8, dwReserved1=0x6508e0, cFileName=".", cAlternateFileName="")) returned 0x6366f0 [0074.322] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.323] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4f0accdf, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x64f44a4c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x64f44a4c, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6508e8, dwReserved1=0x6508e0, cFileName="..", cAlternateFileName="")) returned 1 [0074.323] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.323] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.323] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x698bf800, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x508a9a90, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x698bf800, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x6508e8, dwReserved1=0x6508e0, cFileName="ACCESS12.ACC", cAlternateFileName="")) returned 1 [0074.323] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.323] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACCESS12.ACC") returned 1 [0074.323] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACCESS12.ACC") returned 1 [0074.324] lstrcmpiA (lpString1="", lpString2="ACCESS12.ACC") returned -1 [0074.324] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\*.*") returned="*.*" [0074.324] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.324] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.324] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.324] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0xffffffff [0074.324] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0074.325] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text virusjahid4209@cyberper.net\r\n\r\nYou have 70 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n\r\nPrice of private key and decrypt software is $50.\r\nDiscount 50% available if you contact us first 72 hours, that\x92s price for you is $25.\r\n\r\nBTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8\r\n\r\nBitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] \r\n\r\nContact me here: virusjahid4209@cyberper.net\r\n") returned 623 [0074.325] WriteFile (in: hFile=0x1cc, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0074.326] SetFileTime (hFile=0x1cc, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.326] CloseHandle (hObject=0x1cc) returned 1 [0074.326] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="ACCESS12.ACC" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC" [0074.326] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.zip") returned 0 [0074.326] lstrlenA (lpString="*.zip") returned 5 [0074.326] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.rar") returned 0 [0074.326] lstrlenA (lpString="*.rar") returned 5 [0074.326] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.7z") returned 0 [0074.326] lstrlenA (lpString="*.7z") returned 4 [0074.326] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.tar") returned 0 [0074.326] lstrlenA (lpString="*.tar") returned 5 [0074.326] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.gzip") returned 0 [0074.326] lstrlenA (lpString="*.gzip") returned 6 [0074.326] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.jpg") returned 0 [0074.327] lstrlenA (lpString="*.jpg") returned 5 [0074.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.jpeg") returned 0 [0074.327] lstrlenA (lpString="*.jpeg") returned 6 [0074.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.psd") returned 0 [0074.327] lstrlenA (lpString="*.psd") returned 5 [0074.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.cdr") returned 0 [0074.327] lstrlenA (lpString="*.cdr") returned 5 [0074.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.dwg") returned 0 [0074.327] lstrlenA (lpString="*.dwg") returned 5 [0074.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.max") returned 0 [0074.327] lstrlenA (lpString="*.max") returned 5 [0074.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.bmp") returned 0 [0074.327] lstrlenA (lpString="*.bmp") returned 5 [0074.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.gif") returned 0 [0074.327] lstrlenA (lpString="*.gif") returned 5 [0074.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.png") returned 0 [0074.327] lstrlenA (lpString="*.png") returned 5 [0074.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.doc") returned 0 [0074.327] lstrlenA (lpString="*.doc") returned 5 [0074.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.docx") returned 0 [0074.327] lstrlenA (lpString="*.docx") returned 6 [0074.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.xls") returned 0 [0074.327] lstrlenA (lpString="*.xls") returned 5 [0074.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.xlsx") returned 0 [0074.327] lstrlenA (lpString="*.xlsx") returned 6 [0074.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.ppt") returned 0 [0074.327] lstrlenA (lpString="*.ppt") returned 5 [0074.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.pptx") returned 0 [0074.327] lstrlenA (lpString="*.pptx") returned 6 [0074.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.txt") returned 0 [0074.327] lstrlenA (lpString="*.txt") returned 5 [0074.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.pdf") returned 0 [0074.327] lstrlenA (lpString="*.pdf") returned 5 [0074.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.djvu") returned 0 [0074.328] lstrlenA (lpString="*.djvu") returned 6 [0074.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.htm") returned 0 [0074.328] lstrlenA (lpString="*.htm") returned 5 [0074.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.html") returned 0 [0074.328] lstrlenA (lpString="*.html") returned 6 [0074.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.mdb") returned 0 [0074.328] lstrlenA (lpString="*.mdb") returned 5 [0074.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.cer") returned 0 [0074.328] lstrlenA (lpString="*.cer") returned 5 [0074.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.p12") returned 0 [0074.328] lstrlenA (lpString="*.p12") returned 5 [0074.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.pfx") returned 0 [0074.328] lstrlenA (lpString="*.pfx") returned 5 [0074.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.kwm") returned 0 [0074.328] lstrlenA (lpString="*.kwm") returned 5 [0074.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.pwm") returned 0 [0074.328] lstrlenA (lpString="*.pwm") returned 5 [0074.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.1cd") returned 0 [0074.328] lstrlenA (lpString="*.1cd") returned 5 [0074.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.md") returned 0 [0074.328] lstrlenA (lpString="*.md") returned 4 [0074.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.mdf") returned 0 [0074.328] lstrlenA (lpString="*.mdf") returned 5 [0074.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.dbf") returned 0 [0074.328] lstrlenA (lpString="*.dbf") returned 5 [0074.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.odt") returned 0 [0074.328] lstrlenA (lpString="*.odt") returned 5 [0074.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.vob") returned 0 [0074.328] lstrlenA (lpString="*.vob") returned 5 [0074.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.ifo") returned 0 [0074.328] lstrlenA (lpString="*.ifo") returned 5 [0074.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.lnk") returned 0 [0074.328] lstrlenA (lpString="*.lnk") returned 5 [0074.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.torrent") returned 0 [0074.329] lstrlenA (lpString="*.torrent") returned 9 [0074.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.mov") returned 0 [0074.329] lstrlenA (lpString="*.mov") returned 5 [0074.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.m2v") returned 0 [0074.329] lstrlenA (lpString="*.m2v") returned 5 [0074.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.3gp") returned 0 [0074.329] lstrlenA (lpString="*.3gp") returned 5 [0074.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.mpeg") returned 0 [0074.329] lstrlenA (lpString="*.mpeg") returned 6 [0074.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.mpg") returned 0 [0074.329] lstrlenA (lpString="*.mpg") returned 5 [0074.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.flv") returned 0 [0074.329] lstrlenA (lpString="*.flv") returned 5 [0074.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.avi") returned 0 [0074.329] lstrlenA (lpString="*.avi") returned 5 [0074.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.mp4") returned 0 [0074.329] lstrlenA (lpString="*.mp4") returned 5 [0074.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.wmv") returned 0 [0074.329] lstrlenA (lpString="*.wmv") returned 5 [0074.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.divx") returned 0 [0074.329] lstrlenA (lpString="*.divx") returned 6 [0074.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.mkv") returned 0 [0074.329] lstrlenA (lpString="*.mkv") returned 5 [0074.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.mp3") returned 0 [0074.329] lstrlenA (lpString="*.mp3") returned 5 [0074.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.wav") returned 0 [0074.329] lstrlenA (lpString="*.wav") returned 5 [0074.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.flac") returned 0 [0074.329] lstrlenA (lpString="*.flac") returned 6 [0074.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.ape") returned 0 [0074.329] lstrlenA (lpString="*.ape") returned 5 [0074.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.wma") returned 0 [0074.330] lstrlenA (lpString="*.wma") returned 5 [0074.330] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC", pszSpec="*.ac3") returned 0 [0074.330] lstrlenA (lpString="*.ac3") returned 5 [0074.330] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x582a1500, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x509681de, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x582a1500, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x3500, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCOLKI.DLL", cAlternateFileName="")) returned 1 [0074.330] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.330] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACCOLKI.DLL") returned 1 [0074.330] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACCOLKI.DLL") returned 1 [0074.330] lstrcmpiA (lpString1="", lpString2="ACCOLKI.DLL") returned -1 [0074.330] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCESS12.ACC") returned="ACCESS12.ACC" [0074.330] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.330] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.330] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.330] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.330] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="ACCOLKI.DLL" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL" [0074.330] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.zip") returned 0 [0074.330] lstrlenA (lpString="*.zip") returned 5 [0074.330] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.rar") returned 0 [0074.330] lstrlenA (lpString="*.rar") returned 5 [0074.330] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.7z") returned 0 [0074.330] lstrlenA (lpString="*.7z") returned 4 [0074.330] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.tar") returned 0 [0074.330] lstrlenA (lpString="*.tar") returned 5 [0074.330] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.gzip") returned 0 [0074.330] lstrlenA (lpString="*.gzip") returned 6 [0074.330] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.jpg") returned 0 [0074.330] lstrlenA (lpString="*.jpg") returned 5 [0074.330] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.jpeg") returned 0 [0074.330] lstrlenA (lpString="*.jpeg") returned 6 [0074.330] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.psd") returned 0 [0074.331] lstrlenA (lpString="*.psd") returned 5 [0074.331] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.cdr") returned 0 [0074.331] lstrlenA (lpString="*.cdr") returned 5 [0074.331] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.dwg") returned 0 [0074.331] lstrlenA (lpString="*.dwg") returned 5 [0074.331] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.max") returned 0 [0074.331] lstrlenA (lpString="*.max") returned 5 [0074.331] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.bmp") returned 0 [0074.331] lstrlenA (lpString="*.bmp") returned 5 [0074.331] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.gif") returned 0 [0074.331] lstrlenA (lpString="*.gif") returned 5 [0074.331] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.png") returned 0 [0074.331] lstrlenA (lpString="*.png") returned 5 [0074.331] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.doc") returned 0 [0074.331] lstrlenA (lpString="*.doc") returned 5 [0074.331] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.docx") returned 0 [0074.331] lstrlenA (lpString="*.docx") returned 6 [0074.331] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.xls") returned 0 [0074.331] lstrlenA (lpString="*.xls") returned 5 [0074.331] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.xlsx") returned 0 [0074.331] lstrlenA (lpString="*.xlsx") returned 6 [0074.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.ppt") returned 0 [0074.332] lstrlenA (lpString="*.ppt") returned 5 [0074.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.pptx") returned 0 [0074.332] lstrlenA (lpString="*.pptx") returned 6 [0074.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.txt") returned 0 [0074.332] lstrlenA (lpString="*.txt") returned 5 [0074.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.pdf") returned 0 [0074.332] lstrlenA (lpString="*.pdf") returned 5 [0074.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.djvu") returned 0 [0074.332] lstrlenA (lpString="*.djvu") returned 6 [0074.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.htm") returned 0 [0074.332] lstrlenA (lpString="*.htm") returned 5 [0074.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.html") returned 0 [0074.332] lstrlenA (lpString="*.html") returned 6 [0074.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.mdb") returned 0 [0074.332] lstrlenA (lpString="*.mdb") returned 5 [0074.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.cer") returned 0 [0074.332] lstrlenA (lpString="*.cer") returned 5 [0074.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.p12") returned 0 [0074.332] lstrlenA (lpString="*.p12") returned 5 [0074.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.pfx") returned 0 [0074.332] lstrlenA (lpString="*.pfx") returned 5 [0074.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.kwm") returned 0 [0074.332] lstrlenA (lpString="*.kwm") returned 5 [0074.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.pwm") returned 0 [0074.332] lstrlenA (lpString="*.pwm") returned 5 [0074.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.1cd") returned 0 [0074.332] lstrlenA (lpString="*.1cd") returned 5 [0074.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.md") returned 0 [0074.332] lstrlenA (lpString="*.md") returned 4 [0074.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.mdf") returned 0 [0074.332] lstrlenA (lpString="*.mdf") returned 5 [0074.333] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.dbf") returned 0 [0074.333] lstrlenA (lpString="*.dbf") returned 5 [0074.333] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.odt") returned 0 [0074.333] lstrlenA (lpString="*.odt") returned 5 [0074.333] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.vob") returned 0 [0074.333] lstrlenA (lpString="*.vob") returned 5 [0074.333] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.ifo") returned 0 [0074.333] lstrlenA (lpString="*.ifo") returned 5 [0074.333] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.lnk") returned 0 [0074.333] lstrlenA (lpString="*.lnk") returned 5 [0074.333] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.torrent") returned 0 [0074.333] lstrlenA (lpString="*.torrent") returned 9 [0074.333] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.mov") returned 0 [0074.333] lstrlenA (lpString="*.mov") returned 5 [0074.333] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.m2v") returned 0 [0074.333] lstrlenA (lpString="*.m2v") returned 5 [0074.333] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.3gp") returned 0 [0074.333] lstrlenA (lpString="*.3gp") returned 5 [0074.333] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.mpeg") returned 0 [0074.333] lstrlenA (lpString="*.mpeg") returned 6 [0074.333] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.mpg") returned 0 [0074.333] lstrlenA (lpString="*.mpg") returned 5 [0074.333] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.flv") returned 0 [0074.333] lstrlenA (lpString="*.flv") returned 5 [0074.333] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.avi") returned 0 [0074.333] lstrlenA (lpString="*.avi") returned 5 [0074.333] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.mp4") returned 0 [0074.333] lstrlenA (lpString="*.mp4") returned 5 [0074.333] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.wmv") returned 0 [0074.333] lstrlenA (lpString="*.wmv") returned 5 [0074.333] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.divx") returned 0 [0074.333] lstrlenA (lpString="*.divx") returned 6 [0074.334] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.mkv") returned 0 [0074.334] lstrlenA (lpString="*.mkv") returned 5 [0074.334] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.mp3") returned 0 [0074.334] lstrlenA (lpString="*.mp3") returned 5 [0074.334] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.wav") returned 0 [0074.334] lstrlenA (lpString="*.wav") returned 5 [0074.334] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.flac") returned 0 [0074.334] lstrlenA (lpString="*.flac") returned 6 [0074.334] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.ape") returned 0 [0074.334] lstrlenA (lpString="*.ape") returned 5 [0074.334] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.wma") returned 0 [0074.334] lstrlenA (lpString="*.wma") returned 5 [0074.334] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL", pszSpec="*.ac3") returned 0 [0074.334] lstrlenA (lpString="*.ac3") returned 5 [0074.334] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x698bf800, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x50976bae, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x698bf800, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x53de0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIP10.HLP", cAlternateFileName="")) returned 1 [0074.334] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.334] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACTIP10.HLP") returned 1 [0074.334] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACTIP10.HLP") returned 1 [0074.334] lstrcmpiA (lpString1="", lpString2="ACTIP10.HLP") returned -1 [0074.334] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACCOLKI.DLL") returned="ACCOLKI.DLL" [0074.334] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.334] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.334] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.334] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.334] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="ACTIP10.HLP" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP" [0074.334] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.zip") returned 0 [0074.334] lstrlenA (lpString="*.zip") returned 5 [0074.334] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.rar") returned 0 [0074.334] lstrlenA (lpString="*.rar") returned 5 [0074.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.7z") returned 0 [0074.335] lstrlenA (lpString="*.7z") returned 4 [0074.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.tar") returned 0 [0074.335] lstrlenA (lpString="*.tar") returned 5 [0074.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.gzip") returned 0 [0074.335] lstrlenA (lpString="*.gzip") returned 6 [0074.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.jpg") returned 0 [0074.335] lstrlenA (lpString="*.jpg") returned 5 [0074.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.jpeg") returned 0 [0074.335] lstrlenA (lpString="*.jpeg") returned 6 [0074.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.psd") returned 0 [0074.335] lstrlenA (lpString="*.psd") returned 5 [0074.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.cdr") returned 0 [0074.335] lstrlenA (lpString="*.cdr") returned 5 [0074.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.dwg") returned 0 [0074.335] lstrlenA (lpString="*.dwg") returned 5 [0074.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.max") returned 0 [0074.335] lstrlenA (lpString="*.max") returned 5 [0074.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.bmp") returned 0 [0074.335] lstrlenA (lpString="*.bmp") returned 5 [0074.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.gif") returned 0 [0074.335] lstrlenA (lpString="*.gif") returned 5 [0074.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.png") returned 0 [0074.335] lstrlenA (lpString="*.png") returned 5 [0074.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.doc") returned 0 [0074.335] lstrlenA (lpString="*.doc") returned 5 [0074.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.docx") returned 0 [0074.335] lstrlenA (lpString="*.docx") returned 6 [0074.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.xls") returned 0 [0074.335] lstrlenA (lpString="*.xls") returned 5 [0074.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.xlsx") returned 0 [0074.335] lstrlenA (lpString="*.xlsx") returned 6 [0074.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.ppt") returned 0 [0074.336] lstrlenA (lpString="*.ppt") returned 5 [0074.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.pptx") returned 0 [0074.336] lstrlenA (lpString="*.pptx") returned 6 [0074.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.txt") returned 0 [0074.336] lstrlenA (lpString="*.txt") returned 5 [0074.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.pdf") returned 0 [0074.336] lstrlenA (lpString="*.pdf") returned 5 [0074.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.djvu") returned 0 [0074.336] lstrlenA (lpString="*.djvu") returned 6 [0074.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.htm") returned 0 [0074.336] lstrlenA (lpString="*.htm") returned 5 [0074.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.html") returned 0 [0074.336] lstrlenA (lpString="*.html") returned 6 [0074.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.mdb") returned 0 [0074.336] lstrlenA (lpString="*.mdb") returned 5 [0074.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.cer") returned 0 [0074.336] lstrlenA (lpString="*.cer") returned 5 [0074.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.p12") returned 0 [0074.336] lstrlenA (lpString="*.p12") returned 5 [0074.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.pfx") returned 0 [0074.336] lstrlenA (lpString="*.pfx") returned 5 [0074.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.kwm") returned 0 [0074.336] lstrlenA (lpString="*.kwm") returned 5 [0074.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.pwm") returned 0 [0074.336] lstrlenA (lpString="*.pwm") returned 5 [0074.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.1cd") returned 0 [0074.336] lstrlenA (lpString="*.1cd") returned 5 [0074.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.md") returned 0 [0074.336] lstrlenA (lpString="*.md") returned 4 [0074.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.mdf") returned 0 [0074.336] lstrlenA (lpString="*.mdf") returned 5 [0074.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.dbf") returned 0 [0074.336] lstrlenA (lpString="*.dbf") returned 5 [0074.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.odt") returned 0 [0074.337] lstrlenA (lpString="*.odt") returned 5 [0074.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.vob") returned 0 [0074.337] lstrlenA (lpString="*.vob") returned 5 [0074.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.ifo") returned 0 [0074.337] lstrlenA (lpString="*.ifo") returned 5 [0074.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.lnk") returned 0 [0074.337] lstrlenA (lpString="*.lnk") returned 5 [0074.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.torrent") returned 0 [0074.337] lstrlenA (lpString="*.torrent") returned 9 [0074.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.mov") returned 0 [0074.337] lstrlenA (lpString="*.mov") returned 5 [0074.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.m2v") returned 0 [0074.337] lstrlenA (lpString="*.m2v") returned 5 [0074.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.3gp") returned 0 [0074.337] lstrlenA (lpString="*.3gp") returned 5 [0074.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.mpeg") returned 0 [0074.337] lstrlenA (lpString="*.mpeg") returned 6 [0074.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.mpg") returned 0 [0074.337] lstrlenA (lpString="*.mpg") returned 5 [0074.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.flv") returned 0 [0074.337] lstrlenA (lpString="*.flv") returned 5 [0074.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.avi") returned 0 [0074.337] lstrlenA (lpString="*.avi") returned 5 [0074.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.mp4") returned 0 [0074.337] lstrlenA (lpString="*.mp4") returned 5 [0074.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.wmv") returned 0 [0074.337] lstrlenA (lpString="*.wmv") returned 5 [0074.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.divx") returned 0 [0074.337] lstrlenA (lpString="*.divx") returned 6 [0074.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.mkv") returned 0 [0074.337] lstrlenA (lpString="*.mkv") returned 5 [0074.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.mp3") returned 0 [0074.338] lstrlenA (lpString="*.mp3") returned 5 [0074.338] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.wav") returned 0 [0074.338] lstrlenA (lpString="*.wav") returned 5 [0074.338] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.flac") returned 0 [0074.338] lstrlenA (lpString="*.flac") returned 6 [0074.338] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.ape") returned 0 [0074.338] lstrlenA (lpString="*.ape") returned 5 [0074.338] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.wma") returned 0 [0074.338] lstrlenA (lpString="*.wma") returned 5 [0074.338] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP", pszSpec="*.ac3") returned 0 [0074.338] lstrlenA (lpString="*.ac3") returned 5 [0074.338] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x582a1500, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x509890d1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x582a1500, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x464d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWIZRC.DLL", cAlternateFileName="")) returned 1 [0074.338] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.338] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACWIZRC.DLL") returned 1 [0074.338] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACWIZRC.DLL") returned 1 [0074.338] lstrcmpiA (lpString1="", lpString2="ACWIZRC.DLL") returned -1 [0074.338] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACTIP10.HLP") returned="ACTIP10.HLP" [0074.338] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.338] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.338] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.338] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.338] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="ACWIZRC.DLL" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL" [0074.338] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.zip") returned 0 [0074.338] lstrlenA (lpString="*.zip") returned 5 [0074.338] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.rar") returned 0 [0074.338] lstrlenA (lpString="*.rar") returned 5 [0074.338] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.7z") returned 0 [0074.338] lstrlenA (lpString="*.7z") returned 4 [0074.338] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.tar") returned 0 [0074.338] lstrlenA (lpString="*.tar") returned 5 [0074.338] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.gzip") returned 0 [0074.338] lstrlenA (lpString="*.gzip") returned 6 [0074.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.jpg") returned 0 [0074.339] lstrlenA (lpString="*.jpg") returned 5 [0074.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.jpeg") returned 0 [0074.339] lstrlenA (lpString="*.jpeg") returned 6 [0074.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.psd") returned 0 [0074.339] lstrlenA (lpString="*.psd") returned 5 [0074.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.cdr") returned 0 [0074.339] lstrlenA (lpString="*.cdr") returned 5 [0074.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.dwg") returned 0 [0074.339] lstrlenA (lpString="*.dwg") returned 5 [0074.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.max") returned 0 [0074.339] lstrlenA (lpString="*.max") returned 5 [0074.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.bmp") returned 0 [0074.339] lstrlenA (lpString="*.bmp") returned 5 [0074.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.gif") returned 0 [0074.339] lstrlenA (lpString="*.gif") returned 5 [0074.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.png") returned 0 [0074.339] lstrlenA (lpString="*.png") returned 5 [0074.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.doc") returned 0 [0074.339] lstrlenA (lpString="*.doc") returned 5 [0074.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.docx") returned 0 [0074.339] lstrlenA (lpString="*.docx") returned 6 [0074.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.xls") returned 0 [0074.339] lstrlenA (lpString="*.xls") returned 5 [0074.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.xlsx") returned 0 [0074.339] lstrlenA (lpString="*.xlsx") returned 6 [0074.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.ppt") returned 0 [0074.339] lstrlenA (lpString="*.ppt") returned 5 [0074.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.pptx") returned 0 [0074.339] lstrlenA (lpString="*.pptx") returned 6 [0074.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.txt") returned 0 [0074.339] lstrlenA (lpString="*.txt") returned 5 [0074.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.pdf") returned 0 [0074.339] lstrlenA (lpString="*.pdf") returned 5 [0074.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.djvu") returned 0 [0074.340] lstrlenA (lpString="*.djvu") returned 6 [0074.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.htm") returned 0 [0074.340] lstrlenA (lpString="*.htm") returned 5 [0074.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.html") returned 0 [0074.340] lstrlenA (lpString="*.html") returned 6 [0074.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.mdb") returned 0 [0074.340] lstrlenA (lpString="*.mdb") returned 5 [0074.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.cer") returned 0 [0074.340] lstrlenA (lpString="*.cer") returned 5 [0074.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.p12") returned 0 [0074.340] lstrlenA (lpString="*.p12") returned 5 [0074.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.pfx") returned 0 [0074.340] lstrlenA (lpString="*.pfx") returned 5 [0074.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.kwm") returned 0 [0074.340] lstrlenA (lpString="*.kwm") returned 5 [0074.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.pwm") returned 0 [0074.340] lstrlenA (lpString="*.pwm") returned 5 [0074.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.1cd") returned 0 [0074.340] lstrlenA (lpString="*.1cd") returned 5 [0074.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.md") returned 0 [0074.340] lstrlenA (lpString="*.md") returned 4 [0074.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.mdf") returned 0 [0074.340] lstrlenA (lpString="*.mdf") returned 5 [0074.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.dbf") returned 0 [0074.340] lstrlenA (lpString="*.dbf") returned 5 [0074.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.odt") returned 0 [0074.340] lstrlenA (lpString="*.odt") returned 5 [0074.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.vob") returned 0 [0074.340] lstrlenA (lpString="*.vob") returned 5 [0074.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.ifo") returned 0 [0074.340] lstrlenA (lpString="*.ifo") returned 5 [0074.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.lnk") returned 0 [0074.340] lstrlenA (lpString="*.lnk") returned 5 [0074.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.torrent") returned 0 [0074.340] lstrlenA (lpString="*.torrent") returned 9 [0074.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.mov") returned 0 [0074.341] lstrlenA (lpString="*.mov") returned 5 [0074.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.m2v") returned 0 [0074.341] lstrlenA (lpString="*.m2v") returned 5 [0074.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.3gp") returned 0 [0074.341] lstrlenA (lpString="*.3gp") returned 5 [0074.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.mpeg") returned 0 [0074.341] lstrlenA (lpString="*.mpeg") returned 6 [0074.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.mpg") returned 0 [0074.341] lstrlenA (lpString="*.mpg") returned 5 [0074.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.flv") returned 0 [0074.341] lstrlenA (lpString="*.flv") returned 5 [0074.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.avi") returned 0 [0074.341] lstrlenA (lpString="*.avi") returned 5 [0074.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.mp4") returned 0 [0074.341] lstrlenA (lpString="*.mp4") returned 5 [0074.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.wmv") returned 0 [0074.341] lstrlenA (lpString="*.wmv") returned 5 [0074.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.divx") returned 0 [0074.341] lstrlenA (lpString="*.divx") returned 6 [0074.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.mkv") returned 0 [0074.341] lstrlenA (lpString="*.mkv") returned 5 [0074.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.mp3") returned 0 [0074.341] lstrlenA (lpString="*.mp3") returned 5 [0074.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.wav") returned 0 [0074.341] lstrlenA (lpString="*.wav") returned 5 [0074.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.flac") returned 0 [0074.341] lstrlenA (lpString="*.flac") returned 6 [0074.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.ape") returned 0 [0074.341] lstrlenA (lpString="*.ape") returned 5 [0074.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.wma") returned 0 [0074.341] lstrlenA (lpString="*.wma") returned 5 [0074.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL", pszSpec="*.ac3") returned 0 [0074.341] lstrlenA (lpString="*.ac3") returned 5 [0074.341] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62e6a900, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x5b73d775, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x62e6a900, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x44c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSRuntimeRes.dll", cAlternateFileName="BCSRUN~1.DLL")) returned 1 [0074.342] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.342] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BCSRuntimeRes.dll") returned 1 [0074.342] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCSRuntimeRes.dll") returned 1 [0074.342] lstrcmpiA (lpString1="", lpString2="BCSRuntimeRes.dll") returned -1 [0074.342] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ACWIZRC.DLL") returned="ACWIZRC.DLL" [0074.342] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.342] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.342] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.342] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.342] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="BCSRuntimeRes.dll" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\BCSRuntimeRes.dll") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\BCSRuntimeRes.dll" [0074.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\BCSRuntimeRes.dll", pszSpec="*.zip") returned 0 [0074.342] lstrlenA (lpString="*.zip") returned 5 [0074.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\BCSRuntimeRes.dll", pszSpec="*.rar") returned 0 [0074.342] lstrlenA (lpString="*.rar") returned 5 [0074.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\BCSRuntimeRes.dll", pszSpec="*.7z") returned 0 [0074.342] lstrlenA (lpString="*.7z") returned 4 [0074.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\BCSRuntimeRes.dll", pszSpec="*.tar") returned 0 [0074.342] lstrlenA (lpString="*.tar") returned 5 [0074.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\BCSRuntimeRes.dll", pszSpec="*.gzip") returned 0 [0074.342] lstrlenA (lpString="*.gzip") returned 6 [0074.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\BCSRuntimeRes.dll", pszSpec="*.jpg") returned 0 [0074.342] lstrlenA (lpString="*.jpg") returned 5 [0074.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\BCSRuntimeRes.dll", pszSpec="*.jpeg") returned 0 [0074.342] lstrlenA (lpString="*.jpeg") returned 6 [0074.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\BCSRuntimeRes.dll", pszSpec="*.psd") returned 0 [0074.342] lstrlenA (lpString="*.psd") returned 5 [0074.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\BCSRuntimeRes.dll", pszSpec="*.cdr") returned 0 [0074.342] lstrlenA (lpString="*.cdr") returned 5 [0074.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\BCSRuntimeRes.dll", pszSpec="*.dwg") returned 0 [0074.342] lstrlenA (lpString="*.dwg") returned 5 [0074.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\BCSRuntimeRes.dll", pszSpec="*.max") returned 0 [0074.343] lstrlenA (lpString="*.max") returned 5 [0074.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\BCSRuntimeRes.dll", pszSpec="*.bmp") returned 0 [0074.343] lstrlenA (lpString="*.bmp") returned 5 [0074.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\BCSRuntimeRes.dll", pszSpec="*.gif") returned 0 [0074.343] lstrlenA (lpString="*.gif") returned 5 [0074.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\BCSRuntimeRes.dll", pszSpec="*.png") returned 0 [0074.343] lstrlenA (lpString="*.png") returned 5 [0074.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\BCSRuntimeRes.dll", pszSpec="*.doc") returned 0 [0074.343] lstrlenA (lpString="*.doc") returned 5 [0074.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\BCSRuntimeRes.dll", pszSpec="*.docx") returned 0 [0074.343] lstrlenA (lpString="*.docx") returned 6 [0074.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\BCSRuntimeRes.dll", pszSpec="*.xls") returned 0 [0074.343] lstrlenA (lpString="*.xls") returned 5 [0074.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\BCSRuntimeRes.dll", pszSpec="*.xlsx") returned 0 [0074.343] lstrlenA (lpString="*.xlsx") returned 6 [0074.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\BCSRuntimeRes.dll", pszSpec="*.ppt") returned 0 [0074.343] lstrlenA (lpString="*.ppt") returned 5 [0074.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\BCSRuntimeRes.dll", pszSpec="*.pptx") returned 0 [0074.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\BCSRuntimeRes.dll", pszSpec="*.txt") returned 0 [0074.343] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62e6a900, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x5b56edcc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x62e6a900, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x2ab8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BHOINTL.DLL", cAlternateFileName="")) returned 1 [0074.343] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.343] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BHOINTL.DLL") returned 1 [0074.343] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BHOINTL.DLL") returned 1 [0074.343] lstrcmpiA (lpString1="", lpString2="BHOINTL.DLL") returned -1 [0074.343] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\BCSRuntimeRes.dll") returned="BCSRuntimeRes.dll" [0074.344] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.344] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.344] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.344] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.344] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="BHOINTL.DLL" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\BHOINTL.DLL") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\BHOINTL.DLL" [0074.344] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x64d738d7, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x64d74ca5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x64d74ca5, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bibliography", cAlternateFileName="BIBLIO~1")) returned 1 [0074.344] lstrcmpA (lpString1=".", lpString2="Bibliography") returned -1 [0074.344] lstrcmpA (lpString1="..", lpString2="Bibliography") returned -1 [0074.344] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\BHOINTL.DLL") returned="BHOINTL.DLL" [0074.344] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="Bibliography" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\Bibliography") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\Bibliography" [0074.344] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\Bibliography\\*.*" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\bibliography\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x64d738d7, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x64d74ca5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x64d74ca5, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0xa6, cFileName=".", cAlternateFileName="")) returned 0x636b70 [0074.345] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.345] FindNextFileA (in: hFindFile=0x636b70, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x64d738d7, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x64d74ca5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x64d74ca5, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0xa6, cFileName="..", cAlternateFileName="")) returned 1 [0074.345] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.345] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.345] FindNextFileA (in: hFindFile=0x636b70, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b6d9b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x64d76031, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x7b6d9b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1b2ce, dwReserved0=0x77792cf0, dwReserved1=0xa6, cFileName="BIBFORM.XML", cAlternateFileName="")) returned 1 [0074.345] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.345] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BIBFORM.XML") returned 1 [0074.345] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BIBFORM.XML") returned 1 [0074.345] lstrcmpiA (lpString1="", lpString2="BIBFORM.XML") returned -1 [0074.345] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\Bibliography\\*.*") returned="*.*" [0074.345] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\Bibliography\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\Bibliography\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\Bibliography\\" [0074.345] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\Bibliography\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\Bibliography\\") returned="" [0074.345] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\Bibliography\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\Bibliography\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\Bibliography\\HOW TO DECRYPT FILES.txt" [0074.345] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\Bibliography\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\bibliography\\how to decrypt files.txt")) returned 0xffffffff [0074.345] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\Bibliography\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\bibliography\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.346] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0074.347] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.347] CloseHandle (hObject=0x1d0) returned 1 [0074.347] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\Bibliography\\", lpString2="BIBFORM.XML" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\Bibliography\\BIBFORM.XML") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\Bibliography\\BIBFORM.XML" [0074.347] FindNextFileA (in: hFindFile=0x636b70, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b6d9b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x64d76031, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x7b6d9b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1b2ce, dwReserved0=0x77792cf0, dwReserved1=0xa6, cFileName="BIBFORM.XML", cAlternateFileName="")) returned 0 [0074.347] FindClose (in: hFindFile=0x636b70 | out: hFindFile=0x636b70) returned 1 [0074.347] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62e6a900, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x5b56edcc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x62e6a900, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x30d8, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="CERTINTL.DLL", cAlternateFileName="")) returned 1 [0074.347] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.347] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CERTINTL.DLL") returned 1 [0074.347] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CERTINTL.DLL") returned 1 [0074.347] lstrcmpiA (lpString1="", lpString2="CERTINTL.DLL") returned -1 [0074.347] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\*.*") returned="*.*" [0074.348] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.348] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.348] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.348] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.348] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="CERTINTL.DLL" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL" [0074.348] lstrlenA (lpString="*.zip") returned 5 [0074.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.rar") returned 0 [0074.348] lstrlenA (lpString="*.rar") returned 5 [0074.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.7z") returned 0 [0074.348] lstrlenA (lpString="*.7z") returned 4 [0074.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.tar") returned 0 [0074.348] lstrlenA (lpString="*.tar") returned 5 [0074.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.gzip") returned 0 [0074.348] lstrlenA (lpString="*.gzip") returned 6 [0074.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.jpg") returned 0 [0074.348] lstrlenA (lpString="*.jpg") returned 5 [0074.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.jpeg") returned 0 [0074.348] lstrlenA (lpString="*.jpeg") returned 6 [0074.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.psd") returned 0 [0074.348] lstrlenA (lpString="*.psd") returned 5 [0074.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.cdr") returned 0 [0074.348] lstrlenA (lpString="*.cdr") returned 5 [0074.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.dwg") returned 0 [0074.348] lstrlenA (lpString="*.dwg") returned 5 [0074.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.max") returned 0 [0074.348] lstrlenA (lpString="*.max") returned 5 [0074.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.bmp") returned 0 [0074.348] lstrlenA (lpString="*.bmp") returned 5 [0074.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.gif") returned 0 [0074.348] lstrlenA (lpString="*.gif") returned 5 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.png") returned 0 [0074.349] lstrlenA (lpString="*.png") returned 5 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.doc") returned 0 [0074.349] lstrlenA (lpString="*.doc") returned 5 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.docx") returned 0 [0074.349] lstrlenA (lpString="*.docx") returned 6 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.xls") returned 0 [0074.349] lstrlenA (lpString="*.xls") returned 5 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.xlsx") returned 0 [0074.349] lstrlenA (lpString="*.xlsx") returned 6 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.ppt") returned 0 [0074.349] lstrlenA (lpString="*.ppt") returned 5 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.pptx") returned 0 [0074.349] lstrlenA (lpString="*.pptx") returned 6 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.txt") returned 0 [0074.349] lstrlenA (lpString="*.txt") returned 5 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.pdf") returned 0 [0074.349] lstrlenA (lpString="*.pdf") returned 5 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.djvu") returned 0 [0074.349] lstrlenA (lpString="*.djvu") returned 6 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.htm") returned 0 [0074.349] lstrlenA (lpString="*.htm") returned 5 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.html") returned 0 [0074.349] lstrlenA (lpString="*.html") returned 6 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.mdb") returned 0 [0074.349] lstrlenA (lpString="*.mdb") returned 5 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.cer") returned 0 [0074.349] lstrlenA (lpString="*.cer") returned 5 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.p12") returned 0 [0074.349] lstrlenA (lpString="*.p12") returned 5 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.pfx") returned 0 [0074.349] lstrlenA (lpString="*.pfx") returned 5 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.kwm") returned 0 [0074.349] lstrlenA (lpString="*.kwm") returned 5 [0074.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.pwm") returned 0 [0074.350] lstrlenA (lpString="*.pwm") returned 5 [0074.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.1cd") returned 0 [0074.350] lstrlenA (lpString="*.1cd") returned 5 [0074.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.md") returned 0 [0074.350] lstrlenA (lpString="*.md") returned 4 [0074.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.mdf") returned 0 [0074.350] lstrlenA (lpString="*.mdf") returned 5 [0074.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.dbf") returned 0 [0074.350] lstrlenA (lpString="*.dbf") returned 5 [0074.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.odt") returned 0 [0074.350] lstrlenA (lpString="*.odt") returned 5 [0074.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.vob") returned 0 [0074.350] lstrlenA (lpString="*.vob") returned 5 [0074.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.ifo") returned 0 [0074.350] lstrlenA (lpString="*.ifo") returned 5 [0074.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.lnk") returned 0 [0074.350] lstrlenA (lpString="*.lnk") returned 5 [0074.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.torrent") returned 0 [0074.350] lstrlenA (lpString="*.torrent") returned 9 [0074.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.mov") returned 0 [0074.350] lstrlenA (lpString="*.mov") returned 5 [0074.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.m2v") returned 0 [0074.350] lstrlenA (lpString="*.m2v") returned 5 [0074.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.3gp") returned 0 [0074.350] lstrlenA (lpString="*.3gp") returned 5 [0074.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.mpeg") returned 0 [0074.350] lstrlenA (lpString="*.mpeg") returned 6 [0074.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.mpg") returned 0 [0074.350] lstrlenA (lpString="*.mpg") returned 5 [0074.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.flv") returned 0 [0074.350] lstrlenA (lpString="*.flv") returned 5 [0074.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.avi") returned 0 [0074.350] lstrlenA (lpString="*.avi") returned 5 [0074.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.mp4") returned 0 [0074.351] lstrlenA (lpString="*.mp4") returned 5 [0074.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.wmv") returned 0 [0074.351] lstrlenA (lpString="*.wmv") returned 5 [0074.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.divx") returned 0 [0074.351] lstrlenA (lpString="*.divx") returned 6 [0074.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.mkv") returned 0 [0074.351] lstrlenA (lpString="*.mkv") returned 5 [0074.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.mp3") returned 0 [0074.351] lstrlenA (lpString="*.mp3") returned 5 [0074.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.wav") returned 0 [0074.351] lstrlenA (lpString="*.wav") returned 5 [0074.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.flac") returned 0 [0074.351] lstrlenA (lpString="*.flac") returned 6 [0074.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.ape") returned 0 [0074.351] lstrlenA (lpString="*.ape") returned 5 [0074.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.wma") returned 0 [0074.351] lstrlenA (lpString="*.wma") returned 5 [0074.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL", pszSpec="*.ac3") returned 0 [0074.351] lstrlenA (lpString="*.ac3") returned 5 [0074.351] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62e6a900, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x5b5a397d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x62e6a900, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x18ef0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLVWINTL.DLL", cAlternateFileName="")) returned 1 [0074.351] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.351] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CLVWINTL.DLL") returned 1 [0074.351] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CLVWINTL.DLL") returned 1 [0074.351] lstrcmpiA (lpString1="", lpString2="CLVWINTL.DLL") returned -1 [0074.351] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CERTINTL.DLL") returned="CERTINTL.DLL" [0074.351] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.351] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.351] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.351] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.351] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="CLVWINTL.DLL" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL" [0074.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.zip") returned 0 [0074.352] lstrlenA (lpString="*.zip") returned 5 [0074.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.rar") returned 0 [0074.352] lstrlenA (lpString="*.rar") returned 5 [0074.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.7z") returned 0 [0074.352] lstrlenA (lpString="*.7z") returned 4 [0074.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.tar") returned 0 [0074.352] lstrlenA (lpString="*.tar") returned 5 [0074.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.gzip") returned 0 [0074.352] lstrlenA (lpString="*.gzip") returned 6 [0074.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.jpg") returned 0 [0074.352] lstrlenA (lpString="*.jpg") returned 5 [0074.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.jpeg") returned 0 [0074.352] lstrlenA (lpString="*.jpeg") returned 6 [0074.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.psd") returned 0 [0074.352] lstrlenA (lpString="*.psd") returned 5 [0074.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.cdr") returned 0 [0074.352] lstrlenA (lpString="*.cdr") returned 5 [0074.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.dwg") returned 0 [0074.352] lstrlenA (lpString="*.dwg") returned 5 [0074.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.max") returned 0 [0074.352] lstrlenA (lpString="*.max") returned 5 [0074.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.bmp") returned 0 [0074.352] lstrlenA (lpString="*.bmp") returned 5 [0074.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.gif") returned 0 [0074.352] lstrlenA (lpString="*.gif") returned 5 [0074.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.png") returned 0 [0074.352] lstrlenA (lpString="*.png") returned 5 [0074.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.doc") returned 0 [0074.352] lstrlenA (lpString="*.doc") returned 5 [0074.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.docx") returned 0 [0074.352] lstrlenA (lpString="*.docx") returned 6 [0074.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.xls") returned 0 [0074.353] lstrlenA (lpString="*.xls") returned 5 [0074.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.xlsx") returned 0 [0074.353] lstrlenA (lpString="*.xlsx") returned 6 [0074.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.ppt") returned 0 [0074.353] lstrlenA (lpString="*.ppt") returned 5 [0074.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.pptx") returned 0 [0074.353] lstrlenA (lpString="*.pptx") returned 6 [0074.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.txt") returned 0 [0074.353] lstrlenA (lpString="*.txt") returned 5 [0074.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.pdf") returned 0 [0074.353] lstrlenA (lpString="*.pdf") returned 5 [0074.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.djvu") returned 0 [0074.353] lstrlenA (lpString="*.djvu") returned 6 [0074.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.htm") returned 0 [0074.353] lstrlenA (lpString="*.htm") returned 5 [0074.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.html") returned 0 [0074.353] lstrlenA (lpString="*.html") returned 6 [0074.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.mdb") returned 0 [0074.353] lstrlenA (lpString="*.mdb") returned 5 [0074.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.cer") returned 0 [0074.353] lstrlenA (lpString="*.cer") returned 5 [0074.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.p12") returned 0 [0074.353] lstrlenA (lpString="*.p12") returned 5 [0074.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.pfx") returned 0 [0074.353] lstrlenA (lpString="*.pfx") returned 5 [0074.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.kwm") returned 0 [0074.353] lstrlenA (lpString="*.kwm") returned 5 [0074.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.pwm") returned 0 [0074.353] lstrlenA (lpString="*.pwm") returned 5 [0074.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.1cd") returned 0 [0074.353] lstrlenA (lpString="*.1cd") returned 5 [0074.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.md") returned 0 [0074.353] lstrlenA (lpString="*.md") returned 4 [0074.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.mdf") returned 0 [0074.354] lstrlenA (lpString="*.mdf") returned 5 [0074.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.dbf") returned 0 [0074.354] lstrlenA (lpString="*.dbf") returned 5 [0074.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.odt") returned 0 [0074.354] lstrlenA (lpString="*.odt") returned 5 [0074.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.vob") returned 0 [0074.354] lstrlenA (lpString="*.vob") returned 5 [0074.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.ifo") returned 0 [0074.354] lstrlenA (lpString="*.ifo") returned 5 [0074.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.lnk") returned 0 [0074.354] lstrlenA (lpString="*.lnk") returned 5 [0074.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.torrent") returned 0 [0074.354] lstrlenA (lpString="*.torrent") returned 9 [0074.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.mov") returned 0 [0074.354] lstrlenA (lpString="*.mov") returned 5 [0074.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.m2v") returned 0 [0074.354] lstrlenA (lpString="*.m2v") returned 5 [0074.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.3gp") returned 0 [0074.354] lstrlenA (lpString="*.3gp") returned 5 [0074.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.mpeg") returned 0 [0074.354] lstrlenA (lpString="*.mpeg") returned 6 [0074.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.mpg") returned 0 [0074.354] lstrlenA (lpString="*.mpg") returned 5 [0074.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.flv") returned 0 [0074.354] lstrlenA (lpString="*.flv") returned 5 [0074.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.avi") returned 0 [0074.354] lstrlenA (lpString="*.avi") returned 5 [0074.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.mp4") returned 0 [0074.354] lstrlenA (lpString="*.mp4") returned 5 [0074.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.wmv") returned 0 [0074.354] lstrlenA (lpString="*.wmv") returned 5 [0074.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.divx") returned 0 [0074.354] lstrlenA (lpString="*.divx") returned 6 [0074.355] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.mkv") returned 0 [0074.355] lstrlenA (lpString="*.mkv") returned 5 [0074.355] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.mp3") returned 0 [0074.355] lstrlenA (lpString="*.mp3") returned 5 [0074.355] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.wav") returned 0 [0074.355] lstrlenA (lpString="*.wav") returned 5 [0074.355] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.flac") returned 0 [0074.355] lstrlenA (lpString="*.flac") returned 6 [0074.355] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.ape") returned 0 [0074.355] lstrlenA (lpString="*.ape") returned 5 [0074.355] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.wma") returned 0 [0074.355] lstrlenA (lpString="*.wma") returned 5 [0074.355] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL", pszSpec="*.ac3") returned 0 [0074.355] lstrlenA (lpString="*.ac3") returned 5 [0074.355] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d9f3f00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x5b5a397d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6d9f3f00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x393e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CollectSignatures_Init.xsn", cAlternateFileName="COLLEC~1.XSN")) returned 1 [0074.355] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.355] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CollectSignatures_Init.xsn") returned 1 [0074.355] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CollectSignatures_Init.xsn") returned 1 [0074.355] lstrcmpiA (lpString1="", lpString2="CollectSignatures_Init.xsn") returned -1 [0074.355] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CLVWINTL.DLL") returned="CLVWINTL.DLL" [0074.355] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.355] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.355] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.355] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.355] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="CollectSignatures_Init.xsn" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn" [0074.355] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.zip") returned 0 [0074.355] lstrlenA (lpString="*.zip") returned 5 [0074.355] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.rar") returned 0 [0074.355] lstrlenA (lpString="*.rar") returned 5 [0074.355] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.7z") returned 0 [0074.355] lstrlenA (lpString="*.7z") returned 4 [0074.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.tar") returned 0 [0074.356] lstrlenA (lpString="*.tar") returned 5 [0074.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.gzip") returned 0 [0074.356] lstrlenA (lpString="*.gzip") returned 6 [0074.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.jpg") returned 0 [0074.356] lstrlenA (lpString="*.jpg") returned 5 [0074.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.jpeg") returned 0 [0074.356] lstrlenA (lpString="*.jpeg") returned 6 [0074.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.psd") returned 0 [0074.356] lstrlenA (lpString="*.psd") returned 5 [0074.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.cdr") returned 0 [0074.356] lstrlenA (lpString="*.cdr") returned 5 [0074.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.dwg") returned 0 [0074.356] lstrlenA (lpString="*.dwg") returned 5 [0074.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.max") returned 0 [0074.356] lstrlenA (lpString="*.max") returned 5 [0074.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.bmp") returned 0 [0074.356] lstrlenA (lpString="*.bmp") returned 5 [0074.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.gif") returned 0 [0074.356] lstrlenA (lpString="*.gif") returned 5 [0074.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.png") returned 0 [0074.356] lstrlenA (lpString="*.png") returned 5 [0074.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.doc") returned 0 [0074.356] lstrlenA (lpString="*.doc") returned 5 [0074.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.docx") returned 0 [0074.356] lstrlenA (lpString="*.docx") returned 6 [0074.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.xls") returned 0 [0074.356] lstrlenA (lpString="*.xls") returned 5 [0074.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.xlsx") returned 0 [0074.356] lstrlenA (lpString="*.xlsx") returned 6 [0074.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.ppt") returned 0 [0074.356] lstrlenA (lpString="*.ppt") returned 5 [0074.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.pptx") returned 0 [0074.356] lstrlenA (lpString="*.pptx") returned 6 [0074.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.txt") returned 0 [0074.357] lstrlenA (lpString="*.txt") returned 5 [0074.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.pdf") returned 0 [0074.357] lstrlenA (lpString="*.pdf") returned 5 [0074.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.djvu") returned 0 [0074.357] lstrlenA (lpString="*.djvu") returned 6 [0074.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.htm") returned 0 [0074.357] lstrlenA (lpString="*.htm") returned 5 [0074.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.html") returned 0 [0074.357] lstrlenA (lpString="*.html") returned 6 [0074.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.mdb") returned 0 [0074.357] lstrlenA (lpString="*.mdb") returned 5 [0074.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.cer") returned 0 [0074.357] lstrlenA (lpString="*.cer") returned 5 [0074.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.p12") returned 0 [0074.357] lstrlenA (lpString="*.p12") returned 5 [0074.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.pfx") returned 0 [0074.357] lstrlenA (lpString="*.pfx") returned 5 [0074.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.kwm") returned 0 [0074.357] lstrlenA (lpString="*.kwm") returned 5 [0074.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.pwm") returned 0 [0074.357] lstrlenA (lpString="*.pwm") returned 5 [0074.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.1cd") returned 0 [0074.357] lstrlenA (lpString="*.1cd") returned 5 [0074.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.md") returned 0 [0074.357] lstrlenA (lpString="*.md") returned 4 [0074.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.mdf") returned 0 [0074.357] lstrlenA (lpString="*.mdf") returned 5 [0074.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.dbf") returned 0 [0074.357] lstrlenA (lpString="*.dbf") returned 5 [0074.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.odt") returned 0 [0074.357] lstrlenA (lpString="*.odt") returned 5 [0074.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.vob") returned 0 [0074.357] lstrlenA (lpString="*.vob") returned 5 [0074.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.ifo") returned 0 [0074.358] lstrlenA (lpString="*.ifo") returned 5 [0074.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.lnk") returned 0 [0074.358] lstrlenA (lpString="*.lnk") returned 5 [0074.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.torrent") returned 0 [0074.358] lstrlenA (lpString="*.torrent") returned 9 [0074.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.mov") returned 0 [0074.358] lstrlenA (lpString="*.mov") returned 5 [0074.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.m2v") returned 0 [0074.358] lstrlenA (lpString="*.m2v") returned 5 [0074.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.3gp") returned 0 [0074.358] lstrlenA (lpString="*.3gp") returned 5 [0074.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.mpeg") returned 0 [0074.358] lstrlenA (lpString="*.mpeg") returned 6 [0074.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.mpg") returned 0 [0074.358] lstrlenA (lpString="*.mpg") returned 5 [0074.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.flv") returned 0 [0074.358] lstrlenA (lpString="*.flv") returned 5 [0074.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.avi") returned 0 [0074.358] lstrlenA (lpString="*.avi") returned 5 [0074.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.mp4") returned 0 [0074.358] lstrlenA (lpString="*.mp4") returned 5 [0074.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.wmv") returned 0 [0074.358] lstrlenA (lpString="*.wmv") returned 5 [0074.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.divx") returned 0 [0074.358] lstrlenA (lpString="*.divx") returned 6 [0074.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.mkv") returned 0 [0074.358] lstrlenA (lpString="*.mkv") returned 5 [0074.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.mp3") returned 0 [0074.358] lstrlenA (lpString="*.mp3") returned 5 [0074.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.wav") returned 0 [0074.358] lstrlenA (lpString="*.wav") returned 5 [0074.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.flac") returned 0 [0074.359] lstrlenA (lpString="*.flac") returned 6 [0074.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.ape") returned 0 [0074.359] lstrlenA (lpString="*.ape") returned 5 [0074.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.wma") returned 0 [0074.359] lstrlenA (lpString="*.wma") returned 5 [0074.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn", pszSpec="*.ac3") returned 0 [0074.359] lstrlenA (lpString="*.ac3") returned 5 [0074.359] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d9f3f00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x5b5a397d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6d9f3f00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x3a7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CollectSignatures_Sign.xsn", cAlternateFileName="COLLEC~2.XSN")) returned 1 [0074.359] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.359] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CollectSignatures_Sign.xsn") returned 1 [0074.359] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CollectSignatures_Sign.xsn") returned 1 [0074.359] lstrcmpiA (lpString1="", lpString2="CollectSignatures_Sign.xsn") returned -1 [0074.359] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Init.xsn") returned="CollectSignatures_Init.xsn" [0074.359] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.359] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.359] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.359] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.359] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="CollectSignatures_Sign.xsn" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn" [0074.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.zip") returned 0 [0074.359] lstrlenA (lpString="*.zip") returned 5 [0074.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.rar") returned 0 [0074.359] lstrlenA (lpString="*.rar") returned 5 [0074.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.7z") returned 0 [0074.359] lstrlenA (lpString="*.7z") returned 4 [0074.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.tar") returned 0 [0074.359] lstrlenA (lpString="*.tar") returned 5 [0074.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.gzip") returned 0 [0074.359] lstrlenA (lpString="*.gzip") returned 6 [0074.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.jpg") returned 0 [0074.359] lstrlenA (lpString="*.jpg") returned 5 [0074.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.jpeg") returned 0 [0074.360] lstrlenA (lpString="*.jpeg") returned 6 [0074.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.psd") returned 0 [0074.360] lstrlenA (lpString="*.psd") returned 5 [0074.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.cdr") returned 0 [0074.360] lstrlenA (lpString="*.cdr") returned 5 [0074.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.dwg") returned 0 [0074.360] lstrlenA (lpString="*.dwg") returned 5 [0074.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.max") returned 0 [0074.360] lstrlenA (lpString="*.max") returned 5 [0074.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.bmp") returned 0 [0074.360] lstrlenA (lpString="*.bmp") returned 5 [0074.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.gif") returned 0 [0074.360] lstrlenA (lpString="*.gif") returned 5 [0074.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.png") returned 0 [0074.360] lstrlenA (lpString="*.png") returned 5 [0074.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.doc") returned 0 [0074.360] lstrlenA (lpString="*.doc") returned 5 [0074.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.docx") returned 0 [0074.360] lstrlenA (lpString="*.docx") returned 6 [0074.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.xls") returned 0 [0074.360] lstrlenA (lpString="*.xls") returned 5 [0074.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.xlsx") returned 0 [0074.360] lstrlenA (lpString="*.xlsx") returned 6 [0074.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.ppt") returned 0 [0074.360] lstrlenA (lpString="*.ppt") returned 5 [0074.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.pptx") returned 0 [0074.360] lstrlenA (lpString="*.pptx") returned 6 [0074.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.txt") returned 0 [0074.360] lstrlenA (lpString="*.txt") returned 5 [0074.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.pdf") returned 0 [0074.360] lstrlenA (lpString="*.pdf") returned 5 [0074.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.djvu") returned 0 [0074.360] lstrlenA (lpString="*.djvu") returned 6 [0074.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.htm") returned 0 [0074.360] lstrlenA (lpString="*.htm") returned 5 [0074.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.html") returned 0 [0074.361] lstrlenA (lpString="*.html") returned 6 [0074.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.mdb") returned 0 [0074.361] lstrlenA (lpString="*.mdb") returned 5 [0074.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.cer") returned 0 [0074.361] lstrlenA (lpString="*.cer") returned 5 [0074.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.p12") returned 0 [0074.361] lstrlenA (lpString="*.p12") returned 5 [0074.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.pfx") returned 0 [0074.361] lstrlenA (lpString="*.pfx") returned 5 [0074.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.kwm") returned 0 [0074.361] lstrlenA (lpString="*.kwm") returned 5 [0074.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.pwm") returned 0 [0074.361] lstrlenA (lpString="*.pwm") returned 5 [0074.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.1cd") returned 0 [0074.361] lstrlenA (lpString="*.1cd") returned 5 [0074.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.md") returned 0 [0074.361] lstrlenA (lpString="*.md") returned 4 [0074.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.mdf") returned 0 [0074.361] lstrlenA (lpString="*.mdf") returned 5 [0074.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.dbf") returned 0 [0074.361] lstrlenA (lpString="*.dbf") returned 5 [0074.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.odt") returned 0 [0074.361] lstrlenA (lpString="*.odt") returned 5 [0074.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.vob") returned 0 [0074.361] lstrlenA (lpString="*.vob") returned 5 [0074.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.ifo") returned 0 [0074.361] lstrlenA (lpString="*.ifo") returned 5 [0074.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.lnk") returned 0 [0074.361] lstrlenA (lpString="*.lnk") returned 5 [0074.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.torrent") returned 0 [0074.361] lstrlenA (lpString="*.torrent") returned 9 [0074.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.mov") returned 0 [0074.362] lstrlenA (lpString="*.mov") returned 5 [0074.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.m2v") returned 0 [0074.362] lstrlenA (lpString="*.m2v") returned 5 [0074.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.3gp") returned 0 [0074.362] lstrlenA (lpString="*.3gp") returned 5 [0074.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.mpeg") returned 0 [0074.362] lstrlenA (lpString="*.mpeg") returned 6 [0074.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.mpg") returned 0 [0074.362] lstrlenA (lpString="*.mpg") returned 5 [0074.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.flv") returned 0 [0074.362] lstrlenA (lpString="*.flv") returned 5 [0074.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.avi") returned 0 [0074.362] lstrlenA (lpString="*.avi") returned 5 [0074.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.mp4") returned 0 [0074.362] lstrlenA (lpString="*.mp4") returned 5 [0074.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.wmv") returned 0 [0074.362] lstrlenA (lpString="*.wmv") returned 5 [0074.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.divx") returned 0 [0074.362] lstrlenA (lpString="*.divx") returned 6 [0074.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.mkv") returned 0 [0074.362] lstrlenA (lpString="*.mkv") returned 5 [0074.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.mp3") returned 0 [0074.362] lstrlenA (lpString="*.mp3") returned 5 [0074.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.wav") returned 0 [0074.363] lstrlenA (lpString="*.wav") returned 5 [0074.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.flac") returned 0 [0074.363] lstrlenA (lpString="*.flac") returned 6 [0074.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.ape") returned 0 [0074.363] lstrlenA (lpString="*.ape") returned 5 [0074.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.wma") returned 0 [0074.363] lstrlenA (lpString="*.wma") returned 5 [0074.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn", pszSpec="*.ac3") returned 0 [0074.363] lstrlenA (lpString="*.ac3") returned 5 [0074.363] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5ba2c00, ftCreationTime.dwHighDateTime=0x1d0ca65, ftLastAccessTime.dwLowDateTime=0x5b5a397d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xd5ba2c00, ftLastWriteTime.dwHighDateTime=0x1d0ca65, nFileSizeHigh=0x0, nFileSizeLow=0x17b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="CT_ROOTS.XML", cAlternateFileName="")) returned 1 [0074.363] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.363] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CT_ROOTS.XML") returned 1 [0074.363] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CT_ROOTS.XML") returned 1 [0074.363] lstrcmpiA (lpString1="", lpString2="CT_ROOTS.XML") returned -1 [0074.363] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CollectSignatures_Sign.xsn") returned="CollectSignatures_Sign.xsn" [0074.363] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.363] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.363] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.363] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.363] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="CT_ROOTS.XML" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CT_ROOTS.XML") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CT_ROOTS.XML" [0074.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CT_ROOTS.XML", pszSpec="*.zip") returned 0 [0074.364] lstrlenA (lpString="*.zip") returned 5 [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CT_ROOTS.XML", pszSpec="*.rar") returned 0 [0074.364] lstrlenA (lpString="*.rar") returned 5 [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CT_ROOTS.XML", pszSpec="*.7z") returned 0 [0074.364] lstrlenA (lpString="*.7z") returned 4 [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CT_ROOTS.XML", pszSpec="*.tar") returned 0 [0074.364] lstrlenA (lpString="*.tar") returned 5 [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CT_ROOTS.XML", pszSpec="*.gzip") returned 0 [0074.364] lstrlenA (lpString="*.gzip") returned 6 [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CT_ROOTS.XML", pszSpec="*.jpg") returned 0 [0074.364] lstrlenA (lpString="*.jpg") returned 5 [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CT_ROOTS.XML", pszSpec="*.jpeg") returned 0 [0074.364] lstrlenA (lpString="*.jpeg") returned 6 [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CT_ROOTS.XML", pszSpec="*.psd") returned 0 [0074.364] lstrlenA (lpString="*.psd") returned 5 [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CT_ROOTS.XML", pszSpec="*.cdr") returned 0 [0074.364] lstrlenA (lpString="*.cdr") returned 5 [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CT_ROOTS.XML", pszSpec="*.dwg") returned 0 [0074.364] lstrlenA (lpString="*.dwg") returned 5 [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CT_ROOTS.XML", pszSpec="*.max") returned 0 [0074.364] lstrlenA (lpString="*.max") returned 5 [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CT_ROOTS.XML", pszSpec="*.bmp") returned 0 [0074.364] lstrlenA (lpString="*.bmp") returned 5 [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CT_ROOTS.XML", pszSpec="*.gif") returned 0 [0074.364] lstrlenA (lpString="*.gif") returned 5 [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CT_ROOTS.XML", pszSpec="*.png") returned 0 [0074.364] lstrlenA (lpString="*.png") returned 5 [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CT_ROOTS.XML", pszSpec="*.doc") returned 0 [0074.364] lstrlenA (lpString="*.doc") returned 5 [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CT_ROOTS.XML", pszSpec="*.docx") returned 0 [0074.364] lstrlenA (lpString="*.docx") returned 6 [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CT_ROOTS.XML", pszSpec="*.xls") returned 0 [0074.364] lstrlenA (lpString="*.xls") returned 5 [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CT_ROOTS.XML", pszSpec="*.xlsx") returned 0 [0074.365] lstrlenA (lpString="*.xlsx") returned 6 [0074.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CT_ROOTS.XML", pszSpec="*.ppt") returned 0 [0074.365] lstrlenA (lpString="*.ppt") returned 5 [0074.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CT_ROOTS.XML", pszSpec="*.pptx") returned 0 [0074.365] lstrlenA (lpString="*.pptx") returned 6 [0074.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CT_ROOTS.XML", pszSpec="*.txt") returned 0 [0074.365] lstrlenA (lpString="*.txt") returned 5 [0074.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CT_ROOTS.XML", pszSpec="*.pdf") returned 0 [0074.365] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x5b5a397d, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x5b8771d5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x5b8771d5, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataServices", cAlternateFileName="DATASE~1")) returned 1 [0074.365] lstrcmpA (lpString1=".", lpString2="DataServices") returned -1 [0074.365] lstrcmpA (lpString1="..", lpString2="DataServices") returned -1 [0074.365] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\CT_ROOTS.XML") returned="CT_ROOTS.XML" [0074.365] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="DataServices" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices" [0074.365] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\*.*" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\dataservices\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x5b5a397d, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x5b8771d5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x5b8771d5, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0xa6, cFileName=".", cAlternateFileName="")) returned 0x636530 [0074.374] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.374] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x5b5a397d, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x5b8771d5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x5b8771d5, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0xa6, cFileName="..", cAlternateFileName="")) returned 1 [0074.374] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.374] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.374] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f81d900, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x5b5a397d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6f81d900, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x77792cf0, dwReserved1=0xa6, cFileName="+Connect to New Data Source.odc", cAlternateFileName="_CONNE~1.ODC")) returned 1 [0074.374] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.374] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="+Connect to New Data Source.odc") returned 1 [0074.374] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="+Connect to New Data Source.odc") returned 1 [0074.374] lstrcmpiA (lpString1="", lpString2="+Connect to New Data Source.odc") returned -1 [0074.374] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\*.*") returned="*.*" [0074.374] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\" [0074.374] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\") returned="" [0074.374] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\HOW TO DECRYPT FILES.txt" [0074.374] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\dataservices\\how to decrypt files.txt")) returned 0xffffffff [0074.375] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\dataservices\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.376] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0074.376] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.377] CloseHandle (hObject=0x1d0) returned 1 [0074.377] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\", lpString2="+Connect to New Data Source.odc" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\+Connect to New Data Source.odc") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\+Connect to New Data Source.odc" [0074.377] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f81d900, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x5b8771d5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6f81d900, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="+NewSQLServerConnection.odc", cAlternateFileName="_NEWSQ~1.ODC")) returned 1 [0074.377] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.377] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\+Connect to New Data Source.odc") returned="+Connect to New Data Source.odc" [0074.377] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\" [0074.377] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\") returned="" [0074.377] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\HOW TO DECRYPT FILES.txt" [0074.377] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\dataservices\\how to decrypt files.txt")) returned 0x20 [0074.377] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\", lpString2="+NewSQLServerConnection.odc" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\+NewSQLServerConnection.odc") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\+NewSQLServerConnection.odc" [0074.378] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f81d900, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x5b5a397d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6f81d900, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x46, dwReserved0=0x490046, dwReserved1=0x45004c, cFileName="DESKTOP.INI", cAlternateFileName="")) returned 1 [0074.378] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.378] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\+NewSQLServerConnection.odc") returned="+NewSQLServerConnection.odc" [0074.378] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\" [0074.378] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\") returned="" [0074.378] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\HOW TO DECRYPT FILES.txt" [0074.378] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\dataservices\\how to decrypt files.txt")) returned 0x20 [0074.378] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\", lpString2="DESKTOP.INI" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\DESKTOP.INI") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\DESKTOP.INI" [0074.378] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f81d900, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x5b6b10c8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6f81d900, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1266, dwReserved0=0x490046, dwReserved1=0x45004c, cFileName="FOLDER.ICO", cAlternateFileName="")) returned 1 [0074.378] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.378] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\DESKTOP.INI") returned="DESKTOP.INI" [0074.378] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\" [0074.378] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\") returned="" [0074.378] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\HOW TO DECRYPT FILES.txt" [0074.378] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\dataservices\\how to decrypt files.txt")) returned 0x20 [0074.378] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\", lpString2="FOLDER.ICO" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\FOLDER.ICO") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\DataServices\\FOLDER.ICO" [0074.378] FindNextFileA (in: hFindFile=0x636530, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f81d900, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x5b6b10c8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6f81d900, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1266, dwReserved0=0x490046, dwReserved1=0x45004c, cFileName="FOLDER.ICO", cAlternateFileName="")) returned 0 [0074.379] FindClose (in: hFindFile=0x636530 | out: hFindFile=0x636530) returned 1 [0074.379] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d9f3f00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x5b5a397d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6d9f3f00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x3c0f, dwReserved0=0x0, dwReserved1=0x63a4a8, cFileName="EADOCUMENTAPPROVAL_INIT.XSN", cAlternateFileName="EADOCU~1.XSN")) returned 1 [0074.379] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.379] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\*.*") returned="*.*" [0074.379] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.379] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.379] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.379] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.379] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="EADOCUMENTAPPROVAL_INIT.XSN" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN" [0074.379] lstrlenA (lpString="*.zip") returned 5 [0074.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.rar") returned 0 [0074.379] lstrlenA (lpString="*.rar") returned 5 [0074.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.7z") returned 0 [0074.379] lstrlenA (lpString="*.7z") returned 4 [0074.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.tar") returned 0 [0074.379] lstrlenA (lpString="*.tar") returned 5 [0074.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.gzip") returned 0 [0074.379] lstrlenA (lpString="*.gzip") returned 6 [0074.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.jpg") returned 0 [0074.379] lstrlenA (lpString="*.jpg") returned 5 [0074.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.jpeg") returned 0 [0074.379] lstrlenA (lpString="*.jpeg") returned 6 [0074.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.psd") returned 0 [0074.379] lstrlenA (lpString="*.psd") returned 5 [0074.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.cdr") returned 0 [0074.380] lstrlenA (lpString="*.cdr") returned 5 [0074.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.dwg") returned 0 [0074.380] lstrlenA (lpString="*.dwg") returned 5 [0074.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.max") returned 0 [0074.380] lstrlenA (lpString="*.max") returned 5 [0074.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.bmp") returned 0 [0074.380] lstrlenA (lpString="*.bmp") returned 5 [0074.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.gif") returned 0 [0074.380] lstrlenA (lpString="*.gif") returned 5 [0074.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.png") returned 0 [0074.380] lstrlenA (lpString="*.png") returned 5 [0074.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.doc") returned 0 [0074.380] lstrlenA (lpString="*.doc") returned 5 [0074.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.docx") returned 0 [0074.380] lstrlenA (lpString="*.docx") returned 6 [0074.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.xls") returned 0 [0074.380] lstrlenA (lpString="*.xls") returned 5 [0074.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.xlsx") returned 0 [0074.380] lstrlenA (lpString="*.xlsx") returned 6 [0074.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.ppt") returned 0 [0074.380] lstrlenA (lpString="*.ppt") returned 5 [0074.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.pptx") returned 0 [0074.380] lstrlenA (lpString="*.pptx") returned 6 [0074.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.txt") returned 0 [0074.380] lstrlenA (lpString="*.txt") returned 5 [0074.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.pdf") returned 0 [0074.380] lstrlenA (lpString="*.pdf") returned 5 [0074.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.djvu") returned 0 [0074.380] lstrlenA (lpString="*.djvu") returned 6 [0074.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.htm") returned 0 [0074.380] lstrlenA (lpString="*.htm") returned 5 [0074.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.html") returned 0 [0074.380] lstrlenA (lpString="*.html") returned 6 [0074.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.mdb") returned 0 [0074.381] lstrlenA (lpString="*.mdb") returned 5 [0074.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.cer") returned 0 [0074.381] lstrlenA (lpString="*.cer") returned 5 [0074.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.p12") returned 0 [0074.381] lstrlenA (lpString="*.p12") returned 5 [0074.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.pfx") returned 0 [0074.381] lstrlenA (lpString="*.pfx") returned 5 [0074.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.kwm") returned 0 [0074.381] lstrlenA (lpString="*.kwm") returned 5 [0074.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.pwm") returned 0 [0074.381] lstrlenA (lpString="*.pwm") returned 5 [0074.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.1cd") returned 0 [0074.381] lstrlenA (lpString="*.1cd") returned 5 [0074.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.md") returned 0 [0074.381] lstrlenA (lpString="*.md") returned 4 [0074.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.mdf") returned 0 [0074.381] lstrlenA (lpString="*.mdf") returned 5 [0074.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.dbf") returned 0 [0074.381] lstrlenA (lpString="*.dbf") returned 5 [0074.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.odt") returned 0 [0074.381] lstrlenA (lpString="*.odt") returned 5 [0074.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.vob") returned 0 [0074.381] lstrlenA (lpString="*.vob") returned 5 [0074.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.ifo") returned 0 [0074.381] lstrlenA (lpString="*.ifo") returned 5 [0074.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.lnk") returned 0 [0074.381] lstrlenA (lpString="*.lnk") returned 5 [0074.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.torrent") returned 0 [0074.381] lstrlenA (lpString="*.torrent") returned 9 [0074.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.mov") returned 0 [0074.381] lstrlenA (lpString="*.mov") returned 5 [0074.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.m2v") returned 0 [0074.381] lstrlenA (lpString="*.m2v") returned 5 [0074.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.3gp") returned 0 [0074.382] lstrlenA (lpString="*.3gp") returned 5 [0074.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.mpeg") returned 0 [0074.382] lstrlenA (lpString="*.mpeg") returned 6 [0074.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.mpg") returned 0 [0074.382] lstrlenA (lpString="*.mpg") returned 5 [0074.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.flv") returned 0 [0074.382] lstrlenA (lpString="*.flv") returned 5 [0074.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.avi") returned 0 [0074.382] lstrlenA (lpString="*.avi") returned 5 [0074.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.mp4") returned 0 [0074.382] lstrlenA (lpString="*.mp4") returned 5 [0074.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.wmv") returned 0 [0074.382] lstrlenA (lpString="*.wmv") returned 5 [0074.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.divx") returned 0 [0074.382] lstrlenA (lpString="*.divx") returned 6 [0074.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.mkv") returned 0 [0074.382] lstrlenA (lpString="*.mkv") returned 5 [0074.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.mp3") returned 0 [0074.382] lstrlenA (lpString="*.mp3") returned 5 [0074.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.wav") returned 0 [0074.382] lstrlenA (lpString="*.wav") returned 5 [0074.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.flac") returned 0 [0074.382] lstrlenA (lpString="*.flac") returned 6 [0074.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.ape") returned 0 [0074.382] lstrlenA (lpString="*.ape") returned 5 [0074.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.wma") returned 0 [0074.382] lstrlenA (lpString="*.wma") returned 5 [0074.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", pszSpec="*.ac3") returned 0 [0074.382] lstrlenA (lpString="*.ac3") returned 5 [0074.382] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d9f3f00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x5b5c9f87, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6d9f3f00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x5101, dwReserved0=0x0, dwReserved1=0x0, cFileName="EADOCUMENTAPPROVAL_REVIEW.XSN", cAlternateFileName="EADOCU~2.XSN")) returned 1 [0074.382] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.383] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN") returned="EADOCUMENTAPPROVAL_INIT.XSN" [0074.383] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.383] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.383] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.383] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.383] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="EADOCUMENTAPPROVAL_REVIEW.XSN" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN" [0074.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.zip") returned 0 [0074.383] lstrlenA (lpString="*.zip") returned 5 [0074.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.rar") returned 0 [0074.383] lstrlenA (lpString="*.rar") returned 5 [0074.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.7z") returned 0 [0074.383] lstrlenA (lpString="*.7z") returned 4 [0074.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.tar") returned 0 [0074.383] lstrlenA (lpString="*.tar") returned 5 [0074.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.gzip") returned 0 [0074.383] lstrlenA (lpString="*.gzip") returned 6 [0074.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.jpg") returned 0 [0074.383] lstrlenA (lpString="*.jpg") returned 5 [0074.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.jpeg") returned 0 [0074.383] lstrlenA (lpString="*.jpeg") returned 6 [0074.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.psd") returned 0 [0074.383] lstrlenA (lpString="*.psd") returned 5 [0074.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.cdr") returned 0 [0074.383] lstrlenA (lpString="*.cdr") returned 5 [0074.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.dwg") returned 0 [0074.383] lstrlenA (lpString="*.dwg") returned 5 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.max") returned 0 [0074.384] lstrlenA (lpString="*.max") returned 5 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.bmp") returned 0 [0074.384] lstrlenA (lpString="*.bmp") returned 5 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.gif") returned 0 [0074.384] lstrlenA (lpString="*.gif") returned 5 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.png") returned 0 [0074.384] lstrlenA (lpString="*.png") returned 5 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.doc") returned 0 [0074.384] lstrlenA (lpString="*.doc") returned 5 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.docx") returned 0 [0074.384] lstrlenA (lpString="*.docx") returned 6 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.xls") returned 0 [0074.384] lstrlenA (lpString="*.xls") returned 5 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.xlsx") returned 0 [0074.384] lstrlenA (lpString="*.xlsx") returned 6 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.ppt") returned 0 [0074.384] lstrlenA (lpString="*.ppt") returned 5 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.pptx") returned 0 [0074.384] lstrlenA (lpString="*.pptx") returned 6 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.txt") returned 0 [0074.384] lstrlenA (lpString="*.txt") returned 5 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.pdf") returned 0 [0074.384] lstrlenA (lpString="*.pdf") returned 5 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.djvu") returned 0 [0074.384] lstrlenA (lpString="*.djvu") returned 6 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.htm") returned 0 [0074.384] lstrlenA (lpString="*.htm") returned 5 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.html") returned 0 [0074.384] lstrlenA (lpString="*.html") returned 6 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.mdb") returned 0 [0074.384] lstrlenA (lpString="*.mdb") returned 5 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.cer") returned 0 [0074.385] lstrlenA (lpString="*.cer") returned 5 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.p12") returned 0 [0074.385] lstrlenA (lpString="*.p12") returned 5 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.pfx") returned 0 [0074.385] lstrlenA (lpString="*.pfx") returned 5 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.kwm") returned 0 [0074.385] lstrlenA (lpString="*.kwm") returned 5 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.pwm") returned 0 [0074.385] lstrlenA (lpString="*.pwm") returned 5 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.1cd") returned 0 [0074.385] lstrlenA (lpString="*.1cd") returned 5 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.md") returned 0 [0074.385] lstrlenA (lpString="*.md") returned 4 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.mdf") returned 0 [0074.385] lstrlenA (lpString="*.mdf") returned 5 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.dbf") returned 0 [0074.385] lstrlenA (lpString="*.dbf") returned 5 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.odt") returned 0 [0074.385] lstrlenA (lpString="*.odt") returned 5 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.vob") returned 0 [0074.385] lstrlenA (lpString="*.vob") returned 5 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.ifo") returned 0 [0074.385] lstrlenA (lpString="*.ifo") returned 5 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.lnk") returned 0 [0074.385] lstrlenA (lpString="*.lnk") returned 5 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.torrent") returned 0 [0074.385] lstrlenA (lpString="*.torrent") returned 9 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.mov") returned 0 [0074.385] lstrlenA (lpString="*.mov") returned 5 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.m2v") returned 0 [0074.385] lstrlenA (lpString="*.m2v") returned 5 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.3gp") returned 0 [0074.385] lstrlenA (lpString="*.3gp") returned 5 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.mpeg") returned 0 [0074.386] lstrlenA (lpString="*.mpeg") returned 6 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.mpg") returned 0 [0074.386] lstrlenA (lpString="*.mpg") returned 5 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.flv") returned 0 [0074.386] lstrlenA (lpString="*.flv") returned 5 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.avi") returned 0 [0074.386] lstrlenA (lpString="*.avi") returned 5 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.mp4") returned 0 [0074.386] lstrlenA (lpString="*.mp4") returned 5 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.wmv") returned 0 [0074.386] lstrlenA (lpString="*.wmv") returned 5 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.divx") returned 0 [0074.386] lstrlenA (lpString="*.divx") returned 6 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.mkv") returned 0 [0074.386] lstrlenA (lpString="*.mkv") returned 5 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.mp3") returned 0 [0074.386] lstrlenA (lpString="*.mp3") returned 5 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.wav") returned 0 [0074.386] lstrlenA (lpString="*.wav") returned 5 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.flac") returned 0 [0074.386] lstrlenA (lpString="*.flac") returned 6 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.ape") returned 0 [0074.386] lstrlenA (lpString="*.ape") returned 5 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.wma") returned 0 [0074.386] lstrlenA (lpString="*.wma") returned 5 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", pszSpec="*.ac3") returned 0 [0074.386] lstrlenA (lpString="*.ac3") returned 5 [0074.386] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d9f3f00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x5b5c9f87, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6d9f3f00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0xccd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EAWFINTL.DLL", cAlternateFileName="")) returned 1 [0074.386] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.386] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN") returned="EADOCUMENTAPPROVAL_REVIEW.XSN" [0074.386] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.386] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.387] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.387] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.387] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="EAWFINTL.DLL" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL" [0074.387] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.zip") returned 0 [0074.387] lstrlenA (lpString="*.zip") returned 5 [0074.387] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.rar") returned 0 [0074.387] lstrlenA (lpString="*.rar") returned 5 [0074.387] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.7z") returned 0 [0074.387] lstrlenA (lpString="*.7z") returned 4 [0074.387] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.tar") returned 0 [0074.387] lstrlenA (lpString="*.tar") returned 5 [0074.387] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.gzip") returned 0 [0074.387] lstrlenA (lpString="*.gzip") returned 6 [0074.387] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.jpg") returned 0 [0074.387] lstrlenA (lpString="*.jpg") returned 5 [0074.387] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.jpeg") returned 0 [0074.387] lstrlenA (lpString="*.jpeg") returned 6 [0074.387] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.psd") returned 0 [0074.387] lstrlenA (lpString="*.psd") returned 5 [0074.387] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.cdr") returned 0 [0074.387] lstrlenA (lpString="*.cdr") returned 5 [0074.387] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.dwg") returned 0 [0074.387] lstrlenA (lpString="*.dwg") returned 5 [0074.387] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.max") returned 0 [0074.387] lstrlenA (lpString="*.max") returned 5 [0074.387] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.bmp") returned 0 [0074.387] lstrlenA (lpString="*.bmp") returned 5 [0074.387] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.gif") returned 0 [0074.387] lstrlenA (lpString="*.gif") returned 5 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.png") returned 0 [0074.388] lstrlenA (lpString="*.png") returned 5 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.doc") returned 0 [0074.388] lstrlenA (lpString="*.doc") returned 5 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.docx") returned 0 [0074.388] lstrlenA (lpString="*.docx") returned 6 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.xls") returned 0 [0074.388] lstrlenA (lpString="*.xls") returned 5 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.xlsx") returned 0 [0074.388] lstrlenA (lpString="*.xlsx") returned 6 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.ppt") returned 0 [0074.388] lstrlenA (lpString="*.ppt") returned 5 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.pptx") returned 0 [0074.388] lstrlenA (lpString="*.pptx") returned 6 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.txt") returned 0 [0074.388] lstrlenA (lpString="*.txt") returned 5 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.pdf") returned 0 [0074.388] lstrlenA (lpString="*.pdf") returned 5 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.djvu") returned 0 [0074.388] lstrlenA (lpString="*.djvu") returned 6 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.htm") returned 0 [0074.388] lstrlenA (lpString="*.htm") returned 5 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.html") returned 0 [0074.388] lstrlenA (lpString="*.html") returned 6 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.mdb") returned 0 [0074.388] lstrlenA (lpString="*.mdb") returned 5 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.cer") returned 0 [0074.388] lstrlenA (lpString="*.cer") returned 5 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.p12") returned 0 [0074.388] lstrlenA (lpString="*.p12") returned 5 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.pfx") returned 0 [0074.388] lstrlenA (lpString="*.pfx") returned 5 [0074.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.kwm") returned 0 [0074.389] lstrlenA (lpString="*.kwm") returned 5 [0074.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.pwm") returned 0 [0074.389] lstrlenA (lpString="*.pwm") returned 5 [0074.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.1cd") returned 0 [0074.389] lstrlenA (lpString="*.1cd") returned 5 [0074.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.md") returned 0 [0074.389] lstrlenA (lpString="*.md") returned 4 [0074.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.mdf") returned 0 [0074.389] lstrlenA (lpString="*.mdf") returned 5 [0074.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.dbf") returned 0 [0074.389] lstrlenA (lpString="*.dbf") returned 5 [0074.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.odt") returned 0 [0074.389] lstrlenA (lpString="*.odt") returned 5 [0074.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.vob") returned 0 [0074.389] lstrlenA (lpString="*.vob") returned 5 [0074.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.ifo") returned 0 [0074.389] lstrlenA (lpString="*.ifo") returned 5 [0074.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.lnk") returned 0 [0074.389] lstrlenA (lpString="*.lnk") returned 5 [0074.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.torrent") returned 0 [0074.389] lstrlenA (lpString="*.torrent") returned 9 [0074.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.mov") returned 0 [0074.389] lstrlenA (lpString="*.mov") returned 5 [0074.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.m2v") returned 0 [0074.389] lstrlenA (lpString="*.m2v") returned 5 [0074.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.3gp") returned 0 [0074.389] lstrlenA (lpString="*.3gp") returned 5 [0074.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.mpeg") returned 0 [0074.389] lstrlenA (lpString="*.mpeg") returned 6 [0074.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.mpg") returned 0 [0074.389] lstrlenA (lpString="*.mpg") returned 5 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.flv") returned 0 [0074.390] lstrlenA (lpString="*.flv") returned 5 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.avi") returned 0 [0074.390] lstrlenA (lpString="*.avi") returned 5 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.mp4") returned 0 [0074.390] lstrlenA (lpString="*.mp4") returned 5 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.wmv") returned 0 [0074.390] lstrlenA (lpString="*.wmv") returned 5 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.divx") returned 0 [0074.390] lstrlenA (lpString="*.divx") returned 6 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.mkv") returned 0 [0074.390] lstrlenA (lpString="*.mkv") returned 5 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.mp3") returned 0 [0074.390] lstrlenA (lpString="*.mp3") returned 5 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.wav") returned 0 [0074.390] lstrlenA (lpString="*.wav") returned 5 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.flac") returned 0 [0074.390] lstrlenA (lpString="*.flac") returned 6 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.ape") returned 0 [0074.390] lstrlenA (lpString="*.ape") returned 5 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.wma") returned 0 [0074.390] lstrlenA (lpString="*.wma") returned 5 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL", pszSpec="*.ac3") returned 0 [0074.390] lstrlenA (lpString="*.ac3") returned 5 [0074.390] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62e6a900, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x5b5c9f87, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x62e6a900, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x62d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EntityPickerIntl.dll", cAlternateFileName="ENTITY~1.DLL")) returned 1 [0074.390] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.390] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EAWFINTL.DLL") returned="EAWFINTL.DLL" [0074.390] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.390] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.390] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.390] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.391] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="EntityPickerIntl.dll" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll" [0074.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.zip") returned 0 [0074.391] lstrlenA (lpString="*.zip") returned 5 [0074.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.rar") returned 0 [0074.391] lstrlenA (lpString="*.rar") returned 5 [0074.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.7z") returned 0 [0074.391] lstrlenA (lpString="*.7z") returned 4 [0074.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.tar") returned 0 [0074.391] lstrlenA (lpString="*.tar") returned 5 [0074.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.gzip") returned 0 [0074.391] lstrlenA (lpString="*.gzip") returned 6 [0074.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.jpg") returned 0 [0074.391] lstrlenA (lpString="*.jpg") returned 5 [0074.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.jpeg") returned 0 [0074.391] lstrlenA (lpString="*.jpeg") returned 6 [0074.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.psd") returned 0 [0074.391] lstrlenA (lpString="*.psd") returned 5 [0074.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.cdr") returned 0 [0074.391] lstrlenA (lpString="*.cdr") returned 5 [0074.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.dwg") returned 0 [0074.391] lstrlenA (lpString="*.dwg") returned 5 [0074.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.max") returned 0 [0074.391] lstrlenA (lpString="*.max") returned 5 [0074.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.bmp") returned 0 [0074.391] lstrlenA (lpString="*.bmp") returned 5 [0074.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.gif") returned 0 [0074.391] lstrlenA (lpString="*.gif") returned 5 [0074.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.png") returned 0 [0074.391] lstrlenA (lpString="*.png") returned 5 [0074.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.doc") returned 0 [0074.391] lstrlenA (lpString="*.doc") returned 5 [0074.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.docx") returned 0 [0074.391] lstrlenA (lpString="*.docx") returned 6 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.xls") returned 0 [0074.392] lstrlenA (lpString="*.xls") returned 5 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.xlsx") returned 0 [0074.392] lstrlenA (lpString="*.xlsx") returned 6 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.ppt") returned 0 [0074.392] lstrlenA (lpString="*.ppt") returned 5 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.pptx") returned 0 [0074.392] lstrlenA (lpString="*.pptx") returned 6 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.txt") returned 0 [0074.392] lstrlenA (lpString="*.txt") returned 5 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.pdf") returned 0 [0074.392] lstrlenA (lpString="*.pdf") returned 5 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.djvu") returned 0 [0074.392] lstrlenA (lpString="*.djvu") returned 6 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.htm") returned 0 [0074.392] lstrlenA (lpString="*.htm") returned 5 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.html") returned 0 [0074.392] lstrlenA (lpString="*.html") returned 6 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.mdb") returned 0 [0074.392] lstrlenA (lpString="*.mdb") returned 5 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.cer") returned 0 [0074.392] lstrlenA (lpString="*.cer") returned 5 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.p12") returned 0 [0074.392] lstrlenA (lpString="*.p12") returned 5 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.pfx") returned 0 [0074.392] lstrlenA (lpString="*.pfx") returned 5 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.kwm") returned 0 [0074.392] lstrlenA (lpString="*.kwm") returned 5 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.pwm") returned 0 [0074.392] lstrlenA (lpString="*.pwm") returned 5 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.1cd") returned 0 [0074.392] lstrlenA (lpString="*.1cd") returned 5 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.md") returned 0 [0074.392] lstrlenA (lpString="*.md") returned 4 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.mdf") returned 0 [0074.393] lstrlenA (lpString="*.mdf") returned 5 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.dbf") returned 0 [0074.393] lstrlenA (lpString="*.dbf") returned 5 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.odt") returned 0 [0074.393] lstrlenA (lpString="*.odt") returned 5 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.vob") returned 0 [0074.393] lstrlenA (lpString="*.vob") returned 5 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.ifo") returned 0 [0074.393] lstrlenA (lpString="*.ifo") returned 5 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.lnk") returned 0 [0074.393] lstrlenA (lpString="*.lnk") returned 5 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.torrent") returned 0 [0074.393] lstrlenA (lpString="*.torrent") returned 9 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.mov") returned 0 [0074.393] lstrlenA (lpString="*.mov") returned 5 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.m2v") returned 0 [0074.393] lstrlenA (lpString="*.m2v") returned 5 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.3gp") returned 0 [0074.393] lstrlenA (lpString="*.3gp") returned 5 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.mpeg") returned 0 [0074.393] lstrlenA (lpString="*.mpeg") returned 6 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.mpg") returned 0 [0074.393] lstrlenA (lpString="*.mpg") returned 5 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.flv") returned 0 [0074.393] lstrlenA (lpString="*.flv") returned 5 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.avi") returned 0 [0074.393] lstrlenA (lpString="*.avi") returned 5 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.mp4") returned 0 [0074.393] lstrlenA (lpString="*.mp4") returned 5 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.wmv") returned 0 [0074.393] lstrlenA (lpString="*.wmv") returned 5 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.divx") returned 0 [0074.394] lstrlenA (lpString="*.divx") returned 6 [0074.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.mkv") returned 0 [0074.394] lstrlenA (lpString="*.mkv") returned 5 [0074.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.mp3") returned 0 [0074.394] lstrlenA (lpString="*.mp3") returned 5 [0074.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.wav") returned 0 [0074.394] lstrlenA (lpString="*.wav") returned 5 [0074.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.flac") returned 0 [0074.394] lstrlenA (lpString="*.flac") returned 6 [0074.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.ape") returned 0 [0074.394] lstrlenA (lpString="*.ape") returned 5 [0074.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.wma") returned 0 [0074.394] lstrlenA (lpString="*.wma") returned 5 [0074.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll", pszSpec="*.ac3") returned 0 [0074.394] lstrlenA (lpString="*.ac3") returned 5 [0074.394] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c38e00, ftCreationTime.dwHighDateTime=0x1d0cb67, ftLastAccessTime.dwLowDateTime=0x605efdc1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x85c38e00, ftLastWriteTime.dwHighDateTime=0x1d0cb67, nFileSizeHigh=0x0, nFileSizeLow=0x44d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPR.DLL", cAlternateFileName="")) returned 1 [0074.394] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.394] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EntityPickerIntl.dll") returned="EntityPickerIntl.dll" [0074.394] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.394] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.394] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.395] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.395] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="ENVELOPR.DLL" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ENVELOPR.DLL") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ENVELOPR.DLL" [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ENVELOPR.DLL", pszSpec="*.zip") returned 0 [0074.395] lstrlenA (lpString="*.zip") returned 5 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ENVELOPR.DLL", pszSpec="*.rar") returned 0 [0074.395] lstrlenA (lpString="*.rar") returned 5 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ENVELOPR.DLL", pszSpec="*.7z") returned 0 [0074.395] lstrlenA (lpString="*.7z") returned 4 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ENVELOPR.DLL", pszSpec="*.tar") returned 0 [0074.395] lstrlenA (lpString="*.tar") returned 5 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ENVELOPR.DLL", pszSpec="*.gzip") returned 0 [0074.395] lstrlenA (lpString="*.gzip") returned 6 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ENVELOPR.DLL", pszSpec="*.jpg") returned 0 [0074.395] lstrlenA (lpString="*.jpg") returned 5 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ENVELOPR.DLL", pszSpec="*.jpeg") returned 0 [0074.395] lstrlenA (lpString="*.jpeg") returned 6 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ENVELOPR.DLL", pszSpec="*.psd") returned 0 [0074.395] lstrlenA (lpString="*.psd") returned 5 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ENVELOPR.DLL", pszSpec="*.cdr") returned 0 [0074.395] lstrlenA (lpString="*.cdr") returned 5 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ENVELOPR.DLL", pszSpec="*.dwg") returned 0 [0074.395] lstrlenA (lpString="*.dwg") returned 5 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ENVELOPR.DLL", pszSpec="*.max") returned 0 [0074.395] lstrlenA (lpString="*.max") returned 5 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ENVELOPR.DLL", pszSpec="*.bmp") returned 0 [0074.395] lstrlenA (lpString="*.bmp") returned 5 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ENVELOPR.DLL", pszSpec="*.gif") returned 0 [0074.395] lstrlenA (lpString="*.gif") returned 5 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ENVELOPR.DLL", pszSpec="*.png") returned 0 [0074.395] lstrlenA (lpString="*.png") returned 5 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ENVELOPR.DLL", pszSpec="*.doc") returned 0 [0074.395] lstrlenA (lpString="*.doc") returned 5 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ENVELOPR.DLL", pszSpec="*.docx") returned 0 [0074.396] lstrlenA (lpString="*.docx") returned 6 [0074.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ENVELOPR.DLL", pszSpec="*.xls") returned 0 [0074.396] lstrlenA (lpString="*.xls") returned 5 [0074.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ENVELOPR.DLL", pszSpec="*.xlsx") returned 0 [0074.396] lstrlenA (lpString="*.xlsx") returned 6 [0074.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ENVELOPR.DLL", pszSpec="*.ppt") returned 0 [0074.396] lstrlenA (lpString="*.ppt") returned 5 [0074.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ENVELOPR.DLL", pszSpec="*.pptx") returned 0 [0074.396] lstrlenA (lpString="*.pptx") returned 6 [0074.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ENVELOPR.DLL", pszSpec="*.txt") returned 0 [0074.396] lstrlenA (lpString="*.txt") returned 5 [0074.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ENVELOPR.DLL", pszSpec="*.pdf") returned 0 [0074.396] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6abd2500, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x549967c3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6abd2500, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x173da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.HXS", cAlternateFileName="")) returned 1 [0074.396] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.396] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ENVELOPR.DLL") returned="ENVELOPR.DLL" [0074.396] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.396] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.396] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.396] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.396] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="EXCEL.HXS" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EXCEL.HXS") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EXCEL.HXS" [0074.396] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6abd2500, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x5499f10c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6abd2500, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL_COL.HXC", cAlternateFileName="EXCEL_~1.HXC")) returned 1 [0074.397] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.397] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EXCEL.HXS") returned="EXCEL.HXS" [0074.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.397] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.397] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.397] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.397] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="EXCEL_COL.HXC" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EXCEL_COL.HXC") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EXCEL_COL.HXC" [0074.397] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6abd2500, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x549a3e32, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6abd2500, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL_COL.HXT", cAlternateFileName="EXCEL_~1.HXT")) returned 1 [0074.397] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.397] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EXCEL_COL.HXC") returned="EXCEL_COL.HXC" [0074.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.397] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.397] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.397] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.397] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="EXCEL_COL.HXT" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EXCEL_COL.HXT") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EXCEL_COL.HXT" [0074.397] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6abd2500, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x549a8c7e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6abd2500, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL_F_COL.HXK", cAlternateFileName="EXCEL_~1.HXK")) returned 1 [0074.397] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.397] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EXCEL_COL.HXT") returned="EXCEL_COL.HXT" [0074.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.397] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.397] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.397] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.397] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="EXCEL_F_COL.HXK" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EXCEL_F_COL.HXK") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EXCEL_F_COL.HXK" [0074.398] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6abd2500, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x549ac804, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6abd2500, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL_K_COL.HXK", cAlternateFileName="EXCEL_~2.HXK")) returned 1 [0074.398] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.398] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EXCEL_F_COL.HXK") returned="EXCEL_F_COL.HXK" [0074.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.398] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.398] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.398] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.398] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="EXCEL_K_COL.HXK" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EXCEL_K_COL.HXK") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EXCEL_K_COL.HXK" [0074.398] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec957700, ftCreationTime.dwHighDateTime=0x1d0cb68, ftLastAccessTime.dwLowDateTime=0x5b61646a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xec957700, ftLastWriteTime.dwHighDateTime=0x1d0cb68, nFileSizeHigh=0x0, nFileSizeLow=0x32c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPTOOWS.DLL", cAlternateFileName="")) returned 1 [0074.398] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.398] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EXCEL_K_COL.HXK") returned="EXCEL_K_COL.HXK" [0074.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.398] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.398] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.398] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.398] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="EXPTOOWS.DLL" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EXPTOOWS.DLL") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EXPTOOWS.DLL" [0074.398] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f81d900, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x5b61646a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6f81d900, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16800, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPTOOWS.XLA", cAlternateFileName="")) returned 1 [0074.398] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.398] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EXPTOOWS.DLL") returned="EXPTOOWS.DLL" [0074.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.398] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.398] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.398] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.399] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="EXPTOOWS.XLA" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EXPTOOWS.XLA") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EXPTOOWS.XLA" [0074.399] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc58b7500, ftCreationTime.dwHighDateTime=0x1d0cb69, ftLastAccessTime.dwLowDateTime=0x5b6cbf35, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xc58b7500, ftLastWriteTime.dwHighDateTime=0x1d0cb69, nFileSizeHigh=0x0, nFileSizeLow=0x44a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="frintl.dll", cAlternateFileName="")) returned 1 [0074.399] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.399] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\EXPTOOWS.XLA") returned="EXPTOOWS.XLA" [0074.399] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.399] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.399] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.399] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.399] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="frintl.dll" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\frintl.dll") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\frintl.dll" [0074.399] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f81d900, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x5b6ea6bd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6f81d900, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="GR8GALRY.GRA", cAlternateFileName="")) returned 1 [0074.399] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.399] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\frintl.dll") returned="frintl.dll" [0074.399] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.399] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.399] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.399] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.399] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="GR8GALRY.GRA" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GR8GALRY.GRA") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GR8GALRY.GRA" [0074.399] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f81d900, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x5b6fa4e5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6f81d900, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x94d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH.HXS", cAlternateFileName="")) returned 1 [0074.399] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.399] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GR8GALRY.GRA") returned="GR8GALRY.GRA" [0074.399] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.399] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.399] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.400] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.400] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="GRAPH.HXS" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GRAPH.HXS") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GRAPH.HXS" [0074.400] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f81d900, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x5b706814, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6f81d900, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_COL.HXC", cAlternateFileName="GRAPH_~1.HXC")) returned 1 [0074.400] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.400] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GRAPH.HXS") returned="GRAPH.HXS" [0074.400] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.400] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.400] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.400] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.400] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="GRAPH_COL.HXC" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GRAPH_COL.HXC") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GRAPH_COL.HXC" [0074.400] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f81d900, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x5b70a2ac, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6f81d900, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_COL.HXT", cAlternateFileName="GRAPH_~1.HXT")) returned 1 [0074.400] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.400] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GRAPH_COL.HXC") returned="GRAPH_COL.HXC" [0074.400] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.400] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.400] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.400] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.400] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="GRAPH_COL.HXT" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GRAPH_COL.HXT") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GRAPH_COL.HXT" [0074.400] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f81d900, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x5b71041f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6f81d900, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_F_COL.HXK", cAlternateFileName="GRAPH_~1.HXK")) returned 1 [0074.400] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.400] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GRAPH_COL.HXT") returned="GRAPH_COL.HXT" [0074.400] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.400] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.401] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.401] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.401] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="GRAPH_F_COL.HXK" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GRAPH_F_COL.HXK") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GRAPH_F_COL.HXK" [0074.401] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f81d900, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x5b716638, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6f81d900, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_K_COL.HXK", cAlternateFileName="GRAPH_~2.HXK")) returned 1 [0074.402] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.402] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GRAPH_F_COL.HXK") returned="GRAPH_F_COL.HXK" [0074.402] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.402] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.402] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.402] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.402] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="GRAPH_K_COL.HXK" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GRAPH_K_COL.HXK") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GRAPH_K_COL.HXK" [0074.402] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62e6a900, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x5b71eeb0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x62e6a900, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x1e4c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.DLL", cAlternateFileName="")) returned 1 [0074.402] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.402] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GRAPH_K_COL.HXK") returned="GRAPH_K_COL.HXK" [0074.402] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.402] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.402] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.402] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.402] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="GRINTL32.DLL" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GRINTL32.DLL") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GRINTL32.DLL" [0074.402] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62e6a900, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x5b729fd0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x62e6a900, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x34c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRLEX.DLL", cAlternateFileName="")) returned 1 [0074.402] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.402] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GRINTL32.DLL") returned="GRINTL32.DLL" [0074.402] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.402] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.403] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.403] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.403] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="GRLEX.DLL" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GRLEX.DLL") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GRLEX.DLL" [0074.403] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f81d900, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x571ed47e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6f81d900, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1f7cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE.HXS", cAlternateFileName="")) returned 1 [0074.403] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.403] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GRLEX.DLL") returned="GRLEX.DLL" [0074.403] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.403] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.403] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.403] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.403] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="GROOVE.HXS" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GROOVE.HXS") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GROOVE.HXS" [0074.403] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98899300, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x5726c0f8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x98899300, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x87d4a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveIntlResource.dll", cAlternateFileName="GROOVE~1.DLL")) returned 1 [0074.403] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.403] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GROOVE.HXS") returned="GROOVE.HXS" [0074.403] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.403] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.403] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" [0074.403] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.403] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f81d900, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x571ed47e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6f81d900, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE_COL.HXC", cAlternateFileName="GROOVE~1.HXC")) returned 1 [0074.403] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.404] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GrooveIntlResource.dll") returned="GrooveIntlResource.dll" [0074.404] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.404] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.404] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.404] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f81d900, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x571ed47e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6f81d900, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE_COL.HXT", cAlternateFileName="GROOVE~1.HXT")) returned 1 [0074.404] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.404] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GROOVE_COL.HXC") returned="GROOVE_COL.HXC" [0074.404] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.404] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.404] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.404] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f81d900, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x571ed47e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6f81d900, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE_F_COL.HXK", cAlternateFileName="GROOVE~1.HXK")) returned 1 [0074.404] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.404] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GROOVE_COL.HXT") returned="GROOVE_COL.HXT" [0074.404] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.404] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.404] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.404] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f81d900, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x5721367d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6f81d900, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE_K_COL.HXK", cAlternateFileName="GROOVE~2.HXK")) returned 1 [0074.404] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.404] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GROOVE_F_COL.HXK") returned="GROOVE_F_COL.HXK" [0074.404] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.404] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.405] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.405] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x220ad5e0, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x220ad5e0, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x220ad5e0, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0074.405] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.405] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa04a3700, ftCreationTime.dwHighDateTime=0x1d0cb68, ftLastAccessTime.dwLowDateTime=0x64e52f66, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xa04a3700, ftLastWriteTime.dwHighDateTime=0x1d0cb68, nFileSizeHigh=0x0, nFileSizeLow=0x30b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IFDPINTL.DLL", cAlternateFileName="")) returned 1 [0074.405] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.405] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\GROOVE_K_COL.HXK") returned="GROOVE_K_COL.HXK" [0074.405] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.405] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.405] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.405] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e43300, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x521a8926, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x71e43300, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2bc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Invite or Link.one", cAlternateFileName="INVITE~1.ONE")) returned 1 [0074.405] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.405] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\IFDPINTL.DLL") returned="IFDPINTL.DLL" [0074.405] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.405] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.405] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.405] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e50ac00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x58cda127, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6e50ac00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x228fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC.HXS", cAlternateFileName="")) returned 1 [0074.405] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.405] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\Invite or Link.one") returned="Invite or Link.one" [0074.405] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.405] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.405] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.406] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7076e00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x58ce9f13, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xc7076e00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x522a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="lyncDesktopResources.dll", cAlternateFileName="LYNCDE~1.DLL")) returned 1 [0074.406] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.406] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\LYNC.HXS") returned="LYNC.HXS" [0074.406] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.406] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.406] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.406] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e50ac00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x58d9c33a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6e50ac00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x21c80, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC_BASIC.HXS", cAlternateFileName="LYNC_B~1.HXS")) returned 1 [0074.406] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.406] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\lyncDesktopResources.dll") returned="lyncDesktopResources.dll" [0074.406] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.406] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.406] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.406] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e50ac00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x58da860d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6e50ac00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC_BASIC_COL.HXC", cAlternateFileName="LYNC_B~1.HXC")) returned 1 [0074.406] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.406] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\LYNC_BASIC.HXS") returned="LYNC_BASIC.HXS" [0074.406] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.406] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.406] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.406] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e50ac00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x58dad420, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6e50ac00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC_BASIC_COL.HXT", cAlternateFileName="LYNC_B~1.HXT")) returned 1 [0074.406] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.406] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\LYNC_BASIC_COL.HXC") returned="LYNC_BASIC_COL.HXC" [0074.407] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.407] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.407] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.407] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e50ac00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x58db4933, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6e50ac00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC_BASIC_F_COL.HXK", cAlternateFileName="LYNC_B~1.HXK")) returned 1 [0074.407] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.407] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\LYNC_BASIC_COL.HXT") returned="LYNC_BASIC_COL.HXT" [0074.407] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.407] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.407] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.407] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e50ac00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x58db9790, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6e50ac00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC_BASIC_K_COL.HXK", cAlternateFileName="LYNC_B~2.HXK")) returned 1 [0074.407] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.407] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\LYNC_BASIC_F_COL.HXK") returned="LYNC_BASIC_F_COL.HXK" [0074.407] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.407] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.407] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.407] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e50ac00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x58dbe593, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6e50ac00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC_COL.HXC", cAlternateFileName="")) returned 1 [0074.407] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.407] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\LYNC_BASIC_K_COL.HXK") returned="LYNC_BASIC_K_COL.HXK" [0074.407] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.407] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.408] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.408] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e50ac00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x58dc4742, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6e50ac00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC_COL.HXT", cAlternateFileName="")) returned 1 [0074.408] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.408] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\LYNC_COL.HXC") returned="LYNC_COL.HXC" [0074.408] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.408] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.408] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.408] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e50ac00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x58dcbcb8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6e50ac00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC_F_COL.HXK", cAlternateFileName="LYNC_F~1.HXK")) returned 1 [0074.408] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.408] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\LYNC_COL.HXT") returned="LYNC_COL.HXT" [0074.408] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.408] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.408] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.408] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e50ac00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x58dd31aa, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6e50ac00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC_K_COL.HXK", cAlternateFileName="LYNC_K~1.HXK")) returned 1 [0074.408] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.408] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\LYNC_F_COL.HXK") returned="LYNC_F_COL.HXK" [0074.408] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.408] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.408] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.409] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e50ac00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x58ddcdf9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6e50ac00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x22756, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC_ONLINE.HXS", cAlternateFileName="LYNC_O~1.HXS")) returned 1 [0074.409] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.409] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\LYNC_K_COL.HXK") returned="LYNC_K_COL.HXK" [0074.409] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.409] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.409] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.409] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e50ac00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x58de4315, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6e50ac00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC_ONLINE_COL.HXC", cAlternateFileName="LYNC_O~1.HXC")) returned 1 [0074.409] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.409] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\LYNC_ONLINE.HXS") returned="LYNC_ONLINE.HXS" [0074.409] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.409] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.409] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.569] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e50ac00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x58df2dc6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6e50ac00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC_ONLINE_COL.HXT", cAlternateFileName="LYNC_O~1.HXT")) returned 1 [0074.569] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.570] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\LYNC_ONLINE_COL.HXC") returned="LYNC_ONLINE_COL.HXC" [0074.570] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.570] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.570] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.570] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e50ac00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x58df7be6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6e50ac00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC_ONLINE_F_COL.HXK", cAlternateFileName="LYNC_O~1.HXK")) returned 1 [0074.570] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.570] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\LYNC_ONLINE_COL.HXT") returned="LYNC_ONLINE_COL.HXT" [0074.570] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.570] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.570] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.570] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e50ac00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x58dfc9b3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6e50ac00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC_ONLINE_K_COL.HXK", cAlternateFileName="LYNC_O~2.HXK")) returned 1 [0074.570] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.570] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\LYNC_ONLINE_F_COL.HXK") returned="LYNC_ONLINE_F_COL.HXK" [0074.570] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.570] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.570] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.571] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c38e00, ftCreationTime.dwHighDateTime=0x1d0cb67, ftLastAccessTime.dwLowDateTime=0x606650d8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x85c38e00, ftLastWriteTime.dwHighDateTime=0x1d0cb67, nFileSizeHigh=0x0, nFileSizeLow=0x1364b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIR.DLL", cAlternateFileName="")) returned 1 [0074.571] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.571] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\LYNC_ONLINE_K_COL.HXK") returned="LYNC_ONLINE_K_COL.HXK" [0074.571] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.571] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.571] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.571] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c38e00, ftCreationTime.dwHighDateTime=0x1d0cb67, ftLastAccessTime.dwLowDateTime=0x606727ab, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x85c38e00, ftLastWriteTime.dwHighDateTime=0x1d0cb67, nFileSizeHigh=0x0, nFileSizeLow=0x2b118, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPISHELLR.DLL", cAlternateFileName="MAPISH~1.DLL")) returned 1 [0074.571] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.571] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\MAPIR.DLL") returned="MAPIR.DLL" [0074.571] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.571] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.571] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.571] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda99800, ftCreationTime.dwHighDateTime=0x1d0cb68, ftLastAccessTime.dwLowDateTime=0x636449e2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xda99800, ftLastWriteTime.dwHighDateTime=0x1d0cb68, nFileSizeHigh=0x0, nFileSizeLow=0x6c8a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOR6INT.DLL", cAlternateFileName="")) returned 1 [0074.571] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.571] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\MAPISHELLR.DLL") returned="MAPISHELLR.DLL" [0074.571] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.571] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.571] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.571] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x698bf800, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x509fe3da, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x698bf800, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4297c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.HXS", cAlternateFileName="")) returned 1 [0074.581] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.581] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\MOR6INT.DLL") returned="MOR6INT.DLL" [0074.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.581] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.581] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.581] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x698bf800, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x50a0812e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x698bf800, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS_COL.HXC", cAlternateFileName="MSACCE~1.HXC")) returned 1 [0074.582] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.582] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\MSACCESS.HXS") returned="MSACCESS.HXS" [0074.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.582] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.582] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.582] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x698bf800, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x50a0ce0b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x698bf800, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS_COL.HXT", cAlternateFileName="MSACCE~1.HXT")) returned 1 [0074.582] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.582] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\MSACCESS_COL.HXC") returned="MSACCESS_COL.HXC" [0074.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.582] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.582] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.582] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x698bf800, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x50a12fbb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x698bf800, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS_F_COL.HXK", cAlternateFileName="MSACCE~1.HXK")) returned 1 [0074.582] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.582] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\MSACCESS_COL.HXT") returned="MSACCESS_COL.HXT" [0074.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.582] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.582] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.582] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x698bf800, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x50a17def, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x698bf800, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS_K_COL.HXK", cAlternateFileName="MSACCE~2.HXK")) returned 1 [0074.582] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.583] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\MSACCESS_F_COL.HXK") returned="MSACCESS_F_COL.HXK" [0074.583] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.583] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.583] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.583] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x582a1500, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x50a3b50d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x582a1500, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x1436c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSAIN.DLL", cAlternateFileName="")) returned 1 [0074.583] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.583] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\MSACCESS_K_COL.HXK") returned="MSACCESS_K_COL.HXK" [0074.583] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.583] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.583] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.583] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6eb5900, ftCreationTime.dwHighDateTime=0x1d0ca65, ftLastAccessTime.dwLowDateTime=0x4f0b06d3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xd6eb5900, ftLastWriteTime.dwHighDateTime=0x1d0ca65, nFileSizeHigh=0x0, nFileSizeLow=0x9362, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.ACL", cAlternateFileName="")) returned 1 [0074.583] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.583] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\MSAIN.DLL") returned="MSAIN.DLL" [0074.583] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.583] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.583] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.583] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69275600, ftCreationTime.dwHighDateTime=0x1d0cb67, ftLastAccessTime.dwLowDateTime=0x5f2f46de, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x69275600, ftLastWriteTime.dwHighDateTime=0x1d0cb67, nFileSizeHigh=0x0, nFileSizeLow=0x5ae0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msotdintl.dll", cAlternateFileName="MSOTDI~1.DLL")) returned 1 [0074.583] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.583] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\MSO.ACL") returned="MSO.ACL" [0074.583] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.584] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.584] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.584] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62e6a900, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x5b7a66d6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x62e6a900, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0xb2c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msotelemetryintl.dll", cAlternateFileName="MSOTEL~1.DLL")) returned 1 [0074.584] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.584] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\msotdintl.dll") returned="msotdintl.dll" [0074.584] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.584] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.584] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.584] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b30600, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x5b7adbfd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x70b30600, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2d0b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC.HXS", cAlternateFileName="")) returned 1 [0074.584] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.584] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\msotelemetryintl.dll") returned="msotelemetryintl.dll" [0074.584] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.584] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.584] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.584] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b30600, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x5b7b786e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x70b30600, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC_COL.HXC", cAlternateFileName="MSOUC_~1.HXC")) returned 1 [0074.584] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.584] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\MSOUC.HXS") returned="MSOUC.HXS" [0074.584] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.584] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.585] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.585] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b30600, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x5b7bc629, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x70b30600, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC_COL.HXT", cAlternateFileName="MSOUC_~1.HXT")) returned 1 [0074.585] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.585] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\MSOUC_COL.HXC") returned="MSOUC_COL.HXC" [0074.585] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.585] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.585] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.585] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b30600, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x5b7c4f11, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x70b30600, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC_F_COL.HXK", cAlternateFileName="MSOUC_~1.HXK")) returned 1 [0074.585] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.585] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\MSOUC_COL.HXT") returned="MSOUC_COL.HXT" [0074.585] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.585] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.585] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.585] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b30600, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x5b7cb085, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x70b30600, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC_K_COL.HXK", cAlternateFileName="MSOUC_~2.HXK")) returned 1 [0074.585] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.585] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\MSOUC_F_COL.HXK") returned="MSOUC_F_COL.HXK" [0074.585] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.586] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.586] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.586] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7577ba00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x636547a9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x7577ba00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5f470, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.HXS", cAlternateFileName="")) returned 1 [0074.586] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.586] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\MSOUC_K_COL.HXK") returned="MSOUC_K_COL.HXK" [0074.586] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.586] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.586] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.586] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a8e700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x6365bcdc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x76a8e700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2ef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.OPG", cAlternateFileName="")) returned 1 [0074.586] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.586] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\MSPUB.HXS") returned="MSPUB.HXS" [0074.586] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.586] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.586] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.586] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7577ba00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x63660b77, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x7577ba00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB_COL.HXC", cAlternateFileName="MSPUB_~1.HXC")) returned 1 [0074.586] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.586] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\MSPUB.OPG") returned="MSPUB.OPG" [0074.586] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.586] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.587] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.587] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7577ba00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x6366596c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x7577ba00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB_COL.HXT", cAlternateFileName="MSPUB_~1.HXT")) returned 1 [0074.587] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.587] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\MSPUB_COL.HXC") returned="MSPUB_COL.HXC" [0074.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.587] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.587] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.587] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7577ba00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x6366a755, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x7577ba00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB_F_COL.HXK", cAlternateFileName="MSPUB_~1.HXK")) returned 1 [0074.587] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.587] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\MSPUB_COL.HXT") returned="MSPUB_COL.HXT" [0074.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.587] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.587] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.587] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7577ba00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x6366e268, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x7577ba00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB_K_COL.HXK", cAlternateFileName="MSPUB_~2.HXK")) returned 1 [0074.587] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.587] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\MSPUB_F_COL.HXK") returned="MSPUB_F_COL.HXK" [0074.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.587] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.587] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.588] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b30600, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x5b7d8765, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x70b30600, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7d682, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSQRY32.CHM", cAlternateFileName="")) returned 1 [0074.588] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.588] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\MSPUB_K_COL.HXK") returned="MSPUB_K_COL.HXK" [0074.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.588] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.588] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.588] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62e6a900, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x5b7e720c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x62e6a900, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x70c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSRINTL.DLL", cAlternateFileName="")) returned 1 [0074.588] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.588] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\MSQRY32.CHM") returned="MSQRY32.CHM" [0074.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.588] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.588] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.588] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7076e00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x58cf4edc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xc7076e00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0xe8a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ocapires.dll", cAlternateFileName="")) returned 1 [0074.588] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.588] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\MSSRINTL.DLL") returned="MSSRINTL.DLL" [0074.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.588] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.588] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.588] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7076e00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x58cf9cdf, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xc7076e00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x2ca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OcHelperResource.dll", cAlternateFileName="OCHELP~1.DLL")) returned 1 [0074.588] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.588] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ocapires.dll") returned="ocapires.dll" [0074.589] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.589] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.589] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.589] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec957700, ftCreationTime.dwHighDateTime=0x1d0cb68, ftLastAccessTime.dwLowDateTime=0x5b88358d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xec957700, ftLastWriteTime.dwHighDateTime=0x1d0cb68, nFileSizeHigh=0x0, nFileSizeLow=0x1a2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCLTINT.DLL", cAlternateFileName="")) returned 1 [0074.589] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.589] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\OcHelperResource.dll") returned="OcHelperResource.dll" [0074.589] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.589] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.589] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.589] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7076e00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x58d24871, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xc7076e00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x16e6a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OcPubRes.dll", cAlternateFileName="")) returned 1 [0074.589] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.589] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\OCLTINT.DLL") returned="OCLTINT.DLL" [0074.589] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.589] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.589] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.589] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c38e00, ftCreationTime.dwHighDateTime=0x1d0cb67, ftLastAccessTime.dwLowDateTime=0x606eefc2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x85c38e00, ftLastWriteTime.dwHighDateTime=0x1d0cb67, nFileSizeHigh=0x0, nFileSizeLow=0x610c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSINTL.DLL", cAlternateFileName="")) returned 1 [0074.589] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.589] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\OcPubRes.dll") returned="OcPubRes.dll" [0074.589] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.589] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.590] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.590] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e43300, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x521c715f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x71e43300, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3d1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE.HXS", cAlternateFileName="")) returned 1 [0074.590] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.590] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\OMSINTL.DLL") returned="OMSINTL.DLL" [0074.590] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.590] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.590] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.590] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e43300, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x521cc018, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x71e43300, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE_COL.HXC", cAlternateFileName="ONENOT~1.HXC")) returned 1 [0074.590] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.590] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ONENOTE.HXS") returned="ONENOTE.HXS" [0074.590] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.590] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.590] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.590] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e43300, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x521d0dc4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x71e43300, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE_COL.HXT", cAlternateFileName="ONENOT~1.HXT")) returned 1 [0074.590] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.590] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ONENOTE_COL.HXC") returned="ONENOTE_COL.HXC" [0074.590] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.590] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.590] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.591] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e43300, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x521d6f3d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x71e43300, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE_F_COL.HXK", cAlternateFileName="ONENOT~1.HXK")) returned 1 [0074.591] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.591] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ONENOTE_COL.HXT") returned="ONENOTE_COL.HXT" [0074.591] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.591] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.591] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.591] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e43300, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x521daa7e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x71e43300, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE_K_COL.HXK", cAlternateFileName="ONENOT~2.HXK")) returned 1 [0074.591] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.591] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ONENOTE_F_COL.HXK") returned="ONENOTE_F_COL.HXK" [0074.591] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.591] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.591] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.591] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b2a3200, ftCreationTime.dwHighDateTime=0x1d0cb67, ftLastAccessTime.dwLowDateTime=0x521e9429, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x2b2a3200, ftLastWriteTime.dwHighDateTime=0x1d0cb67, nFileSizeHigh=0x0, nFileSizeLow=0x48e62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONGuide.onepkg", cAlternateFileName="ONGUID~1.ONE")) returned 1 [0074.591] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.591] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ONENOTE_K_COL.HXK") returned="ONENOTE_K_COL.HXK" [0074.591] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.591] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.591] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.591] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b2a3200, ftCreationTime.dwHighDateTime=0x1d0cb67, ftLastAccessTime.dwLowDateTime=0x521f4406, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x2b2a3200, ftLastWriteTime.dwHighDateTime=0x1d0cb67, nFileSizeHigh=0x0, nFileSizeLow=0x294d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.DLL", cAlternateFileName="")) returned 1 [0074.594] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.594] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ONGuide.onepkg") returned="ONGuide.onepkg" [0074.594] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.594] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.594] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.594] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62e6a900, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x5b8b42fb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x62e6a900, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x42d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ospintl.dll", cAlternateFileName="")) returned 1 [0074.594] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.594] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ONINTL.DLL") returned="ONINTL.DLL" [0074.594] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.594] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.594] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.594] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73156000, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x6071e9af, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x73156000, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTFORM.DAT", cAlternateFileName="")) returned 1 [0074.594] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.594] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\ospintl.dll") returned="ospintl.dll" [0074.594] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.594] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.594] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.595] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c38e00, ftCreationTime.dwHighDateTime=0x1d0cb67, ftLastAccessTime.dwLowDateTime=0x6079b1e4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x85c38e00, ftLastWriteTime.dwHighDateTime=0x1d0cb67, nFileSizeHigh=0x0, nFileSizeLow=0x7214b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.DLL", cAlternateFileName="")) returned 1 [0074.595] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.595] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\OUTFORM.DAT") returned="OUTFORM.DAT" [0074.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.595] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.595] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.595] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73156000, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x607b7315, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x73156000, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1467a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.HOL", cAlternateFileName="")) returned 1 [0074.595] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.595] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\OUTLLIBR.DLL") returned="OUTLLIBR.DLL" [0074.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.595] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.595] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.595] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74468d00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x607ce61d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x74468d00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa538a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.HXS", cAlternateFileName="")) returned 1 [0074.595] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.595] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\OUTLOOK.HOL") returned="OUTLOOK.HOL" [0074.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.595] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.596] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.596] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74468d00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x607d5c9c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x74468d00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK_COL.HXC", cAlternateFileName="OUTLOO~1.HXC")) returned 1 [0074.596] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.596] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\OUTLOOK.HXS") returned="OUTLOOK.HXS" [0074.596] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.596] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.596] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.596] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74468d00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x607da938, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x74468d00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK_COL.HXT", cAlternateFileName="OUTLOO~1.HXT")) returned 1 [0074.596] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.596] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\OUTLOOK_COL.HXC") returned="OUTLOOK_COL.HXC" [0074.596] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.596] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.596] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.596] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74468d00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x607df7a5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x74468d00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK_F_COL.HXK", cAlternateFileName="OUTLOO~1.HXK")) returned 1 [0074.596] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.596] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\OUTLOOK_COL.HXT") returned="OUTLOOK_COL.HXT" [0074.596] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.596] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.596] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.597] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74468d00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x607e4599, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x74468d00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK_K_COL.HXK", cAlternateFileName="OUTLOO~2.HXK")) returned 1 [0074.597] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.597] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\OUTLOOK_F_COL.HXK") returned="OUTLOOK_F_COL.HXK" [0074.597] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.597] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.597] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.597] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74468d00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x607ea72f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x74468d00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLPERF.H", cAlternateFileName="")) returned 1 [0074.597] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.597] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.597] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.597] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.598] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5bb4600, ftCreationTime.dwHighDateTime=0x1d0ca2e, ftLastAccessTime.dwLowDateTime=0x607f1c6a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xb5bb4600, ftLastWriteTime.dwHighDateTime=0x1d0ca2e, nFileSizeHigh=0x0, nFileSizeLow=0xa87, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLPERF.INI", cAlternateFileName="")) returned 1 [0074.598] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.598] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.598] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.598] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c38e00, ftCreationTime.dwHighDateTime=0x1d0cb67, ftLastAccessTime.dwLowDateTime=0x607f91cd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x85c38e00, ftLastWriteTime.dwHighDateTime=0x1d0cb67, nFileSizeHigh=0x0, nFileSizeLow=0x1eca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLWVW.DLL", cAlternateFileName="")) returned 1 [0074.598] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.598] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.598] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.598] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f81d900, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x5b8b9110, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6f81d900, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWSHLP10.CHM", cAlternateFileName="")) returned 1 [0074.598] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.598] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.598] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.598] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7577ba00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x6269dcf6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x7577ba00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x70876, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.HXS", cAlternateFileName="")) returned 1 [0074.599] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.599] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.599] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.599] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.599] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7577ba00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x626a659d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x7577ba00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT_COL.HXC", cAlternateFileName="POWERP~1.HXC")) returned 1 [0074.599] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.614] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.614] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.620] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.624] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7577ba00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x626ab3af, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x7577ba00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT_COL.HXT", cAlternateFileName="POWERP~1.HXT")) returned 1 [0074.624] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.624] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.624] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.624] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.624] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7577ba00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x626b01da, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x7577ba00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT_F_COL.HXK", cAlternateFileName="POWERP~1.HXK")) returned 1 [0074.624] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.624] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.625] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.625] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.625] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7577ba00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x626b8a00, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x7577ba00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT_K_COL.HXK", cAlternateFileName="POWERP~2.HXK")) returned 1 [0074.625] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.625] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.625] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.625] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.625] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbefbfe00, ftCreationTime.dwHighDateTime=0x1d0cb67, ftLastAccessTime.dwLowDateTime=0x626d4bca, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xbefbfe00, ftLastWriteTime.dwHighDateTime=0x1d0cb67, nFileSizeHigh=0x0, nFileSizeLow=0x125ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.DLL", cAlternateFileName="")) returned 1 [0074.625] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.625] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.625] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.625] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.625] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7577ba00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x626e3655, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x7577ba00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4571e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEWTEMPLATE.POTX", cAlternateFileName="PREVIE~1.POT")) returned 1 [0074.625] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.625] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.625] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.626] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.626] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7577ba00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x626f35e9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x7577ba00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x48d3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEWTEMPLATE2.POTX", cAlternateFileName="PREVIE~2.POT")) returned 1 [0074.626] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.626] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.626] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.626] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.626] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62e6a900, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x5b8eb275, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x62e6a900, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x2ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTOCOLHANDLERINTL.DLL", cAlternateFileName="PROTOC~1.DLL")) returned 1 [0074.626] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.626] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.626] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.626] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.626] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x698bf800, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x54a04564, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x698bf800, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLN.DOC", cAlternateFileName="")) returned 1 [0074.626] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.626] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.627] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.627] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.627] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLN.DOC" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLN.DOC") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLN.DOC" [0074.627] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLN.DOC" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLN.DOC") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLN.DOC" [0074.627] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLN.DOC" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\prottpln.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0074.631] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4e00 [0074.631] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x698bf800, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0x54a04564, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x698bf800, dwHighDateTime=0x1d0ca66)) returned 1 [0074.631] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.631] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x4da4, lpOverlapped=0x0) returned 1 [0074.634] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.634] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x4da4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x4da4, lpOverlapped=0x0) returned 1 [0074.634] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.634] CloseHandle (hObject=0x1cc) returned 1 [0074.635] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLN.DOC" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\prottpln.doc"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLN.DOC.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\prottpln.doc.bd")) returned 1 [0074.636] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f81d900, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x5b8f1386, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6f81d900, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLN.PPT", cAlternateFileName="")) returned 1 [0074.636] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.636] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.636] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.636] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.636] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLN.PPT" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLN.PPT") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLN.PPT" [0074.636] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLN.PPT" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLN.PPT") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLN.PPT" [0074.636] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLN.PPT" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\prottpln.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0074.637] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3000 [0074.637] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6f81d900, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0x5b8f1386, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6f81d900, dwHighDateTime=0x1d0ca66)) returned 1 [0074.637] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.637] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x2fa4, lpOverlapped=0x0) returned 1 [0074.639] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.639] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x2fa4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x2fa4, lpOverlapped=0x0) returned 1 [0074.640] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.640] CloseHandle (hObject=0x1cc) returned 1 [0074.640] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLN.PPT" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\prottpln.ppt"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLN.PPT.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\prottpln.ppt.bd")) returned 1 [0074.641] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x698bf800, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x54a0e185, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x698bf800, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLN.XLS", cAlternateFileName="")) returned 1 [0074.641] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.641] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.641] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.641] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.641] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLN.XLS" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLN.XLS") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLN.XLS" [0074.641] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLN.XLS" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLN.XLS") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLN.XLS" [0074.641] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLN.XLS" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\prottpln.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0074.641] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2200 [0074.641] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x698bf800, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0x54a0e185, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x698bf800, dwHighDateTime=0x1d0ca66)) returned 1 [0074.642] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.642] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x21a4, lpOverlapped=0x0) returned 1 [0074.647] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.647] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x21a4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x21a4, lpOverlapped=0x0) returned 1 [0074.647] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.647] CloseHandle (hObject=0x1cc) returned 1 [0074.647] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLN.XLS" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\prottpln.xls"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLN.XLS.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\prottpln.xls.bd")) returned 1 [0074.661] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x698bf800, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x54a12fd0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x698bf800, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLV.DOC", cAlternateFileName="")) returned 1 [0074.661] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.661] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.661] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.661] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.661] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLV.DOC" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLV.DOC") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLV.DOC" [0074.661] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLV.DOC" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLV.DOC") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLV.DOC" [0074.662] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLV.DOC" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\prottplv.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0074.662] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4e00 [0074.662] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x698bf800, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0x54a12fd0, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x698bf800, dwHighDateTime=0x1d0ca66)) returned 1 [0074.662] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.662] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x4da4, lpOverlapped=0x0) returned 1 [0074.666] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.666] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x4da4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x4da4, lpOverlapped=0x0) returned 1 [0074.666] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.666] CloseHandle (hObject=0x1cc) returned 1 [0074.666] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLV.DOC" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\prottplv.doc"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLV.DOC.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\prottplv.doc.bd")) returned 1 [0074.667] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f81d900, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x5b8f61b7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x6f81d900, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLV.PPT", cAlternateFileName="")) returned 1 [0074.667] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.667] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.667] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.667] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.667] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLV.PPT" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLV.PPT") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLV.PPT" [0074.667] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLV.PPT" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLV.PPT") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLV.PPT" [0074.667] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLV.PPT" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\prottplv.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0074.667] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3000 [0074.667] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6f81d900, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0x5b8f61b7, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6f81d900, dwHighDateTime=0x1d0ca66)) returned 1 [0074.667] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.667] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x2fa4, lpOverlapped=0x0) returned 1 [0074.670] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.670] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x2fa4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x2fa4, lpOverlapped=0x0) returned 1 [0074.670] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.670] CloseHandle (hObject=0x1cc) returned 1 [0074.670] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLV.PPT" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\prottplv.ppt"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLV.PPT.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\prottplv.ppt.bd")) returned 1 [0074.671] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x698bf800, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x54a17dc7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x698bf800, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLV.XLS", cAlternateFileName="")) returned 1 [0074.671] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.671] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.671] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.671] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.671] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLV.XLS" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLV.XLS") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLV.XLS" [0074.671] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLV.XLS" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLV.XLS") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLV.XLS" [0074.671] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLV.XLS" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\prottplv.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0074.671] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2200 [0074.671] GetFileTime (in: hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x698bf800, dwHighDateTime=0x1d0ca66), lpLastAccessTime=0x407536*(dwLowDateTime=0x54a17dc7, dwHighDateTime=0x1d8a64c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x698bf800, dwHighDateTime=0x1d0ca66)) returned 1 [0074.671] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.671] ReadFile (in: hFile=0x1cc, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x21a4, lpOverlapped=0x0) returned 1 [0074.673] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0074.673] WriteFile (in: hFile=0x1cc, lpBuffer=0x1f6c020*, nNumberOfBytesToWrite=0x21a4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesWritten=0x406561*=0x21a4, lpOverlapped=0x0) returned 1 [0074.673] SetFileTime (hFile=0x1cc, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.673] CloseHandle (hObject=0x1cc) returned 1 [0074.673] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLV.XLS" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\prottplv.xls"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PROTTPLV.XLS.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\prottplv.xls.bd")) returned 1 [0074.674] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c9fe200, ftCreationTime.dwHighDateTime=0x1d0ca2f, ftLastAccessTime.dwLowDateTime=0x52212bfd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x5c9fe200, ftLastWriteTime.dwHighDateTime=0x1d0ca2f, nFileSizeHigh=0x0, nFileSizeLow=0x4f777, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHKEY.DAT", cAlternateFileName="")) returned 1 [0074.674] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.674] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.674] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.674] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.674] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c9fe200, ftCreationTime.dwHighDateTime=0x1d0ca2f, ftLastAccessTime.dwLowDateTime=0x5223b12e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x5c9fe200, ftLastWriteTime.dwHighDateTime=0x1d0ca2f, nFileSizeHigh=0x0, nFileSizeLow=0x1f3978, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHLEX.DAT", cAlternateFileName="")) returned 1 [0074.674] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.674] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.674] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.674] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.675] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c9fe200, ftCreationTime.dwHighDateTime=0x1d0ca2f, ftLastAccessTime.dwLowDateTime=0x5224609d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x5c9fe200, ftLastWriteTime.dwHighDateTime=0x1d0ca2f, nFileSizeHigh=0x0, nFileSizeLow=0xcd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHLTS.DAT", cAlternateFileName="")) returned 1 [0074.675] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.675] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.675] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.675] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.675] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c9fe200, ftCreationTime.dwHighDateTime=0x1d0ca2f, ftLastAccessTime.dwLowDateTime=0x5224c257, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x5c9fe200, ftLastWriteTime.dwHighDateTime=0x1d0ca2f, nFileSizeHigh=0x0, nFileSizeLow=0xd18, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHPHN.DAT", cAlternateFileName="")) returned 1 [0074.675] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.675] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.675] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.675] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.675] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c9fe200, ftCreationTime.dwHighDateTime=0x1d0ca2f, ftLastAccessTime.dwLowDateTime=0x522ed47e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x5c9fe200, ftLastWriteTime.dwHighDateTime=0x1d0ca2f, nFileSizeHigh=0x0, nFileSizeLow=0xa03a47, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHSRN.DAT", cAlternateFileName="")) returned 1 [0074.681] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.681] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.681] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.681] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.681] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda99800, ftCreationTime.dwHighDateTime=0x1d0cb68, ftLastAccessTime.dwLowDateTime=0x638bbb5b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xda99800, ftLastWriteTime.dwHighDateTime=0x1d0cb68, nFileSizeHigh=0x0, nFileSizeLow=0x5b04a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.DLL", cAlternateFileName="")) returned 1 [0074.681] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.681] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.681] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.682] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.682] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x197e900, ftCreationTime.dwHighDateTime=0x1d0cb1c, ftLastAccessTime.dwLowDateTime=0x638c4456, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x197e900, ftLastWriteTime.dwHighDateTime=0x1d0cb1c, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBCOLOR.SCM", cAlternateFileName="")) returned 1 [0074.682] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0074.682] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" [0074.682] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\") returned="" [0074.682] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\how to decrypt files.txt")) returned 0x20 [0074.682] FindNextFileA (in: hFindFile=0x6366f0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63635f51, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x63aa9e05, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x63aa9e05, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBFTSCM", cAlternateFileName="")) returned 1 [0074.682] lstrcmpA (lpString1=".", lpString2="PUBFTSCM") returned -1 [0074.682] lstrcmpA (lpString1="..", lpString2="PUBFTSCM") returned -1 [0074.682] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\*.*" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubftscm\\*.*"), lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63635f51, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x63aa9e05, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x63aa9e05, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0xa6, cFileName=".", cAlternateFileName="")) returned 0x636730 [0074.685] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.685] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63635f51, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x63aa9e05, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x63aa9e05, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77792cf0, dwReserved1=0xa6, cFileName="..", cAlternateFileName="")) returned 1 [0074.686] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.686] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.686] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x197e900, ftCreationTime.dwHighDateTime=0x1d0cb1c, ftLastAccessTime.dwLowDateTime=0x63639a24, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x197e900, ftLastWriteTime.dwHighDateTime=0x1d0cb1c, nFileSizeHigh=0x0, nFileSizeLow=0xcb7, dwReserved0=0x77792cf0, dwReserved1=0xa6, cFileName="FONTSCHM.INI", cAlternateFileName="")) returned 1 [0074.686] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.686] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.686] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.686] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubftscm\\how to decrypt files.txt")) returned 0xffffffff [0074.686] CreateFileA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubftscm\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.686] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0074.687] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.687] CloseHandle (hObject=0x1d0) returned 1 [0074.688] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x197e900, ftCreationTime.dwHighDateTime=0x1d0cb1c, ftLastAccessTime.dwLowDateTime=0x638df230, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x197e900, ftLastWriteTime.dwHighDateTime=0x1d0cb1c, nFileSizeHigh=0x0, nFileSizeLow=0x1eea6, dwReserved0=0x0, dwReserved1=0x7000007, cFileName="SCHEME01.CSS", cAlternateFileName="")) returned 1 [0074.688] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.688] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.688] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.688] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0074.688] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x197e900, ftCreationTime.dwHighDateTime=0x1d0cb1c, ftLastAccessTime.dwLowDateTime=0x6394202c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x197e900, ftLastWriteTime.dwHighDateTime=0x1d0cb1c, nFileSizeHigh=0x0, nFileSizeLow=0x1fbbe, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="SCHEME02.CSS", cAlternateFileName="")) returned 1 [0074.688] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.688] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.688] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.688] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0074.688] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x197e900, ftCreationTime.dwHighDateTime=0x1d0cb1c, ftLastAccessTime.dwLowDateTime=0x6394202c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x197e900, ftLastWriteTime.dwHighDateTime=0x1d0cb1c, nFileSizeHigh=0x0, nFileSizeLow=0x1f024, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="SCHEME03.CSS", cAlternateFileName="")) returned 1 [0074.688] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.688] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.688] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.688] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0074.688] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x197e900, ftCreationTime.dwHighDateTime=0x1d0cb1c, ftLastAccessTime.dwLowDateTime=0x6394202c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x197e900, ftLastWriteTime.dwHighDateTime=0x1d0cb1c, nFileSizeHigh=0x0, nFileSizeLow=0x1f4e2, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="SCHEME04.CSS", cAlternateFileName="")) returned 1 [0074.688] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.689] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.689] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.689] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0074.689] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x197e900, ftCreationTime.dwHighDateTime=0x1d0cb1c, ftLastAccessTime.dwLowDateTime=0x6394202c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x197e900, ftLastWriteTime.dwHighDateTime=0x1d0cb1c, nFileSizeHigh=0x0, nFileSizeLow=0x1edba, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="SCHEME05.CSS", cAlternateFileName="")) returned 1 [0074.689] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.689] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.689] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.689] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0074.689] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x197e900, ftCreationTime.dwHighDateTime=0x1d0cb1c, ftLastAccessTime.dwLowDateTime=0x6394202c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x197e900, ftLastWriteTime.dwHighDateTime=0x1d0cb1c, nFileSizeHigh=0x0, nFileSizeLow=0x1f2da, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="SCHEME06.CSS", cAlternateFileName="")) returned 1 [0074.689] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.689] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.689] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.689] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0074.689] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x197e900, ftCreationTime.dwHighDateTime=0x1d0cb1c, ftLastAccessTime.dwLowDateTime=0x6396855a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x197e900, ftLastWriteTime.dwHighDateTime=0x1d0cb1c, nFileSizeHigh=0x0, nFileSizeLow=0x1ff56, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="SCHEME07.CSS", cAlternateFileName="")) returned 1 [0074.689] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.689] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.689] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.689] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0074.690] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x197e900, ftCreationTime.dwHighDateTime=0x1d0cb1c, ftLastAccessTime.dwLowDateTime=0x6396855a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x197e900, ftLastWriteTime.dwHighDateTime=0x1d0cb1c, nFileSizeHigh=0x0, nFileSizeLow=0x1f998, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="SCHEME08.CSS", cAlternateFileName="")) returned 1 [0074.690] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.690] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.690] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.690] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0074.690] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x197e900, ftCreationTime.dwHighDateTime=0x1d0cb1c, ftLastAccessTime.dwLowDateTime=0x6396855a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x197e900, ftLastWriteTime.dwHighDateTime=0x1d0cb1c, nFileSizeHigh=0x0, nFileSizeLow=0x20444, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="SCHEME09.CSS", cAlternateFileName="")) returned 1 [0074.690] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.690] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.690] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.690] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0074.690] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x197e900, ftCreationTime.dwHighDateTime=0x1d0cb1c, ftLastAccessTime.dwLowDateTime=0x6396855a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x197e900, ftLastWriteTime.dwHighDateTime=0x1d0cb1c, nFileSizeHigh=0x0, nFileSizeLow=0x2072a, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="SCHEME10.CSS", cAlternateFileName="")) returned 1 [0074.690] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.690] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.690] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.690] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0074.691] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x197e900, ftCreationTime.dwHighDateTime=0x1d0cb1c, ftLastAccessTime.dwLowDateTime=0x6396855a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x197e900, ftLastWriteTime.dwHighDateTime=0x1d0cb1c, nFileSizeHigh=0x0, nFileSizeLow=0x20030, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="SCHEME11.CSS", cAlternateFileName="")) returned 1 [0074.691] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.691] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.691] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.691] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0074.691] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x197e900, ftCreationTime.dwHighDateTime=0x1d0cb1c, ftLastAccessTime.dwLowDateTime=0x6398e7ae, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x197e900, ftLastWriteTime.dwHighDateTime=0x1d0cb1c, nFileSizeHigh=0x0, nFileSizeLow=0x1e09a, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="SCHEME12.CSS", cAlternateFileName="")) returned 1 [0074.691] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.691] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.691] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.691] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0074.691] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x197e900, ftCreationTime.dwHighDateTime=0x1d0cb1c, ftLastAccessTime.dwLowDateTime=0x6398e7ae, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x197e900, ftLastWriteTime.dwHighDateTime=0x1d0cb1c, nFileSizeHigh=0x0, nFileSizeLow=0x1ec9a, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="SCHEME13.CSS", cAlternateFileName="")) returned 1 [0074.691] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.692] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.692] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.692] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0074.692] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x197e900, ftCreationTime.dwHighDateTime=0x1d0cb1c, ftLastAccessTime.dwLowDateTime=0x6398e7ae, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x197e900, ftLastWriteTime.dwHighDateTime=0x1d0cb1c, nFileSizeHigh=0x0, nFileSizeLow=0x1f5cc, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="SCHEME14.CSS", cAlternateFileName="")) returned 1 [0074.692] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.692] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.692] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.692] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0074.692] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x197e900, ftCreationTime.dwHighDateTime=0x1d0cb1c, ftLastAccessTime.dwLowDateTime=0x6398e7ae, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x197e900, ftLastWriteTime.dwHighDateTime=0x1d0cb1c, nFileSizeHigh=0x0, nFileSizeLow=0x1e094, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="SCHEME15.CSS", cAlternateFileName="")) returned 1 [0074.692] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.692] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.692] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.692] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0074.692] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x197e900, ftCreationTime.dwHighDateTime=0x1d0cb1c, ftLastAccessTime.dwLowDateTime=0x6398e7ae, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x197e900, ftLastWriteTime.dwHighDateTime=0x1d0cb1c, nFileSizeHigh=0x0, nFileSizeLow=0x1f822, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="SCHEME16.CSS", cAlternateFileName="")) returned 1 [0074.692] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.692] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.692] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.692] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0074.693] FindNextFileA (in: hFindFile=0x636730, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x197e900, ftCreationTime.dwHighDateTime=0x1d0cb1c, ftLastAccessTime.dwLowDateTime=0x6398e7ae, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x197e900, ftLastWriteTime.dwHighDateTime=0x1d0cb1c, nFileSizeHigh=0x0, nFileSizeLow=0x1eada, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="SCHEME17.CSS", cAlternateFileName="")) returned 1 [0074.693] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.693] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.693] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.693] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0074.693] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.693] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.693] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.696] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.696] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.696] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.696] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.696] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.696] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.696] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.696] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.696] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.696] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.696] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.697] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.697] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.697] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.697] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.697] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.697] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.697] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.697] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.697] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.697] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.697] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.697] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.697] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.697] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.697] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.697] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.697] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.698] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.698] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.698] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.698] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.698] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.698] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.698] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.698] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.698] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.700] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.700] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" [0074.700] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.700] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.700] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.700] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.701] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.701] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.701] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.701] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.701] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.701] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.701] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.701] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.701] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.701] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.701] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.701] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.701] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.702] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.702] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.702] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.702] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.702] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0074.702] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.702] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBFTSCM\\") returned="" [0074.703] lstrcmpA (lpString1=".", lpString2="PUBSPAPR") returned -1 [0074.703] lstrcmpA (lpString1="..", lpString2="PUBSPAPR") returned -1 [0074.706] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.707] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.707] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.720] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR10F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir10f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR10F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir10f.gif.bd")) returned 1 [0074.723] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR11F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir11f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR11F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir11f.gif.bd")) returned 1 [0074.725] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR12F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir12f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR12F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir12f.gif.bd")) returned 1 [0074.730] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR13F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir13f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR13F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir13f.gif.bd")) returned 1 [0074.733] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR14F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir14f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR14F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir14f.gif.bd")) returned 1 [0074.735] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR15F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir15f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR15F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir15f.gif.bd")) returned 1 [0074.738] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR16F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir16f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR16F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir16f.gif.bd")) returned 1 [0074.748] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR17F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir17f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR17F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir17f.gif.bd")) returned 1 [0074.750] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR18F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir18f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR18F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir18f.gif.bd")) returned 1 [0074.753] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR19F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir19f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR19F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir19f.gif.bd")) returned 1 [0074.755] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR1B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir1b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR1B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir1b.gif.bd")) returned 1 [0074.778] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR1F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir1f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR1F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir1f.gif.bd")) returned 1 [0074.781] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR20F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir20f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR20F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir20f.gif.bd")) returned 1 [0074.783] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR21F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir21f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR21F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir21f.gif.bd")) returned 1 [0074.786] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR22F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir22f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR22F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir22f.gif.bd")) returned 1 [0074.789] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR23F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir23f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR23F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir23f.gif.bd")) returned 1 [0074.792] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR24F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir24f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR24F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir24f.gif.bd")) returned 1 [0074.798] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR25F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir25f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR25F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir25f.gif.bd")) returned 1 [0074.801] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR26F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir26f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR26F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir26f.gif.bd")) returned 1 [0074.806] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR27F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir27f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR27F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir27f.gif.bd")) returned 1 [0074.809] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR28B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir28b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR28B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir28b.gif.bd")) returned 1 [0074.813] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR28F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir28f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR28F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir28f.gif.bd")) returned 1 [0074.816] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR29B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir29b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR29B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir29b.gif.bd")) returned 1 [0074.820] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR29F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir29f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR29F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir29f.gif.bd")) returned 1 [0074.822] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR2B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir2b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR2B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir2b.gif.bd")) returned 1 [0074.828] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR2F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir2f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR2F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir2f.gif.bd")) returned 1 [0074.832] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR30B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir30b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR30B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir30b.gif.bd")) returned 1 [0074.924] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR30F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir30f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR30F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir30f.gif.bd")) returned 1 [0074.928] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR31B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir31b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR31B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir31b.gif.bd")) returned 1 [0074.932] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR31F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir31f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR31F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir31f.gif.bd")) returned 1 [0074.935] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR32B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir32b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR32B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir32b.gif.bd")) returned 1 [0074.942] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR32F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir32f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR32F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir32f.gif.bd")) returned 1 [0074.949] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR33B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir33b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR33B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir33b.gif.bd")) returned 1 [0074.959] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR33F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir33f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR33F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir33f.gif.bd")) returned 1 [0074.962] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR34B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir34b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR34B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir34b.gif.bd")) returned 1 [0074.967] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR34F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir34f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR34F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir34f.gif.bd")) returned 1 [0074.970] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR35B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir35b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR35B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir35b.gif.bd")) returned 1 [0074.973] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR35F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir35f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR35F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir35f.gif.bd")) returned 1 [0074.976] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR36B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir36b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR36B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir36b.gif.bd")) returned 1 [0074.987] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR36F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir36f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR36F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir36f.gif.bd")) returned 1 [0074.992] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR37F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir37f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR37F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir37f.gif.bd")) returned 1 [0074.997] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR38F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir38f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR38F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir38f.gif.bd")) returned 1 [0075.003] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR39F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir39f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR39F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir39f.gif.bd")) returned 1 [0075.006] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR3B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir3b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR3B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir3b.gif.bd")) returned 1 [0075.011] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR3F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir3f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR3F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir3f.gif.bd")) returned 1 [0075.018] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR40F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir40f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR40F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir40f.gif.bd")) returned 1 [0075.029] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR41F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir41f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR41F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir41f.gif.bd")) returned 1 [0075.033] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR42F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir42f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR42F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir42f.gif.bd")) returned 1 [0075.036] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR43B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir43b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR43B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir43b.gif.bd")) returned 1 [0075.038] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR43F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir43f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR43F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir43f.gif.bd")) returned 1 [0075.043] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR44B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir44b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR44B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir44b.gif.bd")) returned 1 [0075.046] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR44F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir44f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR44F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir44f.gif.bd")) returned 1 [0075.049] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR45B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir45b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR45B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir45b.gif.bd")) returned 1 [0075.054] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR45F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir45f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR45F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir45f.gif.bd")) returned 1 [0075.058] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR46B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir46b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR46B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir46b.gif.bd")) returned 1 [0075.060] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR46F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir46f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR46F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir46f.gif.bd")) returned 1 [0075.065] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR47B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir47b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR47B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir47b.gif.bd")) returned 1 [0075.070] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR47F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir47f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR47F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir47f.gif.bd")) returned 1 [0075.073] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR48B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir48b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR48B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir48b.gif.bd")) returned 1 [0075.076] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR48F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir48f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR48F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir48f.gif.bd")) returned 1 [0075.079] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR49B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir49b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR49B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir49b.gif.bd")) returned 1 [0075.105] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR49F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir49f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR49F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir49f.gif.bd")) returned 1 [0075.109] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR4B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir4b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR4B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir4b.gif.bd")) returned 1 [0075.113] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR4F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir4f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR4F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir4f.gif.bd")) returned 1 [0075.115] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR50B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir50b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR50B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir50b.gif.bd")) returned 1 [0075.118] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR50F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir50f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR50F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir50f.gif.bd")) returned 1 [0075.126] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR51B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir51b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR51B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir51b.gif.bd")) returned 1 [0075.129] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR51F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir51f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR51F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir51f.gif.bd")) returned 1 [0075.133] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR5B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir5b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR5B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir5b.gif.bd")) returned 1 [0075.137] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR5F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir5f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR5F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir5f.gif.bd")) returned 1 [0075.141] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR6B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir6b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR6B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir6b.gif.bd")) returned 1 [0075.145] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR6F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir6f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR6F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir6f.gif.bd")) returned 1 [0075.157] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR7B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir7b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR7B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir7b.gif.bd")) returned 1 [0075.161] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR7F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir7f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR7F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir7f.gif.bd")) returned 1 [0075.165] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR8B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir8b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR8B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir8b.gif.bd")) returned 1 [0075.168] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR8F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir8f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR8F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir8f.gif.bd")) returned 1 [0075.175] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR9B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir9b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR9B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir9b.gif.bd")) returned 1 [0075.178] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR9F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir9f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\PDIR9F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\pdir9f.gif.bd")) returned 1 [0075.180] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR00.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir00.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR00.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir00.gif.bd")) returned 1 [0075.185] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR10F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir10f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR10F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir10f.gif.bd")) returned 1 [0075.187] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR11F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir11f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR11F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir11f.gif.bd")) returned 1 [0075.194] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR12F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir12f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR12F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir12f.gif.bd")) returned 1 [0075.197] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR13F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir13f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR13F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir13f.gif.bd")) returned 1 [0075.202] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR14F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir14f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR14F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir14f.gif.bd")) returned 1 [0075.207] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR15F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir15f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR15F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir15f.gif.bd")) returned 1 [0075.211] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR16F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir16f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR16F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir16f.gif.bd")) returned 1 [0075.220] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR17F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir17f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR17F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir17f.gif.bd")) returned 1 [0075.236] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR18F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir18f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR18F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir18f.gif.bd")) returned 1 [0075.239] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR19F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir19f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR19F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir19f.gif.bd")) returned 1 [0075.242] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR1B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir1b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR1B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir1b.gif.bd")) returned 1 [0075.244] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR1F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir1f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR1F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir1f.gif.bd")) returned 1 [0075.247] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR20F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir20f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR20F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir20f.gif.bd")) returned 1 [0075.251] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR21F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir21f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR21F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir21f.gif.bd")) returned 1 [0075.264] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR22F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir22f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR22F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir22f.gif.bd")) returned 1 [0075.267] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR23F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir23f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR23F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir23f.gif.bd")) returned 1 [0075.270] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR24F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir24f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR24F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir24f.gif.bd")) returned 1 [0075.274] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR25F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir25f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR25F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir25f.gif.bd")) returned 1 [0075.283] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR26F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir26f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR26F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir26f.gif.bd")) returned 1 [0075.286] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR27F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir27f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR27F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir27f.gif.bd")) returned 1 [0075.289] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR28F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir28f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR28F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir28f.gif.bd")) returned 1 [0075.291] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR29F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir29f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR29F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir29f.gif.bd")) returned 1 [0075.295] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR2B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir2b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR2B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir2b.gif.bd")) returned 1 [0075.298] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR2F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir2f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR2F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir2f.gif.bd")) returned 1 [0075.304] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR30F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir30f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR30F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir30f.gif.bd")) returned 1 [0075.308] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR31F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir31f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR31F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir31f.gif.bd")) returned 1 [0075.312] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR32F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir32f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR32F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir32f.gif.bd")) returned 1 [0075.315] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR33F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir33f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR33F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir33f.gif.bd")) returned 1 [0075.320] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR34F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir34f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR34F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir34f.gif.bd")) returned 1 [0075.325] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR35F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir35f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR35F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir35f.gif.bd")) returned 1 [0075.328] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR36F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir36f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR36F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir36f.gif.bd")) returned 1 [0075.334] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR37F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir37f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR37F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir37f.gif.bd")) returned 1 [0075.338] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR38F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir38f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR38F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir38f.gif.bd")) returned 1 [0075.351] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR39F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir39f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR39F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir39f.gif.bd")) returned 1 [0075.354] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR3B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir3b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR3B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir3b.gif.bd")) returned 1 [0075.358] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR3F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir3f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR3F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir3f.gif.bd")) returned 1 [0075.363] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR40F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir40f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR40F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir40f.gif.bd")) returned 1 [0075.370] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR41F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir41f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR41F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir41f.gif.bd")) returned 1 [0075.377] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR42F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir42f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR42F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir42f.gif.bd")) returned 1 [0075.381] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR43B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir43b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR43B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir43b.gif.bd")) returned 1 [0075.383] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR43F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir43f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR43F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir43f.gif.bd")) returned 1 [0075.387] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR44B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir44b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR44B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir44b.gif.bd")) returned 1 [0075.390] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR44F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir44f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR44F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir44f.gif.bd")) returned 1 [0075.393] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR45B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir45b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR45B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir45b.gif.bd")) returned 1 [0075.397] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR45F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir45f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR45F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir45f.gif.bd")) returned 1 [0075.402] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR46B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir46b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR46B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir46b.gif.bd")) returned 1 [0075.404] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR46F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir46f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR46F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir46f.gif.bd")) returned 1 [0075.408] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR47B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir47b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR47B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir47b.gif.bd")) returned 1 [0075.413] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR47F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir47f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR47F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir47f.gif.bd")) returned 1 [0075.417] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR48B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir48b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR48B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir48b.gif.bd")) returned 1 [0075.420] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR48F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir48f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR48F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir48f.gif.bd")) returned 1 [0075.424] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR49B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir49b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR49B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir49b.gif.bd")) returned 1 [0075.427] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR49F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir49f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR49F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir49f.gif.bd")) returned 1 [0075.432] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR4B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir4b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR4B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir4b.gif.bd")) returned 1 [0075.437] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR4F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir4f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR4F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir4f.gif.bd")) returned 1 [0075.439] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR50B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir50b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR50B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir50b.gif.bd")) returned 1 [0075.442] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR50F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir50f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR50F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir50f.gif.bd")) returned 1 [0075.445] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR51B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir51b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR51B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir51b.gif.bd")) returned 1 [0075.448] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR51F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir51f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR51F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir51f.gif.bd")) returned 1 [0075.452] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR5B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir5b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR5B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir5b.gif.bd")) returned 1 [0075.459] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR5F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir5f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR5F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir5f.gif.bd")) returned 1 [0075.463] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR6B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir6b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR6B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir6b.gif.bd")) returned 1 [0075.466] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR6F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir6f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR6F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir6f.gif.bd")) returned 1 [0075.478] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR7B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir7b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR7B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir7b.gif.bd")) returned 1 [0075.482] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR7F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir7f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR7F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir7f.gif.bd")) returned 1 [0075.486] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR8B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir8b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR8B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir8b.gif.bd")) returned 1 [0075.490] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR8F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir8f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR8F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir8f.gif.bd")) returned 1 [0075.496] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR9B.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir9b.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR9B.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir9b.gif.bd")) returned 1 [0075.499] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR9F.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir9f.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\1033\\PUBSPAPR\\ZPDIR9F.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\1033\\pubspapr\\zpdir9f.gif.bd")) returned 1 [0075.500] lstrcmpA (lpString1=".", lpString2="QuickStyles") returned -1 [0075.500] lstrcmpA (lpString1="..", lpString2="QuickStyles") returned -1 [0075.502] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.502] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.502] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.520] lstrcmpA (lpString1=".", lpString2="1036") returned -1 [0075.520] lstrcmpA (lpString1="..", lpString2="1036") returned -1 [0075.521] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.521] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.521] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.522] lstrcmpA (lpString1=".", lpString2="3082") returned -1 [0075.522] lstrcmpA (lpString1="..", lpString2="3082") returned -1 [0075.523] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.523] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.523] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.525] lstrcmpA (lpString1=".", lpString2="AccessWeb") returned -1 [0075.525] lstrcmpA (lpString1="..", lpString2="AccessWeb") returned -1 [0075.526] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.526] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.526] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.535] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\AccessWeb\\CLNTWRAP.HTM" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\accessweb\\clntwrap.htm"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\AccessWeb\\CLNTWRAP.HTM.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\accessweb\\clntwrap.htm.bd")) returned 1 [0075.543] lstrcmpA (lpString1=".", lpString2="ACCWIZ") returned -1 [0075.543] lstrcmpA (lpString1="..", lpString2="ACCWIZ") returned -1 [0075.545] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.545] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.545] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.547] lstrcmpA (lpString1=".", lpString2="ADDINS") returned -1 [0075.547] lstrcmpA (lpString1="..", lpString2="ADDINS") returned -1 [0075.549] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.549] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.549] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.559] lstrcmpA (lpString1=".", lpString2="Microsoft Power Query for Excel Integrated") returned -1 [0075.559] lstrcmpA (lpString1="..", lpString2="Microsoft Power Query for Excel Integrated") returned -1 [0075.559] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.560] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.560] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.560] lstrcmpA (lpString1=".", lpString2="bin") returned -1 [0075.560] lstrcmpA (lpString1="..", lpString2="bin") returned -1 [0075.562] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.568] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.568] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.568] lstrcmpA (lpString1=".", lpString2="ar") returned -1 [0075.568] lstrcmpA (lpString1="..", lpString2="ar") returned -1 [0075.571] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.571] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.571] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.573] lstrcmpA (lpString1=".", lpString2="bg") returned -1 [0075.573] lstrcmpA (lpString1="..", lpString2="bg") returned -1 [0075.575] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.575] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.575] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.577] lstrcmpA (lpString1=".", lpString2="ca") returned -1 [0075.577] lstrcmpA (lpString1="..", lpString2="ca") returned -1 [0075.579] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.579] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.579] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.581] lstrcmpA (lpString1=".", lpString2="cs") returned -1 [0075.581] lstrcmpA (lpString1="..", lpString2="cs") returned -1 [0075.586] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.587] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.587] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.589] lstrcmpA (lpString1=".", lpString2="da") returned -1 [0075.589] lstrcmpA (lpString1="..", lpString2="da") returned -1 [0075.591] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.591] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.591] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.593] lstrcmpA (lpString1=".", lpString2="de") returned -1 [0075.593] lstrcmpA (lpString1="..", lpString2="de") returned -1 [0075.595] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.595] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.595] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.599] lstrcmpA (lpString1=".", lpString2="el") returned -1 [0075.599] lstrcmpA (lpString1="..", lpString2="el") returned -1 [0075.608] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.608] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.608] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.610] lstrcmpA (lpString1=".", lpString2="es") returned -1 [0075.610] lstrcmpA (lpString1="..", lpString2="es") returned -1 [0075.613] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.613] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.613] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.615] lstrcmpA (lpString1=".", lpString2="et") returned -1 [0075.615] lstrcmpA (lpString1="..", lpString2="et") returned -1 [0075.618] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.618] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.618] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.619] lstrcmpA (lpString1=".", lpString2="eu") returned -1 [0075.619] lstrcmpA (lpString1="..", lpString2="eu") returned -1 [0075.621] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.621] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.621] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.623] lstrcmpA (lpString1=".", lpString2="fi") returned -1 [0075.623] lstrcmpA (lpString1="..", lpString2="fi") returned -1 [0075.625] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.625] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.625] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.627] lstrcmpA (lpString1=".", lpString2="fr") returned -1 [0075.628] lstrcmpA (lpString1="..", lpString2="fr") returned -1 [0075.631] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.631] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.631] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.633] lstrcmpA (lpString1=".", lpString2="gl") returned -1 [0075.633] lstrcmpA (lpString1="..", lpString2="gl") returned -1 [0075.636] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.636] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.636] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.637] lstrcmpA (lpString1=".", lpString2="he") returned -1 [0075.638] lstrcmpA (lpString1="..", lpString2="he") returned -1 [0075.640] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.640] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.640] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.641] lstrcmpA (lpString1=".", lpString2="hi") returned -1 [0075.641] lstrcmpA (lpString1="..", lpString2="hi") returned -1 [0075.643] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.643] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.643] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.645] lstrcmpA (lpString1=".", lpString2="hr") returned -1 [0075.645] lstrcmpA (lpString1="..", lpString2="hr") returned -1 [0075.647] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.647] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.647] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.649] lstrcmpA (lpString1=".", lpString2="hu") returned -1 [0075.649] lstrcmpA (lpString1="..", lpString2="hu") returned -1 [0075.651] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.651] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.651] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.653] lstrcmpA (lpString1=".", lpString2="id") returned -1 [0075.653] lstrcmpA (lpString1="..", lpString2="id") returned -1 [0075.657] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.657] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.657] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.661] lstrcmpA (lpString1=".", lpString2="it") returned -1 [0075.661] lstrcmpA (lpString1="..", lpString2="it") returned -1 [0075.664] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.664] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.664] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.666] lstrcmpA (lpString1=".", lpString2="ja") returned -1 [0075.666] lstrcmpA (lpString1="..", lpString2="ja") returned -1 [0075.675] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.675] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.675] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.677] lstrcmpA (lpString1=".", lpString2="kk") returned -1 [0075.677] lstrcmpA (lpString1="..", lpString2="kk") returned -1 [0075.681] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.681] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.681] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.683] lstrcmpA (lpString1=".", lpString2="ko") returned -1 [0075.683] lstrcmpA (lpString1="..", lpString2="ko") returned -1 [0075.686] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.686] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.686] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.688] lstrcmpA (lpString1=".", lpString2="lt") returned -1 [0075.688] lstrcmpA (lpString1="..", lpString2="lt") returned -1 [0075.691] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.691] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.691] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.693] lstrcmpA (lpString1=".", lpString2="lv") returned -1 [0075.693] lstrcmpA (lpString1="..", lpString2="lv") returned -1 [0075.695] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.695] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.695] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.701] lstrcmpA (lpString1=".", lpString2="ms") returned -1 [0075.701] lstrcmpA (lpString1="..", lpString2="ms") returned -1 [0075.703] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.703] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.703] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.704] lstrcmpA (lpString1=".", lpString2="nl") returned -1 [0075.704] lstrcmpA (lpString1="..", lpString2="nl") returned -1 [0075.706] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.706] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.706] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.708] lstrcmpA (lpString1=".", lpString2="no") returned -1 [0075.708] lstrcmpA (lpString1="..", lpString2="no") returned -1 [0075.710] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.710] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.710] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.712] lstrcmpA (lpString1=".", lpString2="pl") returned -1 [0075.712] lstrcmpA (lpString1="..", lpString2="pl") returned -1 [0075.714] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.714] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.714] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.716] lstrcmpA (lpString1=".", lpString2="pt-BR") returned -1 [0075.716] lstrcmpA (lpString1="..", lpString2="pt-BR") returned -1 [0075.718] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.718] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.719] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.722] lstrcmpA (lpString1=".", lpString2="pt-pt") returned -1 [0075.722] lstrcmpA (lpString1="..", lpString2="pt-pt") returned -1 [0075.724] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.724] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.724] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.726] lstrcmpA (lpString1=".", lpString2="ro") returned -1 [0075.726] lstrcmpA (lpString1="..", lpString2="ro") returned -1 [0075.728] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.728] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.728] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.730] lstrcmpA (lpString1=".", lpString2="ru") returned -1 [0075.730] lstrcmpA (lpString1="..", lpString2="ru") returned -1 [0075.732] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.732] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.732] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.734] lstrcmpA (lpString1=".", lpString2="sk") returned -1 [0075.734] lstrcmpA (lpString1="..", lpString2="sk") returned -1 [0075.739] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.739] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.739] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.740] lstrcmpA (lpString1=".", lpString2="sl") returned -1 [0075.740] lstrcmpA (lpString1="..", lpString2="sl") returned -1 [0075.743] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.743] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.743] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.744] lstrcmpA (lpString1=".", lpString2="sr-Cyrl") returned -1 [0075.744] lstrcmpA (lpString1="..", lpString2="sr-Cyrl") returned -1 [0075.747] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.747] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.747] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.752] lstrcmpA (lpString1=".", lpString2="sr-Latn") returned -1 [0075.752] lstrcmpA (lpString1="..", lpString2="sr-Latn") returned -1 [0075.757] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.757] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.757] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.759] lstrcmpA (lpString1=".", lpString2="sr-Latn-CS") returned -1 [0075.759] lstrcmpA (lpString1="..", lpString2="sr-Latn-CS") returned -1 [0075.761] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.761] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.761] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.763] lstrcmpA (lpString1=".", lpString2="sv") returned -1 [0075.763] lstrcmpA (lpString1="..", lpString2="sv") returned -1 [0075.766] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.766] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.766] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.771] lstrcmpA (lpString1=".", lpString2="th") returned -1 [0075.771] lstrcmpA (lpString1="..", lpString2="th") returned -1 [0075.775] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.775] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.775] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.777] lstrcmpA (lpString1=".", lpString2="tr") returned -1 [0075.777] lstrcmpA (lpString1="..", lpString2="tr") returned -1 [0075.779] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.779] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.779] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.780] lstrcmpA (lpString1=".", lpString2="uk") returned -1 [0075.780] lstrcmpA (lpString1="..", lpString2="uk") returned -1 [0075.789] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.789] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.789] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.790] lstrcmpA (lpString1=".", lpString2="vi") returned -1 [0075.790] lstrcmpA (lpString1="..", lpString2="vi") returned -1 [0075.794] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.795] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.837] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\ADDINS\\Power View Excel Add-in\\BI-Report.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\addins\\power view excel add-in\\bi-report.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\ADDINS\\Power View Excel Add-in\\BI-Report.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\addins\\power view excel add-in\\bi-report.png.bd")) returned 1 [0077.650] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Configuration\\card_expiration_terms_dict.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\configuration\\card_expiration_terms_dict.txt"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Configuration\\card_expiration_terms_dict.txt.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\configuration\\card_expiration_terms_dict.txt.bd")) returned 1 [0077.654] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Configuration\\card_security_terms_dict.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\configuration\\card_security_terms_dict.txt"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Configuration\\card_security_terms_dict.txt.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\configuration\\card_security_terms_dict.txt.bd")) returned 1 [0077.657] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Configuration\\card_terms_dict.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\configuration\\card_terms_dict.txt"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Configuration\\card_terms_dict.txt.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\configuration\\card_terms_dict.txt.bd")) returned 1 [0077.661] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Configuration\\ssn_high_group_info.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\configuration\\ssn_high_group_info.txt"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Configuration\\ssn_high_group_info.txt.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\configuration\\ssn_high_group_info.txt.bd")) returned 1 [0077.678] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\DCF\\AccessMessageDismissal.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\dcf\\accessmessagedismissal.txt"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\DCF\\AccessMessageDismissal.txt.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\dcf\\accessmessagedismissal.txt.bd")) returned 1 [0077.688] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\DCF\\ExcelMessageDismissal.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\dcf\\excelmessagedismissal.txt"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\DCF\\ExcelMessageDismissal.txt.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\dcf\\excelmessagedismissal.txt.bd")) returned 1 [0077.729] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\certificates\\groove.net\\components\\signedcomponents.cer"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\certificates\\groove.net\\components\\signedcomponents.cer.bd")) returned 1 [0077.739] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer.bd")) returned 1 [0077.745] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Certificates\\groove.net\\Servers\\Management.cer" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\certificates\\groove.net\\servers\\management.cer"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Certificates\\groove.net\\Servers\\Management.cer.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\certificates\\groove.net\\servers\\management.cer.bd")) returned 1 [0077.750] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\certificates\\groove.net\\servers\\relay.cer"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\certificates\\groove.net\\servers\\relay.cer.bd")) returned 1 [0077.758] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\certificates\\verisign\\components\\verisign_class_3_code_signing_2001-4_ca.cer"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\certificates\\verisign\\components\\verisign_class_3_code_signing_2001-4_ca.cer.bd")) returned 1 [0077.761] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\certificates\\verisign\\components\\verisign_class_3_public_primary_ca.cer"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\certificates\\verisign\\components\\verisign_class_3_public_primary_ca.cer.bd")) returned 1 [0077.764] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\certificates\\verisign\\components\\vs_componentsigningintermediate.cer"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\certificates\\verisign\\components\\vs_componentsigningintermediate.cer.bd")) returned 1 [0077.773] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\People\\COUGH.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\people\\cough.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\People\\COUGH.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\people\\cough.wav.bd")) returned 1 [0077.777] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\People\\GIGGLE.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\people\\giggle.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\People\\GIGGLE.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\people\\giggle.wav.bd")) returned 1 [0077.783] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\People\\HICCUP.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\people\\hiccup.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\People\\HICCUP.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\people\\hiccup.wav.bd")) returned 1 [0077.790] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\People\\MMHMM.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\people\\mmhmm.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\People\\MMHMM.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\people\\mmhmm.wav.bd")) returned 1 [0077.800] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\People\\SNEEZE.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\people\\sneeze.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\People\\SNEEZE.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\people\\sneeze.wav.bd")) returned 1 [0077.804] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\People\\THROAT.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\people\\throat.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\People\\THROAT.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\people\\throat.wav.bd")) returned 1 [0077.810] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\People\\Whistling.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\people\\whistling.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\People\\Whistling.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\people\\whistling.wav.bd")) returned 1 [0077.819] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\Places\\ALARM.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\places\\alarm.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\Places\\ALARM.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\places\\alarm.wav.bd")) returned 1 [0077.825] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\Places\\BUZZ.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\places\\buzz.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\Places\\BUZZ.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\places\\buzz.wav.bd")) returned 1 [0077.832] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\Places\\LASER.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\places\\laser.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\Places\\LASER.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\places\\laser.wav.bd")) returned 1 [0077.841] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\Places\\RADAR.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\places\\radar.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\Places\\RADAR.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\places\\radar.wav.bd")) returned 1 [0077.847] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\Places\\TOOT.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\places\\toot.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\Places\\TOOT.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\places\\toot.wav.bd")) returned 1 [0077.852] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\Places\\VIBE.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\places\\vibe.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\Places\\VIBE.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\places\\vibe.wav.bd")) returned 1 [0077.857] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\Places\\WARN.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\places\\warn.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\Places\\WARN.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\places\\warn.wav.bd")) returned 1 [0077.866] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\Things\\CAN.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\things\\can.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\Things\\CAN.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\things\\can.wav.bd")) returned 1 [0077.871] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\Things\\COUPLER.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\things\\coupler.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\Things\\COUPLER.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\things\\coupler.wav.bd")) returned 1 [0077.878] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\Things\\HORN.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\things\\horn.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\Things\\HORN.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\things\\horn.wav.bd")) returned 1 [0077.888] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\Things\\SHOT.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\things\\shot.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\Things\\SHOT.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\things\\shot.wav.bd")) returned 1 [0077.894] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\Things\\SHOVEL.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\things\\shovel.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\Things\\SHOVEL.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\things\\shovel.wav.bd")) returned 1 [0077.899] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\Things\\SPLASH.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\things\\splash.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\Things\\SPLASH.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\things\\splash.wav.bd")) returned 1 [0077.903] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\Things\\WHOOSH.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\things\\whoosh.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\Sounds\\Things\\WHOOSH.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\sounds\\things\\whoosh.wav.bd")) returned 1 [0077.912] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\DataListIconImages.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\datalisticonimages.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\DataListIconImages.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\datalisticonimages.jpg.bd")) returned 1 [0077.915] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\datalisticonimagesmask.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\datalisticonimagesmask.bmp.bd")) returned 1 [0077.918] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\GRIP.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\grip.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\GRIP.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\grip.jpg.bd")) returned 1 [0077.921] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\GRIPMASK.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\gripmask.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\GRIPMASK.BMP.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\gripmask.bmp.bd")) returned 1 [0077.924] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\InformationIcon.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\informationicon.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\InformationIcon.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\informationicon.jpg.bd")) returned 1 [0077.927] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\InformationIconMask.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\informationiconmask.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\InformationIconMask.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\informationiconmask.bmp.bd")) returned 1 [0077.934] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\logindialogbackground.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\logindialogbackground.jpg.bd")) returned 1 [0077.941] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\logintool24x24images.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\logintool24x24images.jpg.bd")) returned 1 [0077.944] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\logintool24x24imagesmask.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\logintool24x24imagesmask.bmp.bd")) returned 1 [0077.947] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\messageattachmenticonimages.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\messageattachmenticonimages.jpg.bd")) returned 1 [0077.950] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp.bd")) returned 1 [0077.953] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\messagehistoryiconimages.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\messagehistoryiconimages.jpg.bd")) returned 1 [0077.957] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp.bd")) returned 1 [0077.961] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\NotifierBackground.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\notifierbackground.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\NotifierBackground.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\notifierbackground.jpg.bd")) returned 1 [0077.965] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\notifierbackgroundrtl.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\notifierbackgroundrtl.jpg.bd")) returned 1 [0077.969] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\notifierclosebutton.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\notifierclosebutton.jpg.bd")) returned 1 [0078.068] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\notifierdisabledownarrow.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\notifierdisabledownarrow.jpg.bd")) returned 1 [0078.100] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\notifierdisableuparrow.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\notifierdisableuparrow.jpg.bd")) returned 1 [0078.107] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\notifierdownarrow.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\notifierdownarrow.jpg.bd")) returned 1 [0078.109] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\notifieruparrow.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\notifieruparrow.jpg.bd")) returned 1 [0078.112] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\notifierwindowmask.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\NotifierWindowMask.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\notifierwindowmask.bmp.bd")) returned 1 [0078.116] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\notifierwindowmaskrtl.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\notifierwindowmaskrtl.bmp.bd")) returned 1 [0078.119] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\outofsynciconimages.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\outofsynciconimages.jpg.bd")) returned 1 [0078.122] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\outofsynciconimagesmask.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\outofsynciconimagesmask.bmp.bd")) returned 1 [0078.125] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\QuestionIcon.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\questionicon.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\QuestionIcon.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\questionicon.jpg.bd")) returned 1 [0078.129] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\QuestionIconMask.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\questioniconmask.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\QuestionIconMask.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\questioniconmask.bmp.bd")) returned 1 [0078.135] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\Shared16x16Images.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\shared16x16images.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\Shared16x16Images.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\shared16x16images.jpg.bd")) returned 1 [0078.138] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\shared16x16imagesmask.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\shared16x16imagesmask.bmp.bd")) returned 1 [0078.141] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\Shared24x24Images.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\shared24x24images.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\Shared24x24Images.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\shared24x24images.jpg.bd")) returned 1 [0078.144] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\shared24x24imagesmask.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\shared24x24imagesmask.bmp.bd")) returned 1 [0078.147] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\STOPICON.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\stopicon.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\STOPICON.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\stopicon.jpg.bd")) returned 1 [0078.149] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\StopIconMask.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\stopiconmask.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\StopIconMask.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\stopiconmask.bmp.bd")) returned 1 [0078.152] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\taskbariconimages256colors.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\taskbariconimages256colors.bmp.bd")) returned 1 [0078.155] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp.bd")) returned 1 [0078.160] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\TipsImage.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\tipsimage.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\TipsImage.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\tipsimage.jpg.bd")) returned 1 [0078.163] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\TipsImageMask.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\tipsimagemask.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\TipsImageMask.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\tipsimagemask.bmp.bd")) returned 1 [0078.166] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\VeriSignLogo.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\verisignlogo.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolBMPs\\VeriSignLogo.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\toolbmps\\verisignlogo.jpg.bd")) returned 1 [0078.178] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg.bd")) returned 1 [0078.181] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp.bd")) returned 1 [0078.191] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg.bd")) returned 1 [0078.198] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp.bd")) returned 1 [0078.201] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg.bd")) returned 1 [0078.205] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp.bd")) returned 1 [0078.234] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg.bd")) returned 1 [0078.237] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp.bd")) returned 1 [0078.245] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg.bd")) returned 1 [0078.248] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp.bd")) returned 1 [0078.252] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg.bd")) returned 1 [0078.255] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp.bd")) returned 1 [0078.259] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg.bd")) returned 1 [0078.262] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp.bd")) returned 1 [0078.265] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg.bd")) returned 1 [0078.267] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp.bd")) returned 1 [0078.282] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg.bd")) returned 1 [0078.286] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp.bd")) returned 1 [0078.291] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp.bd")) returned 1 [0078.297] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg.bd")) returned 1 [0078.300] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg.bd")) returned 1 [0078.302] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp.bd")) returned 1 [0078.306] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp.bd")) returned 1 [0078.309] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg.bd")) returned 1 [0078.312] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg.bd")) returned 1 [0078.314] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp.bd")) returned 1 [0078.318] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg.bd")) returned 1 [0078.321] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg.bd")) returned 1 [0078.324] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp.bd")) returned 1 [0078.342] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\computers\\computericon.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\computers\\computericon.jpg.bd")) returned 1 [0078.347] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp.bd")) returned 1 [0078.383] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogo.contrast-black_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogo.contrast-black_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogo.contrast-black_scale-100.png.bd")) returned 1 [0078.388] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogo.contrast-black_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogo.contrast-black_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogo.contrast-black_scale-140.png.bd")) returned 1 [0078.392] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogo.contrast-black_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogo.contrast-black_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogo.contrast-black_scale-180.png.bd")) returned 1 [0078.395] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogo.contrast-black_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogo.contrast-black_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogo.contrast-black_scale-80.png.bd")) returned 1 [0078.399] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogo.contrast-white_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogo.contrast-white_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogo.contrast-white_scale-100.png.bd")) returned 1 [0078.401] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogo.contrast-white_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogo.contrast-white_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogo.contrast-white_scale-140.png.bd")) returned 1 [0078.405] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogo.contrast-white_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogo.contrast-white_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogo.contrast-white_scale-180.png.bd")) returned 1 [0078.418] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogo.contrast-white_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogo.contrast-white_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogo.contrast-white_scale-80.png.bd")) returned 1 [0078.429] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogo.scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogo.scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogo.scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogo.scale-100.png.bd")) returned 1 [0078.436] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogo.scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogo.scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogo.scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogo.scale-140.png.bd")) returned 1 [0078.445] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogo.scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogo.scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogo.scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogo.scale-180.png.bd")) returned 1 [0078.450] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogo.scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogo.scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogo.scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogo.scale-80.png.bd")) returned 1 [0078.455] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogoSmall.contrast-black_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogosmall.contrast-black_scale-100.png.bd")) returned 1 [0078.459] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogoSmall.contrast-black_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogosmall.contrast-black_scale-140.png.bd")) returned 1 [0078.467] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogoSmall.contrast-black_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogosmall.contrast-black_scale-180.png.bd")) returned 1 [0078.474] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogoSmall.contrast-black_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogosmall.contrast-black_scale-80.png.bd")) returned 1 [0078.478] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogoSmall.contrast-white_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogosmall.contrast-white_scale-100.png.bd")) returned 1 [0078.481] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogoSmall.contrast-white_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogosmall.contrast-white_scale-140.png.bd")) returned 1 [0078.485] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogoSmall.contrast-white_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogosmall.contrast-white_scale-180.png.bd")) returned 1 [0078.490] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogoSmall.contrast-white_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogosmall.contrast-white_scale-80.png.bd")) returned 1 [0078.494] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogoSmall.scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogosmall.scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogoSmall.scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogosmall.scale-100.png.bd")) returned 1 [0078.498] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogoSmall.scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogosmall.scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogoSmall.scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogosmall.scale-140.png.bd")) returned 1 [0078.502] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogoSmall.scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogosmall.scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogoSmall.scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogosmall.scale-180.png.bd")) returned 1 [0078.512] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogoSmall.scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogosmall.scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\ExcelLogoSmall.scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\excellogosmall.scale-80.png.bd")) returned 1 [0078.517] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogo.contrast-black_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogo.contrast-black_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogo.contrast-black_scale-100.png.bd")) returned 1 [0078.521] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogo.contrast-black_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogo.contrast-black_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogo.contrast-black_scale-140.png.bd")) returned 1 [0078.525] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogo.contrast-black_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogo.contrast-black_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogo.contrast-black_scale-180.png.bd")) returned 1 [0078.529] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogo.contrast-black_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogo.contrast-black_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogo.contrast-black_scale-80.png.bd")) returned 1 [0078.533] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogo.contrast-white_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogo.contrast-white_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogo.contrast-white_scale-100.png.bd")) returned 1 [0078.537] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogo.contrast-white_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogo.contrast-white_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogo.contrast-white_scale-140.png.bd")) returned 1 [0078.541] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogo.contrast-white_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogo.contrast-white_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogo.contrast-white_scale-180.png.bd")) returned 1 [0078.544] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogo.contrast-white_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogo.contrast-white_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogo.contrast-white_scale-80.png.bd")) returned 1 [0078.547] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogo.scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogo.scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogo.scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogo.scale-100.png.bd")) returned 1 [0078.564] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogo.scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogo.scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogo.scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogo.scale-140.png.bd")) returned 1 [0078.568] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogo.scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogo.scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogo.scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogo.scale-180.png.bd")) returned 1 [0078.572] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogo.scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogo.scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogo.scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogo.scale-80.png.bd")) returned 1 [0078.576] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-black_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogosmall.contrast-black_scale-100.png.bd")) returned 1 [0078.579] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-black_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogosmall.contrast-black_scale-140.png.bd")) returned 1 [0078.587] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-black_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogosmall.contrast-black_scale-180.png.bd")) returned 1 [0078.595] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-black_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogosmall.contrast-black_scale-80.png.bd")) returned 1 [0078.599] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-white_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogosmall.contrast-white_scale-100.png.bd")) returned 1 [0078.604] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-white_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogosmall.contrast-white_scale-140.png.bd")) returned 1 [0078.607] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-white_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogosmall.contrast-white_scale-180.png.bd")) returned 1 [0078.615] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-white_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogosmall.contrast-white_scale-80.png.bd")) returned 1 [0078.619] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogoSmall.scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogosmall.scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogoSmall.scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogosmall.scale-100.png.bd")) returned 1 [0078.623] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogoSmall.scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogosmall.scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogoSmall.scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogosmall.scale-140.png.bd")) returned 1 [0078.632] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogoSmall.scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogosmall.scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogoSmall.scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogosmall.scale-180.png.bd")) returned 1 [0078.639] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogoSmall.scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogosmall.scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\FirstRunLogoSmall.scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\firstrunlogosmall.scale-80.png.bd")) returned 1 [0078.643] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogo.contrast-black_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogo.contrast-black_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogo.contrast-black_scale-100.png.bd")) returned 1 [0078.647] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogo.contrast-black_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogo.contrast-black_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogo.contrast-black_scale-140.png.bd")) returned 1 [0078.651] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogo.contrast-black_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogo.contrast-black_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogo.contrast-black_scale-180.png.bd")) returned 1 [0078.654] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogo.contrast-black_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogo.contrast-black_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogo.contrast-black_scale-80.png.bd")) returned 1 [0078.658] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogo.contrast-white_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogo.contrast-white_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogo.contrast-white_scale-100.png.bd")) returned 1 [0078.662] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogo.contrast-white_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogo.contrast-white_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogo.contrast-white_scale-140.png.bd")) returned 1 [0078.665] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogo.contrast-white_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogo.contrast-white_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogo.contrast-white_scale-180.png.bd")) returned 1 [0078.669] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogo.contrast-white_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogo.contrast-white_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogo.contrast-white_scale-80.png.bd")) returned 1 [0078.673] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogo.scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogo.scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogo.scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogo.scale-100.png.bd")) returned 1 [0078.676] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogo.scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogo.scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogo.scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogo.scale-140.png.bd")) returned 1 [0078.680] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogo.scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogo.scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogo.scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogo.scale-180.png.bd")) returned 1 [0078.684] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogo.scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogo.scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogo.scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogo.scale-80.png.bd")) returned 1 [0078.688] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogoSmall.contrast-black_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogosmall.contrast-black_scale-100.png.bd")) returned 1 [0078.694] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogoSmall.contrast-black_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogosmall.contrast-black_scale-140.png.bd")) returned 1 [0078.699] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogoSmall.contrast-black_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogosmall.contrast-black_scale-180.png.bd")) returned 1 [0078.702] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogoSmall.contrast-black_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogosmall.contrast-black_scale-80.png.bd")) returned 1 [0078.706] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogoSmall.contrast-white_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogosmall.contrast-white_scale-100.png.bd")) returned 1 [0078.710] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogoSmall.contrast-white_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogosmall.contrast-white_scale-140.png.bd")) returned 1 [0078.714] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogoSmall.contrast-white_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogosmall.contrast-white_scale-180.png.bd")) returned 1 [0078.718] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogoSmall.contrast-white_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogosmall.contrast-white_scale-80.png.bd")) returned 1 [0078.721] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogoSmall.scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogosmall.scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogoSmall.scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogosmall.scale-100.png.bd")) returned 1 [0078.725] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogoSmall.scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogosmall.scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogoSmall.scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogosmall.scale-140.png.bd")) returned 1 [0078.735] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogoSmall.scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogosmall.scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogoSmall.scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogosmall.scale-180.png.bd")) returned 1 [0078.739] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogoSmall.scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogosmall.scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\GrooveLogoSmall.scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\groovelogosmall.scale-80.png.bd")) returned 1 [0078.744] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogo.contrast-black_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogo.contrast-black_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogo.contrast-black_scale-100.png.bd")) returned 1 [0078.749] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogo.contrast-black_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogo.contrast-black_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogo.contrast-black_scale-140.png.bd")) returned 1 [0078.753] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogo.contrast-black_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogo.contrast-black_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogo.contrast-black_scale-180.png.bd")) returned 1 [0078.757] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogo.contrast-black_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogo.contrast-black_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogo.contrast-black_scale-80.png.bd")) returned 1 [0078.763] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogo.contrast-white_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogo.contrast-white_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogo.contrast-white_scale-100.png.bd")) returned 1 [0078.767] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogo.contrast-white_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogo.contrast-white_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogo.contrast-white_scale-140.png.bd")) returned 1 [0078.771] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogo.contrast-white_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogo.contrast-white_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogo.contrast-white_scale-180.png.bd")) returned 1 [0078.774] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogo.contrast-white_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogo.contrast-white_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogo.contrast-white_scale-80.png.bd")) returned 1 [0078.782] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogo.scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogo.scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogo.scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogo.scale-100.png.bd")) returned 1 [0078.786] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogo.scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogo.scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogo.scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogo.scale-140.png.bd")) returned 1 [0078.790] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogo.scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogo.scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogo.scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogo.scale-180.png.bd")) returned 1 [0078.795] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogo.scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogo.scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogo.scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogo.scale-80.png.bd")) returned 1 [0078.799] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-black_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogosmall.contrast-black_scale-100.png.bd")) returned 1 [0078.802] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-black_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogosmall.contrast-black_scale-140.png.bd")) returned 1 [0078.806] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-black_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogosmall.contrast-black_scale-180.png.bd")) returned 1 [0078.810] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-black_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogosmall.contrast-black_scale-80.png.bd")) returned 1 [0078.816] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-white_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogosmall.contrast-white_scale-100.png.bd")) returned 1 [0078.819] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-white_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogosmall.contrast-white_scale-140.png.bd")) returned 1 [0078.823] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-white_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogosmall.contrast-white_scale-180.png.bd")) returned 1 [0078.827] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-white_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogosmall.contrast-white_scale-80.png.bd")) returned 1 [0078.836] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogoSmall.scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogosmall.scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogoSmall.scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogosmall.scale-100.png.bd")) returned 1 [0078.840] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogoSmall.scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogosmall.scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogoSmall.scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogosmall.scale-140.png.bd")) returned 1 [0078.844] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogoSmall.scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogosmall.scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogoSmall.scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogosmall.scale-180.png.bd")) returned 1 [0078.847] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogoSmall.scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogosmall.scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsAccessLogoSmall.scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\msaccesslogosmall.scale-80.png.bd")) returned 1 [0078.851] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogo.contrast-black_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogo.contrast-black_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogo.contrast-black_scale-100.png.bd")) returned 1 [0078.858] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogo.contrast-black_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogo.contrast-black_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogo.contrast-black_scale-140.png.bd")) returned 1 [0078.862] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogo.contrast-black_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogo.contrast-black_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogo.contrast-black_scale-180.png.bd")) returned 1 [0078.865] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogo.contrast-black_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogo.contrast-black_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogo.contrast-black_scale-80.png.bd")) returned 1 [0078.870] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogo.contrast-white_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogo.contrast-white_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogo.contrast-white_scale-100.png.bd")) returned 1 [0078.874] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogo.contrast-white_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogo.contrast-white_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogo.contrast-white_scale-140.png.bd")) returned 1 [0078.877] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogo.contrast-white_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogo.contrast-white_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogo.contrast-white_scale-180.png.bd")) returned 1 [0078.881] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogo.contrast-white_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogo.contrast-white_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogo.contrast-white_scale-80.png.bd")) returned 1 [0078.885] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogo.scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogo.scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogo.scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogo.scale-100.png.bd")) returned 1 [0078.888] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogo.scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogo.scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogo.scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogo.scale-140.png.bd")) returned 1 [0078.892] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogo.scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogo.scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogo.scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogo.scale-180.png.bd")) returned 1 [0078.897] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogo.scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogo.scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogo.scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogo.scale-80.png.bd")) returned 1 [0078.901] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogoSmall.contrast-black_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogosmall.contrast-black_scale-100.png.bd")) returned 1 [0078.905] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogoSmall.contrast-black_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogosmall.contrast-black_scale-140.png.bd")) returned 1 [0078.908] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogoSmall.contrast-black_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogosmall.contrast-black_scale-180.png.bd")) returned 1 [0078.911] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogoSmall.contrast-black_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogosmall.contrast-black_scale-80.png.bd")) returned 1 [0078.914] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogoSmall.contrast-white_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogosmall.contrast-white_scale-100.png.bd")) returned 1 [0078.917] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogoSmall.contrast-white_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogosmall.contrast-white_scale-140.png.bd")) returned 1 [0078.924] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogoSmall.contrast-white_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogosmall.contrast-white_scale-180.png.bd")) returned 1 [0078.926] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogoSmall.contrast-white_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogosmall.contrast-white_scale-80.png.bd")) returned 1 [0078.934] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogoSmall.scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogosmall.scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogoSmall.scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogosmall.scale-100.png.bd")) returned 1 [0078.937] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogoSmall.scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogosmall.scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogoSmall.scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogosmall.scale-140.png.bd")) returned 1 [0078.940] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogoSmall.scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogosmall.scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogoSmall.scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogosmall.scale-180.png.bd")) returned 1 [0078.943] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogoSmall.scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogosmall.scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\MsPubLogoSmall.scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\mspublogosmall.scale-80.png.bd")) returned 1 [0078.946] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogo.contrast-black_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogo.contrast-black_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogo.contrast-black_scale-100.png.bd")) returned 1 [0078.949] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogo.contrast-black_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogo.contrast-black_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogo.contrast-black_scale-140.png.bd")) returned 1 [0078.953] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogo.contrast-black_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogo.contrast-black_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogo.contrast-black_scale-180.png.bd")) returned 1 [0078.955] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogo.contrast-black_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogo.contrast-black_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogo.contrast-black_scale-80.png.bd")) returned 1 [0078.958] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogo.contrast-white_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogo.contrast-white_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogo.contrast-white_scale-100.png.bd")) returned 1 [0078.961] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogo.contrast-white_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogo.contrast-white_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogo.contrast-white_scale-140.png.bd")) returned 1 [0078.964] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogo.contrast-white_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogo.contrast-white_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogo.contrast-white_scale-180.png.bd")) returned 1 [0078.967] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogo.contrast-white_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogo.contrast-white_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogo.contrast-white_scale-80.png.bd")) returned 1 [0078.970] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogo.scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogo.scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogo.scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogo.scale-100.png.bd")) returned 1 [0078.972] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogo.scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogo.scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogo.scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogo.scale-140.png.bd")) returned 1 [0078.975] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogo.scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogo.scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogo.scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogo.scale-180.png.bd")) returned 1 [0078.979] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogo.scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogo.scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogo.scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogo.scale-80.png.bd")) returned 1 [0078.982] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-black_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogosmall.contrast-black_scale-100.png.bd")) returned 1 [0078.984] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-black_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogosmall.contrast-black_scale-140.png.bd")) returned 1 [0078.987] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-black_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogosmall.contrast-black_scale-180.png.bd")) returned 1 [0078.990] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-black_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogosmall.contrast-black_scale-80.png.bd")) returned 1 [0078.992] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-white_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogosmall.contrast-white_scale-100.png.bd")) returned 1 [0078.996] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-white_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogosmall.contrast-white_scale-140.png.bd")) returned 1 [0078.999] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-white_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogosmall.contrast-white_scale-180.png.bd")) returned 1 [0079.002] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-white_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogosmall.contrast-white_scale-80.png.bd")) returned 1 [0079.009] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogoSmall.scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogosmall.scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogoSmall.scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogosmall.scale-100.png.bd")) returned 1 [0079.013] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogoSmall.scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogosmall.scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogoSmall.scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogosmall.scale-140.png.bd")) returned 1 [0079.016] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogoSmall.scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogosmall.scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogoSmall.scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogosmall.scale-180.png.bd")) returned 1 [0079.019] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogoSmall.scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogosmall.scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OneNoteLogoSmall.scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\onenotelogosmall.scale-80.png.bd")) returned 1 [0079.021] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogo.contrast-black_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogo.contrast-black_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogo.contrast-black_scale-100.png.bd")) returned 1 [0079.025] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogo.contrast-black_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogo.contrast-black_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogo.contrast-black_scale-140.png.bd")) returned 1 [0079.029] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogo.contrast-black_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogo.contrast-black_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogo.contrast-black_scale-180.png.bd")) returned 1 [0079.032] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogo.contrast-black_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogo.contrast-black_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogo.contrast-black_scale-80.png.bd")) returned 1 [0079.038] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogo.contrast-white_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogo.contrast-white_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogo.contrast-white_scale-100.png.bd")) returned 1 [0079.041] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogo.contrast-white_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogo.contrast-white_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogo.contrast-white_scale-140.png.bd")) returned 1 [0079.044] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogo.contrast-white_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogo.contrast-white_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogo.contrast-white_scale-180.png.bd")) returned 1 [0079.047] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogo.contrast-white_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogo.contrast-white_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogo.contrast-white_scale-80.png.bd")) returned 1 [0079.050] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogo.scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogo.scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogo.scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogo.scale-100.png.bd")) returned 1 [0079.053] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogo.scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogo.scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogo.scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogo.scale-140.png.bd")) returned 1 [0079.056] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogo.scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogo.scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogo.scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogo.scale-180.png.bd")) returned 1 [0079.059] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogo.scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogo.scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogo.scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogo.scale-80.png.bd")) returned 1 [0079.062] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogoSmall.contrast-black_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogosmall.contrast-black_scale-100.png.bd")) returned 1 [0079.065] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogoSmall.contrast-black_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogosmall.contrast-black_scale-140.png.bd")) returned 1 [0079.068] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogoSmall.contrast-black_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogosmall.contrast-black_scale-180.png.bd")) returned 1 [0079.070] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogoSmall.contrast-black_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogosmall.contrast-black_scale-80.png.bd")) returned 1 [0079.073] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogoSmall.contrast-white_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogosmall.contrast-white_scale-100.png.bd")) returned 1 [0079.076] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogoSmall.contrast-white_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogosmall.contrast-white_scale-140.png.bd")) returned 1 [0079.079] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogoSmall.contrast-white_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogosmall.contrast-white_scale-180.png.bd")) returned 1 [0079.082] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogoSmall.contrast-white_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogosmall.contrast-white_scale-80.png.bd")) returned 1 [0079.089] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogoSmall.scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogosmall.scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogoSmall.scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogosmall.scale-100.png.bd")) returned 1 [0079.094] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogoSmall.scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogosmall.scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogoSmall.scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogosmall.scale-140.png.bd")) returned 1 [0079.099] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogoSmall.scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogosmall.scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogoSmall.scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogosmall.scale-180.png.bd")) returned 1 [0079.102] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogoSmall.scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogosmall.scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\OutlookLogoSmall.scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\outlooklogosmall.scale-80.png.bd")) returned 1 [0079.105] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogo.contrast-black_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogo.contrast-black_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogo.contrast-black_scale-100.png.bd")) returned 1 [0079.109] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogo.contrast-black_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogo.contrast-black_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogo.contrast-black_scale-140.png.bd")) returned 1 [0079.112] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogo.contrast-black_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogo.contrast-black_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogo.contrast-black_scale-180.png.bd")) returned 1 [0079.114] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogo.contrast-black_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogo.contrast-black_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogo.contrast-black_scale-80.png.bd")) returned 1 [0079.117] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogo.contrast-white_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogo.contrast-white_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogo.contrast-white_scale-100.png.bd")) returned 1 [0079.120] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogo.contrast-white_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogo.contrast-white_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogo.contrast-white_scale-140.png.bd")) returned 1 [0079.123] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogo.contrast-white_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogo.contrast-white_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogo.contrast-white_scale-180.png.bd")) returned 1 [0079.126] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogo.contrast-white_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogo.contrast-white_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogo.contrast-white_scale-80.png.bd")) returned 1 [0079.128] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogo.scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogo.scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogo.scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogo.scale-100.png.bd")) returned 1 [0079.131] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogo.scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogo.scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogo.scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogo.scale-140.png.bd")) returned 1 [0079.134] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogo.scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogo.scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogo.scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogo.scale-180.png.bd")) returned 1 [0079.137] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogo.scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogo.scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogo.scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogo.scale-80.png.bd")) returned 1 [0079.140] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-black_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogosmall.contrast-black_scale-100.png.bd")) returned 1 [0079.146] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-black_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogosmall.contrast-black_scale-140.png.bd")) returned 1 [0079.149] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-black_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogosmall.contrast-black_scale-180.png.bd")) returned 1 [0079.152] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-black_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogosmall.contrast-black_scale-80.png.bd")) returned 1 [0079.155] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-white_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogosmall.contrast-white_scale-100.png.bd")) returned 1 [0079.158] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-white_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogosmall.contrast-white_scale-140.png.bd")) returned 1 [0079.161] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-white_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogosmall.contrast-white_scale-180.png.bd")) returned 1 [0079.169] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-white_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogosmall.contrast-white_scale-80.png.bd")) returned 1 [0079.175] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogoSmall.scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogosmall.scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogoSmall.scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogosmall.scale-100.png.bd")) returned 1 [0079.178] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogoSmall.scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogosmall.scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogoSmall.scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogosmall.scale-140.png.bd")) returned 1 [0079.181] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogoSmall.scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogosmall.scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogoSmall.scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogosmall.scale-180.png.bd")) returned 1 [0079.184] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogoSmall.scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogosmall.scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\PowerPntLogoSmall.scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\powerpntlogosmall.scale-80.png.bd")) returned 1 [0079.188] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogo.contrast-black_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogo.contrast-black_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologo.contrast-black_scale-100.png.bd")) returned 1 [0079.191] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogo.contrast-black_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogo.contrast-black_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologo.contrast-black_scale-140.png.bd")) returned 1 [0079.195] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogo.contrast-black_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogo.contrast-black_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologo.contrast-black_scale-180.png.bd")) returned 1 [0079.199] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogo.contrast-black_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogo.contrast-black_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologo.contrast-black_scale-80.png.bd")) returned 1 [0079.202] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogo.contrast-white_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogo.contrast-white_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologo.contrast-white_scale-100.png.bd")) returned 1 [0079.204] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogo.contrast-white_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogo.contrast-white_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologo.contrast-white_scale-140.png.bd")) returned 1 [0079.207] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogo.contrast-white_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogo.contrast-white_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologo.contrast-white_scale-180.png.bd")) returned 1 [0079.210] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogo.contrast-white_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogo.contrast-white_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologo.contrast-white_scale-80.png.bd")) returned 1 [0079.255] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogo.scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologo.scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogo.scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologo.scale-100.png.bd")) returned 1 [0079.261] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogo.scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologo.scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogo.scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologo.scale-140.png.bd")) returned 1 [0079.264] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogo.scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologo.scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogo.scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologo.scale-180.png.bd")) returned 1 [0079.267] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogo.scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologo.scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogo.scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologo.scale-80.png.bd")) returned 1 [0079.270] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogoSmall.contrast-black_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologosmall.contrast-black_scale-100.png.bd")) returned 1 [0079.272] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogoSmall.contrast-black_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologosmall.contrast-black_scale-140.png.bd")) returned 1 [0079.276] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogoSmall.contrast-black_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologosmall.contrast-black_scale-180.png.bd")) returned 1 [0079.279] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogoSmall.contrast-black_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologosmall.contrast-black_scale-80.png.bd")) returned 1 [0079.282] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogoSmall.contrast-white_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologosmall.contrast-white_scale-100.png.bd")) returned 1 [0079.285] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogoSmall.contrast-white_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologosmall.contrast-white_scale-140.png.bd")) returned 1 [0079.288] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogoSmall.contrast-white_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologosmall.contrast-white_scale-180.png.bd")) returned 1 [0079.295] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogoSmall.contrast-white_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologosmall.contrast-white_scale-80.png.bd")) returned 1 [0079.298] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogoSmall.scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologosmall.scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogoSmall.scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologosmall.scale-100.png.bd")) returned 1 [0079.301] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogoSmall.scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologosmall.scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogoSmall.scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologosmall.scale-140.png.bd")) returned 1 [0079.304] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogoSmall.scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologosmall.scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogoSmall.scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologosmall.scale-180.png.bd")) returned 1 [0079.311] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogoSmall.scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologosmall.scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\VisioLogoSmall.scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\visiologosmall.scale-80.png.bd")) returned 1 [0079.314] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogo.contrast-black_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogo.contrast-black_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogo.contrast-black_scale-100.png.bd")) returned 1 [0079.317] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogo.contrast-black_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogo.contrast-black_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogo.contrast-black_scale-140.png.bd")) returned 1 [0079.320] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogo.contrast-black_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogo.contrast-black_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogo.contrast-black_scale-180.png.bd")) returned 1 [0079.324] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogo.contrast-black_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogo.contrast-black_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogo.contrast-black_scale-80.png.bd")) returned 1 [0079.327] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogo.contrast-white_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogo.contrast-white_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogo.contrast-white_scale-100.png.bd")) returned 1 [0079.330] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogo.contrast-white_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogo.contrast-white_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogo.contrast-white_scale-140.png.bd")) returned 1 [0079.333] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogo.contrast-white_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogo.contrast-white_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogo.contrast-white_scale-180.png.bd")) returned 1 [0079.336] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogo.contrast-white_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogo.contrast-white_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogo.contrast-white_scale-80.png.bd")) returned 1 [0079.339] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogo.scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogo.scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogo.scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogo.scale-100.png.bd")) returned 1 [0079.342] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogo.scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogo.scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogo.scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogo.scale-140.png.bd")) returned 1 [0079.344] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogo.scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogo.scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogo.scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogo.scale-180.png.bd")) returned 1 [0079.347] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogo.scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogo.scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogo.scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogo.scale-80.png.bd")) returned 1 [0079.350] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogoSmall.contrast-black_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogosmall.contrast-black_scale-100.png.bd")) returned 1 [0079.353] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogoSmall.contrast-black_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogosmall.contrast-black_scale-140.png.bd")) returned 1 [0079.356] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogoSmall.contrast-black_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogosmall.contrast-black_scale-180.png.bd")) returned 1 [0079.358] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogoSmall.contrast-black_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogosmall.contrast-black_scale-80.png.bd")) returned 1 [0079.361] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-100.png.bd")) returned 1 [0079.364] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-140.png.bd")) returned 1 [0079.366] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-180.png.bd")) returned 1 [0079.373] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-80.png.bd")) returned 1 [0079.376] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogoSmall.scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogosmall.scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogoSmall.scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogosmall.scale-100.png.bd")) returned 1 [0079.379] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogoSmall.scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogosmall.scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogoSmall.scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogosmall.scale-140.png.bd")) returned 1 [0079.382] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogoSmall.scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogosmall.scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogoSmall.scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogosmall.scale-180.png.bd")) returned 1 [0079.384] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogoSmall.scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogosmall.scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinProjLogoSmall.scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winprojlogosmall.scale-80.png.bd")) returned 1 [0079.388] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogo.contrast-black_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogo.contrast-black_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogo.contrast-black_scale-100.png.bd")) returned 1 [0079.390] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogo.contrast-black_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogo.contrast-black_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogo.contrast-black_scale-140.png.bd")) returned 1 [0079.394] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogo.contrast-black_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogo.contrast-black_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogo.contrast-black_scale-180.png.bd")) returned 1 [0079.397] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogo.contrast-black_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogo.contrast-black_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogo.contrast-black_scale-80.png.bd")) returned 1 [0079.399] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogo.contrast-white_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogo.contrast-white_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogo.contrast-white_scale-100.png.bd")) returned 1 [0079.403] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogo.contrast-white_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogo.contrast-white_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogo.contrast-white_scale-140.png.bd")) returned 1 [0079.406] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogo.contrast-white_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogo.contrast-white_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogo.contrast-white_scale-180.png.bd")) returned 1 [0079.409] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogo.contrast-white_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogo.contrast-white_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogo.contrast-white_scale-80.png.bd")) returned 1 [0079.412] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogo.scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogo.scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogo.scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogo.scale-100.png.bd")) returned 1 [0079.418] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogo.scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogo.scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogo.scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogo.scale-140.png.bd")) returned 1 [0079.421] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogo.scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogo.scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogo.scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogo.scale-180.png.bd")) returned 1 [0079.424] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogo.scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogo.scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogo.scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogo.scale-80.png.bd")) returned 1 [0079.427] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogoSmall.contrast-black_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogosmall.contrast-black_scale-100.png.bd")) returned 1 [0079.430] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogoSmall.contrast-black_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogosmall.contrast-black_scale-140.png.bd")) returned 1 [0079.433] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogoSmall.contrast-black_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogosmall.contrast-black_scale-180.png.bd")) returned 1 [0079.436] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogoSmall.contrast-black_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogosmall.contrast-black_scale-80.png.bd")) returned 1 [0079.439] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogoSmall.contrast-white_scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogosmall.contrast-white_scale-100.png.bd")) returned 1 [0079.442] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogoSmall.contrast-white_scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogosmall.contrast-white_scale-140.png.bd")) returned 1 [0079.444] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogoSmall.contrast-white_scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogosmall.contrast-white_scale-180.png.bd")) returned 1 [0079.448] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogoSmall.contrast-white_scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogosmall.contrast-white_scale-80.png.bd")) returned 1 [0079.451] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogoSmall.scale-100.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogosmall.scale-100.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogoSmall.scale-100.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogosmall.scale-100.png.bd")) returned 1 [0079.454] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogoSmall.scale-140.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogosmall.scale-140.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogoSmall.scale-140.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogosmall.scale-140.png.bd")) returned 1 [0079.456] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogoSmall.scale-180.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogosmall.scale-180.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogoSmall.scale-180.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogosmall.scale-180.png.bd")) returned 1 [0079.459] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogoSmall.scale-80.png" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogosmall.scale-80.png"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\LogoImages\\WinWordLogoSmall.scale-80.png.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\logoimages\\winwordlogosmall.scale-80.png.bd")) returned 1 [0079.463] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Lync2013_Third_Party_Notices.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\lync2013_third_party_notices.txt"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Lync2013_Third_Party_Notices.txt.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\lync2013_third_party_notices.txt.bd")) returned 1 [0079.477] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\APPLAUSE.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\applause.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\APPLAUSE.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\applause.wav.bd")) returned 1 [0079.484] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\ARROW.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\arrow.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\ARROW.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\arrow.wav.bd")) returned 1 [0079.496] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\BOMB.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\bomb.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\BOMB.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\bomb.wav.bd")) returned 1 [0079.502] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\BREEZE.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\breeze.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\BREEZE.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\breeze.wav.bd")) returned 1 [0079.506] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\CAMERA.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\camera.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\CAMERA.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\camera.wav.bd")) returned 1 [0079.511] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\CASHREG.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\cashreg.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\CASHREG.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\cashreg.wav.bd")) returned 1 [0079.516] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\CHIMES.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\chimes.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\CHIMES.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\chimes.wav.bd")) returned 1 [0079.518] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\CLICK.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\click.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\CLICK.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\click.wav.bd")) returned 1 [0079.523] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\COIN.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\coin.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\COIN.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\coin.wav.bd")) returned 1 [0079.579] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\DefaultHold.wma" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\defaulthold.wma"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\DefaultHold.wma.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\defaulthold.wma.bd")) returned 1 [0079.586] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\DRUMROLL.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\drumroll.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\DRUMROLL.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\drumroll.wav.bd")) returned 1 [0079.591] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\EXPLODE.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\explode.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\EXPLODE.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\explode.wav.bd")) returned 1 [0079.594] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\HAMMER.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\hammer.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\HAMMER.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\hammer.wav.bd")) returned 1 [0079.598] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LASER.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\laser.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LASER.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\laser.wav.bd")) returned 1 [0079.606] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_abbrdialtone.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_abbrdialtone.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_abbrdialtone.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_abbrdialtone.wav.bd")) returned 1 [0079.620] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_ActivePresenterChange.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_activepresenterchange.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_ActivePresenterChange.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_activepresenterchange.wav.bd")) returned 1 [0079.636] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_appinvite.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_appinvite.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_appinvite.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_appinvite.wav.bd")) returned 1 [0079.641] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_busy.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_busy.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_busy.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_busy.wav.bd")) returned 1 [0079.931] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_callended.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_callended.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_callended.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_callended.wav.bd")) returned 1 [0080.458] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_ChangeModality.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_changemodality.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_ChangeModality.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_changemodality.wav.bd")) returned 1 [0080.510] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_connecting.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_connecting.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_connecting.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_connecting.wav.bd")) returned 1 [0080.543] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_dialtone.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_dialtone.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_dialtone.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_dialtone.wav.bd")) returned 1 [0080.735] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_dtmf0.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_dtmf0.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_dtmf0.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_dtmf0.wav.bd")) returned 1 [0080.780] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_dtmf1.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_dtmf1.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_dtmf1.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_dtmf1.wav.bd")) returned 1 [0080.784] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_dtmf2.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_dtmf2.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_dtmf2.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_dtmf2.wav.bd")) returned 1 [0080.787] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_dtmf3.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_dtmf3.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_dtmf3.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_dtmf3.wav.bd")) returned 1 [0080.790] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_dtmf4.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_dtmf4.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_dtmf4.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_dtmf4.wav.bd")) returned 1 [0080.794] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_dtmf5.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_dtmf5.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_dtmf5.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_dtmf5.wav.bd")) returned 1 [0080.797] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_dtmf6.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_dtmf6.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_dtmf6.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_dtmf6.wav.bd")) returned 1 [0080.801] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_dtmf7.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_dtmf7.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_dtmf7.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_dtmf7.wav.bd")) returned 1 [0080.804] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_dtmf8.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_dtmf8.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_dtmf8.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_dtmf8.wav.bd")) returned 1 [0080.808] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_dtmf9.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_dtmf9.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_dtmf9.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_dtmf9.wav.bd")) returned 1 [0080.811] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_dtmfpound.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_dtmfpound.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_dtmfpound.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_dtmfpound.wav.bd")) returned 1 [0080.814] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_dtmfstar.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_dtmfstar.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_dtmfstar.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_dtmfstar.wav.bd")) returned 1 [0080.821] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_fastbusy.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_fastbusy.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_fastbusy.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_fastbusy.wav.bd")) returned 1 [0080.851] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_fsringing.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_fsringing.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_fsringing.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_fsringing.wav.bd")) returned 1 [0080.857] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_howler.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_howler.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_howler.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_howler.wav.bd")) returned 1 [0080.872] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_iminvite.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_iminvite.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_iminvite.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_iminvite.wav.bd")) returned 1 [0080.899] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_joinedconference.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_joinedconference.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_joinedconference.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_joinedconference.wav.bd")) returned 1 [0080.911] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_muting.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_muting.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_muting.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_muting.wav.bd")) returned 1 [0080.927] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_newim.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_newim.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_newim.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_newim.wav.bd")) returned 1 [0080.967] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_onhold.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_onhold.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_onhold.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_onhold.wav.bd")) returned 1 [0080.982] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_presence.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_presence.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_presence.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_presence.wav.bd")) returned 1 [0081.002] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_redirect.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_redirect.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_redirect.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_redirect.wav.bd")) returned 1 [0081.043] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_ringback.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_ringback.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_ringback.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_ringback.wav.bd")) returned 1 [0081.077] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_ringing.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_ringing.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_ringing.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_ringing.wav.bd")) returned 1 [0081.155] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_ringtone2.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_ringtone2.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_ringtone2.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_ringtone2.wav.bd")) returned 1 [0081.192] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_ringtone3.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_ringtone3.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_ringtone3.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_ringtone3.wav.bd")) returned 1 [0081.283] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_ringtone4.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_ringtone4.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_ringtone4.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_ringtone4.wav.bd")) returned 1 [0081.302] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_ringtone5.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_ringtone5.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_ringtone5.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_ringtone5.wav.bd")) returned 1 [0081.320] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_ringtone6.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_ringtone6.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_ringtone6.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_ringtone6.wav.bd")) returned 1 [0081.394] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_ringtone7.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_ringtone7.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_ringtone7.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_ringtone7.wav.bd")) returned 1 [0081.410] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_secondcall.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_secondcall.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_secondcall.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_secondcall.wav.bd")) returned 1 [0081.424] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_untag.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_untag.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_untag.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_untag.wav.bd")) returned 1 [0081.438] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_videoadded.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_videoadded.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_videoadded.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_videoadded.wav.bd")) returned 1 [0081.668] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_videocall.wav" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_videocall.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\LYNC_videocall.wav.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\lync_videocall.wav.bd")) returned 1 [0081.686] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\PUSH.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\push.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\PUSH.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\push.wav.bd")) returned 1 [0081.691] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\SUCTION.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\suction.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\SUCTION.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\suction.wav.bd")) returned 1 [0081.695] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\TYPE.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\type.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\TYPE.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\type.wav.bd")) returned 1 [0081.700] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\VOLTAGE.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\voltage.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\VOLTAGE.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\voltage.wav.bd")) returned 1 [0081.702] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\WHOOSH.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\whoosh.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\WHOOSH.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\whoosh.wav.bd")) returned 1 [0081.706] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\WIND.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\wind.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MEDIA\\WIND.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\media\\wind.wav.bd")) returned 1 [0081.728] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Microsoft.Lync.Model.zip" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\microsoft.lync.model.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Microsoft.Lync.Model.zip.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\microsoft.lync.model.zip.bd")) returned 1 [0081.736] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Microsoft.Lync.Utilities.Controls.zip" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\microsoft.lync.utilities.controls.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Microsoft.Lync.Utilities.Controls.zip.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\microsoft.lync.utilities.controls.zip.bd")) returned 1 [0081.754] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Microsoft.Lync.Utilities.zip" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\microsoft.lync.utilities.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Microsoft.Lync.Utilities.zip.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\microsoft.lync.utilities.zip.bd")) returned 1 [0081.969] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Ocomprivate.zip" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\ocomprivate.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\Ocomprivate.zip.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\ocomprivate.zip.bd")) returned 1 [0081.986] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\ospp.htm"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\OSPP.HTM.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\ospp.htm.bd")) returned 1 [0082.087] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\REMINDER.WAV" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\reminder.wav"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\REMINDER.WAV.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\reminder.wav.bd")) returned 1 [0082.102] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\SAMPLES\\SOLVSAMP.XLS" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\samples\\solvsamp.xls"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\SAMPLES\\SOLVSAMP.XLS.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\samples\\solvsamp.xls.bd")) returned 1 [0082.158] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\System.Windows.Controls.Theming.Toolkit.zip" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\system.windows.controls.theming.toolkit.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office16\\System.Windows.Controls.Theming.Toolkit.zip.BD" (normalized: "c:\\program files (x86)\\microsoft office\\office16\\system.windows.controls.theming.toolkit.zip.bd")) returned 1 [0082.172] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\currency.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\currency.gif.bd")) returned 1 [0082.176] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\CURRENCY.HTM" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\currency.htm"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\CURRENCY.HTM.BD" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\currency.htm.bd")) returned 1 [0082.177] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\DADSHIRT.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\dadshirt.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\DADSHIRT.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\dadshirt.gif.bd")) returned 1 [0082.180] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\DADSHIRT.HTM" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\dadshirt.htm"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\DADSHIRT.HTM.BD" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\dadshirt.htm.bd")) returned 1 [0082.184] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\JUDGESCH.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\judgesch.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\JUDGESCH.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\judgesch.gif.bd")) returned 1 [0082.186] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\JUDGESCH.HTM" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\judgesch.htm"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\JUDGESCH.HTM.BD" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\judgesch.htm.bd")) returned 1 [0082.189] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\JUNGLE.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\jungle.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\JUNGLE.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\jungle.gif.bd")) returned 1 [0082.192] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\JUNGLE.HTM" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\jungle.htm"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\JUNGLE.HTM.BD" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\jungle.htm.bd")) returned 1 [0082.195] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.HTM" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\notebook.htm"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.HTM.BD" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\notebook.htm.bd")) returned 1 [0082.199] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\notebook.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\notebook.jpg.bd")) returned 1 [0082.203] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\OFFISUPP.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\offisupp.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\OFFISUPP.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\offisupp.gif.bd")) returned 1 [0082.206] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\OFFISUPP.HTM" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\offisupp.htm"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\OFFISUPP.HTM.BD" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\offisupp.htm.bd")) returned 1 [0082.210] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\PAWPRINT.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\pawprint.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\PAWPRINT.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\pawprint.gif.bd")) returned 1 [0082.213] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\PAWPRINT.HTM" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\pawprint.htm"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\PAWPRINT.HTM.BD" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\pawprint.htm.bd")) returned 1 [0082.243] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\PINELUMB.HTM" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\pinelumb.htm"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\PINELUMB.HTM.BD" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\pinelumb.htm.bd")) returned 1 [0082.255] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\pinelumb.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\pinelumb.jpg.bd")) returned 1 [0082.259] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\SEAMARBL.HTM" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\seamarbl.htm"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\SEAMARBL.HTM.BD" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\seamarbl.htm.bd")) returned 1 [0082.290] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\seamarbl.jpg"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG.BD" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\seamarbl.jpg.bd")) returned 1 [0082.335] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\techtool.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF.BD" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\techtool.gif.bd")) returned 1 [0082.338] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\techtool.htm"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM.BD" (normalized: "c:\\program files (x86)\\microsoft office\\stationery\\1033\\techtool.htm.bd")) returned 1 [0082.497] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif" (normalized: "c:\\program files (x86)\\microsoft office\\templates\\presentation designs\\maple.gif"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif.BD" (normalized: "c:\\program files (x86)\\microsoft office\\templates\\presentation designs\\maple.gif.bd")) returned 1 [0083.397] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp.BD" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp.bd")) returned 1 [0083.403] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png.BD" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.png.bd")) returned 1 [0083.405] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-192.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png.BD" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-192.png.bd")) returned 1 [0083.408] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-32.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png.BD" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-32.png.bd")) returned 1 [0083.410] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-40.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png.BD" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-40.png.bd")) returned 1 [0083.412] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-48.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png.BD" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-48.png.bd")) returned 1 [0083.448] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp.BD" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp.bd")) returned 1 [0083.452] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png.BD" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.png.bd")) returned 1 [0083.960] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html.BD" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html.bd")) returned 1 [0083.982] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\access 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\access 2016.lnk.bd")) returned 1 [0083.989] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessibility\\speech recognition.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessibility\\speech recognition.lnk.bd")) returned 1 [0083.996] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk.bd")) returned 1 [0084.000] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk.bd")) returned 1 [0084.004] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk.bd")) returned 1 [0084.008] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk.bd")) returned 1 [0084.012] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\steps recorder.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\steps recorder.lnk.bd")) returned 1 [0084.016] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk.bd")) returned 1 [0084.024] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk.bd")) returned 1 [0084.037] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk.bd")) returned 1 [0084.045] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows fax and scan.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows fax and scan.lnk.bd")) returned 1 [0084.049] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows media player.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows media player.lnk.bd")) returned 1 [0084.053] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk.bd")) returned 1 [0084.057] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\xps viewer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\xps viewer.lnk.bd")) returned 1 [0084.062] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk.bd")) returned 1 [0084.066] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk.bd")) returned 1 [0084.071] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\dfrgui.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\dfrgui.lnk.bd")) returned 1 [0084.076] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\disk cleanup.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\disk cleanup.lnk.bd")) returned 1 [0084.080] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk.bd")) returned 1 [0084.083] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk.bd")) returned 1 [0084.087] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk.bd")) returned 1 [0084.097] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (32-bit).lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (32-bit).lnk.bd")) returned 1 [0084.102] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (64-bit).lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (64-bit).lnk.bd")) returned 1 [0084.106] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk.bd")) returned 1 [0084.110] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk.bd")) returned 1 [0084.114] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\resource monitor.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\resource monitor.lnk.bd")) returned 1 [0084.117] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk.bd")) returned 1 [0084.121] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk.bd")) returned 1 [0084.125] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk.bd")) returned 1 [0084.128] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system information.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system information.lnk.bd")) returned 1 [0084.131] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk.bd")) returned 1 [0084.134] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk.bd")) returned 1 [0084.140] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk.bd")) returned 1 [0084.149] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk.bd")) returned 1 [0084.155] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk.bd")) returned 1 [0084.159] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk.bd")) returned 1 [0084.168] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk.bd")) returned 1 [0084.172] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk.bd")) returned 1 [0084.177] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk.bd")) returned 1 [0084.180] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk.bd")) returned 1 [0084.187] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk.bd")) returned 1 [0084.190] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk.bd")) returned 1 [0084.194] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk.bd")) returned 1 [0084.198] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk.bd")) returned 1 [0084.202] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk.bd")) returned 1 [0084.205] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk.bd")) returned 1 [0084.211] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk.bd")) returned 1 [0084.214] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk.bd")) returned 1 [0084.240] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk.bd")) returned 1 [0084.259] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Programs.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\default programs.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Programs.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\default programs.lnk.bd")) returned 1 [0084.265] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\task manager.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\task manager.lnk.bd")) returned 1 [0084.268] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\windows defender.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\windows defender.lnk.bd")) returned 1 [0084.272] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\word 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\word 2016.lnk.bd")) returned 1 [0084.278] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\01 - File Explorer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\01 - file explorer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\01 - File Explorer.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\01 - file explorer.lnk.bd")) returned 1 [0084.280] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\03 - Documents.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\03 - documents.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\03 - Documents.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\03 - documents.lnk.bd")) returned 1 [0084.284] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\04 - Downloads.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\04 - downloads.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\04 - Downloads.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\04 - downloads.lnk.bd")) returned 1 [0084.286] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\05 - Music.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\05 - music.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\05 - Music.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\05 - music.lnk.bd")) returned 1 [0084.288] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\06 - Pictures.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\06 - pictures.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\06 - Pictures.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\06 - pictures.lnk.bd")) returned 1 [0084.290] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\07 - Videos.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\07 - videos.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\07 - Videos.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\07 - videos.lnk.bd")) returned 1 [0084.292] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\08 - Homegroup.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\08 - homegroup.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\08 - Homegroup.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\08 - homegroup.lnk.bd")) returned 1 [0084.294] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\09 - Network.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\09 - network.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\09 - Network.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\09 - network.lnk.bd")) returned 1 [0084.296] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\10 - UserProfile.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\10 - userprofile.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\10 - UserProfile.lnk.BD" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\10 - userprofile.lnk.bd")) returned 1 [0084.313] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt.BD" (normalized: "c:\\programdata\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt.bd")) returned 1 [0084.415] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Live\\WLive48x48.png" (normalized: "c:\\programdata\\microsoft\\windows live\\wlive48x48.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Live\\WLive48x48.png.BD" (normalized: "c:\\programdata\\microsoft\\windows live\\wlive48x48.png.bd")) returned 1 [0086.627] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk.BD" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk.bd")) returned 1 [0086.633] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk.BD" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk.bd")) returned 1 [0086.638] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk.BD" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk.bd")) returned 1 [0086.641] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk.BD" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk.bd")) returned 1 [0086.673] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk.BD" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk.bd")) returned 1 [0086.677] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk.BD" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk.bd")) returned 1 [0086.684] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk.BD" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk.bd")) returned 1 [0086.687] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk.BD" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk.bd")) returned 1 [0086.696] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk.BD" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk.bd")) returned 1 [0086.703] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk.BD" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk.bd")) returned 1 [0086.707] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk.BD" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk.bd")) returned 1 [0086.710] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk.BD" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk.bd")) returned 1 [0086.729] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - Network Connections.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - network connections.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - Network Connections.lnk.BD" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - network connections.lnk.bd")) returned 1 [0086.743] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk.BD" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk.bd")) returned 1 [0086.751] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - System.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - system.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - System.lnk.BD" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - system.lnk.bd")) returned 1 [0086.763] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk.BD" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk.bd")) returned 1 [0086.767] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - Power Options.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - power options.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - Power Options.lnk.BD" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - power options.lnk.bd")) returned 1 [0086.770] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk.BD" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk.bd")) returned 1 [0086.773] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - Programs and Features.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - programs and features.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - Programs and Features.lnk.BD" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - programs and features.lnk.bd")) returned 1 [0086.784] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.BD" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.bd")) returned 1 [0086.795] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.BD" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.bd")) returned 1 [0086.810] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.BD" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.bd")) returned 1 [0086.976] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk.BD" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk.bd")) returned 1 [0086.980] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk.BD" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk.bd")) returned 1 [0087.026] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk.BD" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk.bd")) returned 1 [0087.033] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.BD" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.bd")) returned 1 [0087.042] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk.BD" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk.bd")) returned 1 [0087.045] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk.BD" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk.bd")) returned 1 [0087.048] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk.BD" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk.bd")) returned 1 [0087.051] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Apps.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\default apps.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Apps.lnk.BD" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\default apps.lnk.bd")) returned 1 [0087.055] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Devices.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\devices.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Devices.lnk.BD" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\devices.lnk.bd")) returned 1 [0087.058] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk.BD" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk.bd")) returned 1 [0087.061] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk.BD" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk.bd")) returned 1 [0087.092] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk.BD" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk.bd")) returned 1 [0087.096] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.BD" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk.bd")) returned 1 [0087.100] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk.BD" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk.bd")) returned 1 [0087.103] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk.BD" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk.bd")) returned 1 [0087.202] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.bd")) returned 1 [0088.261] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayLogo.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplaylogo.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayLogo.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplaylogo.png.bd")) returned 1 [0088.280] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.gif"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.gif.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.gif.bd")) returned 1 [0088.284] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.png.bd")) returned 1 [0088.382] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayLogo.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplaylogo.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayLogo.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplaylogo.png.bd")) returned 1 [0088.450] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.gif"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.gif.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.gif.bd")) returned 1 [0088.454] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.png.bd")) returned 1 [0088.563] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\AutoPlayLogo.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\autoplaylogo.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\AutoPlayLogo.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\autoplaylogo.png.bd")) returned 1 [0088.592] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\AutoPlayOptIn.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\autoplayoptin.gif"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\AutoPlayOptIn.gif.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\autoplayoptin.gif.bd")) returned 1 [0088.600] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\AutoPlayOptIn.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\autoplayoptin.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\AutoPlayOptIn.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\autoplayoptin.png.bd")) returned 1 [0089.116] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\ScreenshotLogo.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\screenshotlogo.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\ScreenshotLogo.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\screenshotlogo.png.bd")) returned 1 [0089.141] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\ScreenshotOptIn.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\screenshotoptin.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\ScreenshotOptIn.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\screenshotoptin.png.bd")) returned 1 [0089.178] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_3\\AutoPlayLogo.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_3\\autoplaylogo.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_3\\AutoPlayLogo.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_3\\autoplaylogo.png.bd")) returned 1 [0089.204] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_3\\AutoPlayOptIn.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_3\\autoplayoptin.gif"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_3\\AutoPlayOptIn.gif.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_3\\autoplayoptin.gif.bd")) returned 1 [0089.211] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_3\\AutoPlayOptIn.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_3\\autoplayoptin.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_3\\AutoPlayOptIn.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_3\\autoplayoptin.png.bd")) returned 1 [0089.670] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_3\\ScreenshotLogo.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_3\\screenshotlogo.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_3\\ScreenshotLogo.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_3\\screenshotlogo.png.bd")) returned 1 [0089.709] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_3\\ScreenshotOptIn.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_3\\screenshotoptin.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_3\\ScreenshotOptIn.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_3\\screenshotoptin.png.bd")) returned 1 [0089.778] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{360B3910-A8D3-4307-8D6E-6FF79565CF29}.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\actioncentercache\\{360b3910-a8d3-4307-8d6e-6ff79565cf29}.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{360B3910-A8D3-4307-8D6E-6FF79565CF29}.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\actioncentercache\\{360b3910-a8d3-4307-8d6e-6ff79565cf29}.png.bd")) returned 1 [0089.781] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{3791FFDB-0F9B-43E7-B1BC-F83BE99BE18C}.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\actioncentercache\\{3791ffdb-0f9b-43e7-b1bc-f83be99be18c}.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{3791FFDB-0F9B-43E7-B1BC-F83BE99BE18C}.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\actioncentercache\\{3791ffdb-0f9b-43e7-b1bc-f83be99be18c}.png.bd")) returned 1 [0089.783] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{4AEF8B2E-D493-4A47-81D4-881EC5A8E3AF}.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\actioncentercache\\{4aef8b2e-d493-4a47-81d4-881ec5a8e3af}.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{4AEF8B2E-D493-4A47-81D4-881EC5A8E3AF}.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\actioncentercache\\{4aef8b2e-d493-4a47-81d4-881ec5a8e3af}.png.bd")) returned 1 [0089.787] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{521F7180-642B-440A-838D-C4F3A7B3C2C0}.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\actioncentercache\\{521f7180-642b-440a-838d-c4f3a7b3c2c0}.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{521F7180-642B-440A-838D-C4F3A7B3C2C0}.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\actioncentercache\\{521f7180-642b-440a-838d-c4f3a7b3c2c0}.png.bd")) returned 1 [0089.790] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{58F0434E-3EF5-468F-AD7B-6D3DABD11658}.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\actioncentercache\\{58f0434e-3ef5-468f-ad7b-6d3dabd11658}.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{58F0434E-3EF5-468F-AD7B-6D3DABD11658}.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\actioncentercache\\{58f0434e-3ef5-468f-ad7b-6d3dabd11658}.png.bd")) returned 1 [0089.793] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{6847B1C1-F55E-44F1-B047-A5D99CF50202}.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\actioncentercache\\{6847b1c1-f55e-44f1-b047-a5d99cf50202}.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{6847B1C1-F55E-44F1-B047-A5D99CF50202}.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\actioncentercache\\{6847b1c1-f55e-44f1-b047-a5d99cf50202}.png.bd")) returned 1 [0089.796] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{7687CA7B-C212-4CA8-B96F-9F0A8EA68CDC}.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\actioncentercache\\{7687ca7b-c212-4ca8-b96f-9f0a8ea68cdc}.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{7687CA7B-C212-4CA8-B96F-9F0A8EA68CDC}.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\actioncentercache\\{7687ca7b-c212-4ca8-b96f-9f0a8ea68cdc}.png.bd")) returned 1 [0089.798] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{81F3A784-E8DB-4BDD-875C-92E763AED602}.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\actioncentercache\\{81f3a784-e8db-4bdd-875c-92e763aed602}.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{81F3A784-E8DB-4BDD-875C-92E763AED602}.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\actioncentercache\\{81f3a784-e8db-4bdd-875c-92e763aed602}.png.bd")) returned 1 [0089.801] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{8393D971-367B-44C2-B843-3C0BD7C487DF}.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\actioncentercache\\{8393d971-367b-44c2-b843-3c0bd7c487df}.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{8393D971-367B-44C2-B843-3C0BD7C487DF}.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\actioncentercache\\{8393d971-367b-44c2-b843-3c0bd7c487df}.png.bd")) returned 1 [0089.803] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{8D8B8AE5-2647-4ACA-B14D-B59359B4EC08}.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\actioncentercache\\{8d8b8ae5-2647-4aca-b14d-b59359b4ec08}.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{8D8B8AE5-2647-4ACA-B14D-B59359B4EC08}.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\actioncentercache\\{8d8b8ae5-2647-4aca-b14d-b59359b4ec08}.png.bd")) returned 1 [0089.853] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{99CFFC93-F44B-4C78-9233-714D3D891D11}.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\actioncentercache\\{99cffc93-f44b-4c78-9233-714d3d891d11}.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{99CFFC93-F44B-4C78-9233-714D3D891D11}.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\actioncentercache\\{99cffc93-f44b-4c78-9233-714d3d891d11}.png.bd")) returned 1 [0089.914] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{B835D466-3F3C-4FF0-90E5-D395AAB1594D}.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\actioncentercache\\{b835d466-3f3c-4ff0-90e5-d395aab1594d}.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{B835D466-3F3C-4FF0-90E5-D395AAB1594D}.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\actioncentercache\\{b835d466-3f3c-4ff0-90e5-d395aab1594d}.png.bd")) returned 1 [0089.918] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{F147815D-A2FE-4D31-8C0C-760C1D1D0961}.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\actioncentercache\\{f147815d-a2fe-4d31-8c0c-760c1d1d0961}.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{F147815D-A2FE-4D31-8C0C-760C1D1D0961}.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\actioncentercache\\{f147815d-a2fe-4d31-8c0c-760c1d1d0961}.png.bd")) returned 1 [0089.921] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{F762917D-EDD6-4879-96EE-BD0A93A4E06E}.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\actioncentercache\\{f762917d-edd6-4879-96ee-bd0a93a4e06e}.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{F762917D-EDD6-4879-96EE-BD0A93A4E06E}.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\actioncentercache\\{f762917d-edd6-4879-96ee-bd0a93a4e06e}.png.bd")) returned 1 [0089.995] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\179e8db5.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\179e8db5.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\179e8db5.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\179e8db5.jpg.bd")) returned 1 [0090.001] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1ba49cb8.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\1ba49cb8.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1ba49cb8.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\1ba49cb8.jpg.bd")) returned 1 [0090.004] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1ced2593.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\1ced2593.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1ced2593.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\1ced2593.jpg.bd")) returned 1 [0090.007] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1f83d5ef.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\1f83d5ef.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1f83d5ef.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\1f83d5ef.jpg.bd")) returned 1 [0090.011] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\27771a56.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\27771a56.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\27771a56.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\27771a56.jpg.bd")) returned 1 [0090.014] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\4048cb51.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\4048cb51.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\4048cb51.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\4048cb51.jpg.bd")) returned 1 [0090.016] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\48415de7.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\48415de7.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\48415de7.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\48415de7.jpg.bd")) returned 1 [0090.020] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\6bf71745.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\6bf71745.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\6bf71745.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\6bf71745.jpg.bd")) returned 1 [0090.024] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\6f79e4a.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\6f79e4a.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\6f79e4a.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\6f79e4a.jpg.bd")) returned 1 [0090.028] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7a67116a.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7a67116a.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7a67116a.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7a67116a.jpg.bd")) returned 1 [0090.032] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\8b8a3111.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\8b8a3111.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\8b8a3111.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\8b8a3111.jpg.bd")) returned 1 [0090.037] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a5aa8076.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a5aa8076.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a5aa8076.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a5aa8076.jpg.bd")) returned 1 [0090.086] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\ad152324.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\ad152324.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\ad152324.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\ad152324.jpg.bd")) returned 1 [0090.092] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\ad9a3041.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\ad9a3041.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\ad9a3041.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\ad9a3041.jpg.bd")) returned 1 [0090.096] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\b87b2414.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\b87b2414.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\b87b2414.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\b87b2414.jpg.bd")) returned 1 [0090.099] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\c6a29e3f.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\c6a29e3f.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\c6a29e3f.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\c6a29e3f.jpg.bd")) returned 1 [0090.102] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\d242e6bf.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\d242e6bf.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\d242e6bf.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\d242e6bf.jpg.bd")) returned 1 [0090.106] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\eaaf57da.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\eaaf57da.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\eaaf57da.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\eaaf57da.jpg.bd")) returned 1 [0090.171] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk.bd")) returned 1 [0090.178] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk.bd")) returned 1 [0090.189] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk.bd")) returned 1 [0090.193] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk.bd")) returned 1 [0090.200] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk.bd")) returned 1 [0090.204] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk.bd")) returned 1 [0090.250] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk.bd")) returned 1 [0090.255] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk.bd")) returned 1 [0090.258] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk.bd")) returned 1 [0090.261] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk.bd")) returned 1 [0090.264] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk.bd")) returned 1 [0090.267] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk.bd")) returned 1 [0090.270] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - Network Connections.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - network connections.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - Network Connections.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - network connections.lnk.bd")) returned 1 [0090.273] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk.bd")) returned 1 [0090.275] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - System.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - system.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - System.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - system.lnk.bd")) returned 1 [0090.281] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk.bd")) returned 1 [0090.285] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - Power Options.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - power options.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - Power Options.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - power options.lnk.bd")) returned 1 [0090.288] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk.bd")) returned 1 [0090.297] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - Programs and Features.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - programs and features.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - Programs and Features.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - programs and features.lnk.bd")) returned 1 [0090.656] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\1\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\1\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_2[1].txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\1\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\1\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_2[1].txt.bd")) returned 1 [0090.663] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\2\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_COOBE_COOBE[1].html" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\2\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_coobe_coobe[1].html"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\2\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_COOBE_COOBE[1].html.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\2\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_coobe_coobe[1].html.bd")) returned 1 [0090.667] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\2\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_COOBE_CortanaIcon[1].png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\2\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_coobe_cortanaicon[1].png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\2\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_COOBE_CortanaIcon[1].png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\2\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_coobe_cortanaicon[1].png.bd")) returned 1 [0090.671] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_10[1].txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_10[1].txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_10[1].txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_10[1].txt.bd")) returned 1 [0090.676] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_11[1].txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_11[1].txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_11[1].txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_11[1].txt.bd")) returned 1 [0090.681] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_12[1].txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_12[1].txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_12[1].txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_12[1].txt.bd")) returned 1 [0090.755] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_13[1].txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_13[1].txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_13[1].txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_13[1].txt.bd")) returned 1 [0090.766] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_14[1].txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_14[1].txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_14[1].txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_14[1].txt.bd")) returned 1 [0090.777] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_15[1].txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_15[1].txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_15[1].txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_15[1].txt.bd")) returned 1 [0090.783] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_16[1].txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_16[1].txt.bd")) returned 1 [0090.805] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_17[1].txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_17[1].txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_17[1].txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_17[1].txt.bd")) returned 1 [0090.808] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_18[1].txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_18[1].txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_18[1].txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_18[1].txt.bd")) returned 1 [0090.811] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_19[1].txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_19[1].txt.bd")) returned 1 [0090.812] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_20[1].txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_20[1].txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_20[1].txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_20[1].txt.bd")) returned 1 [0090.814] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_21[1].txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_21[1].txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_21[1].txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_21[1].txt.bd")) returned 1 [0090.816] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_22[1].txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_22[1].txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_22[1].txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_22[1].txt.bd")) returned 1 [0090.818] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_23[1].txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_23[1].txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_23[1].txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_23[1].txt.bd")) returned 1 [0090.820] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_24[1].txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_24[1].txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_24[1].txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_24[1].txt.bd")) returned 1 [0090.823] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_25[1].txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_25[1].txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_25[1].txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_25[1].txt.bd")) returned 1 [0090.825] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_26[1].txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_26[1].txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_26[1].txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_26[1].txt.bd")) returned 1 [0090.827] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_27[1].txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_27[1].txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_27[1].txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_27[1].txt.bd")) returned 1 [0090.833] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_28[1].txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_28[1].txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_28[1].txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_28[1].txt.bd")) returned 1 [0090.868] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_2[1].txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_2[1].txt.bd")) returned 0 [0090.880] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_3[1].txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_3[1].txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_3[1].txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_3[1].txt.bd")) returned 1 [0090.884] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_4[1].txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_4[1].txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_4[1].txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_4[1].txt.bd")) returned 1 [0090.887] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_5[1].txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_5[1].txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_5[1].txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_5[1].txt.bd")) returned 1 [0090.890] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_6[1].txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_6[1].txt.bd")) returned 1 [0090.892] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_7[1].txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_7[1].txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_7[1].txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_7[1].txt.bd")) returned 1 [0090.913] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_8[1].txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_8[1].txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_8[1].txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_8[1].txt.bd")) returned 1 [0090.922] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_9[1].txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_9[1].txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_9[1].txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_9[1].txt.bd")) returned 1 [0090.946] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\8\\zinc[1].htm" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\8\\zinc[1].htm"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\8\\zinc[1].htm.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\8\\zinc[1].htm.bd")) returned 1 [0090.960] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\MF12VF9D.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\mf12vf9d.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\MF12VF9D.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\mf12vf9d.txt.bd")) returned 1 [0090.962] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\OB349RDS.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\ob349rds.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\OB349RDS.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\ob349rds.txt.bd")) returned 1 [0091.039] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133039039768590531.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133039039768590531.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133039039768590531.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133039039768590531.txt.bd")) returned 1 [0091.096] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133039045711359287.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133039045711359287.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133039045711359287.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133039045711359287.txt.bd")) returned 1 [0091.104] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040059623021567.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040059623021567.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040059623021567.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040059623021567.txt.bd")) returned 1 [0091.138] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040059811944077.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040059811944077.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040059811944077.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040059811944077.txt.bd")) returned 1 [0091.147] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040061123266563.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040061123266563.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040061123266563.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040061123266563.txt.bd")) returned 1 [0091.155] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040061185555619.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040061185555619.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040061185555619.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040061185555619.txt.bd")) returned 1 [0091.162] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040061240405128.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040061240405128.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040061240405128.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040061240405128.txt.bd")) returned 1 [0091.169] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040061328914220.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040061328914220.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040061328914220.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040061328914220.txt.bd")) returned 1 [0091.208] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040061379430897.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040061379430897.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040061379430897.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040061379430897.txt.bd")) returned 1 [0091.216] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040061436795643.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040061436795643.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040061436795643.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040061436795643.txt.bd")) returned 1 [0091.223] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040061618385022.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040061618385022.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040061618385022.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040061618385022.txt.bd")) returned 1 [0091.234] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040061644202390.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040061644202390.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040061644202390.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040061644202390.txt.bd")) returned 1 [0091.241] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040061686012466.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040061686012466.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040061686012466.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040061686012466.txt.bd")) returned 1 [0091.250] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040061719366060.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040061719366060.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040061719366060.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040061719366060.txt.bd")) returned 1 [0091.284] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040061752733174.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040061752733174.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040061752733174.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040061752733174.txt.bd")) returned 1 [0091.298] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040061824877292.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040061824877292.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040061824877292.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040061824877292.txt.bd")) returned 1 [0091.305] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040062413099320.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040062413099320.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040062413099320.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040062413099320.txt.bd")) returned 1 [0091.312] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040062725169468.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040062725169468.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040062725169468.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040062725169468.txt.bd")) returned 1 [0091.380] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040063027496025.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040063027496025.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040063027496025.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040063027496025.txt.bd")) returned 1 [0091.387] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040063121055077.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040063121055077.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040063121055077.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040063121055077.txt.bd")) returned 1 [0091.394] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040063302069291.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040063302069291.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040063302069291.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040063302069291.txt.bd")) returned 1 [0091.401] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040063443722670.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040063443722670.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040063443722670.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040063443722670.txt.bd")) returned 1 [0091.407] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040063497777084.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040063497777084.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040063497777084.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040063497777084.txt.bd")) returned 1 [0091.414] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040063880239562.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040063880239562.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040063880239562.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040063880239562.txt.bd")) returned 1 [0091.450] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040064058720540.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040064058720540.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040064058720540.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040064058720540.txt.bd")) returned 1 [0091.458] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040064101395546.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040064101395546.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040064101395546.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040064101395546.txt.bd")) returned 1 [0091.469] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040064185280887.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040064185280887.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040064185280887.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040064185280887.txt.bd")) returned 1 [0091.478] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040064267125564.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040064267125564.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040064267125564.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040064267125564.txt.bd")) returned 1 [0091.487] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040064436119377.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040064436119377.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040064436119377.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040064436119377.txt.bd")) returned 1 [0091.513] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040064447647259.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040064447647259.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040064447647259.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040064447647259.txt.bd")) returned 1 [0091.521] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040064457995652.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040064457995652.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133040064457995652.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133040064457995652.txt.bd")) returned 1 [0091.528] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133068423092418241.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133068423092418241.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133068423092418241.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133068423092418241.txt.bd")) returned 1 [0091.547] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133068423586542957.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133068423586542957.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133068423586542957.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133068423586542957.txt.bd")) returned 1 [0091.559] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133068423639653858.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133068423639653858.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133068423639653858.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133068423639653858.txt.bd")) returned 1 [0091.565] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133068424639574833.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133068424639574833.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache133068424639574833.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache133068424639574833.txt.bd")) returned 1 [0091.592] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\SettingsCache.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\settingscache.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\SettingsCache.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\settingscache.txt.bd")) returned 1 [0091.964] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\-S5JCkVvCAdvOxMVW5Kx.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\-s5jckvvcadvoxmvw5kx.gif"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\-S5JCkVvCAdvOxMVW5Kx.gif.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\-s5jckvvcadvoxmvw5kx.gif.bd")) returned 1 [0091.967] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\0vjG1BJcnQf.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\0vjg1bjcnqf.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\0vjG1BJcnQf.mp3.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\0vjg1bjcnqf.mp3.bd")) returned 1 [0091.972] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\3p2kgL_EHL.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\3p2kgl_ehl.wav"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\3p2kgL_EHL.wav.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\3p2kgl_ehl.wav.bd")) returned 1 [0091.974] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\6lVPK.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\6lvpk.pdf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\6lVPK.pdf.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\6lvpk.pdf.bd")) returned 1 [0091.976] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\7eRC9u2CXHsElDkya.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\7erc9u2cxhseldkya.gif"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\7eRC9u2CXHsElDkya.gif.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\7erc9u2cxhseldkya.gif.bd")) returned 1 [0091.984] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\8pDXhW5UdsNcN3shG.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\8pdxhw5udsncn3shg.gif"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\8pDXhW5UdsNcN3shG.gif.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\8pdxhw5udsncn3shg.gif.bd")) returned 1 [0091.988] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\aqmwdvhLmfGi1.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\aqmwdvhlmfgi1.flv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\aqmwdvhLmfGi1.flv.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\aqmwdvhlmfgi1.flv.bd")) returned 1 [0091.994] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\dd_ndp462-kb3151800-x86-x64-allos-enu_decompression_log.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\dd_ndp462-kb3151800-x86-x64-allos-enu_decompression_log.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\dd_ndp462-kb3151800-x86-x64-allos-enu_decompression_log.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\dd_ndp462-kb3151800-x86-x64-allos-enu_decompression_log.txt.bd")) returned 1 [0091.997] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\dd_SetupUtility.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\dd_setuputility.txt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\dd_SetupUtility.txt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\dd_setuputility.txt.bd")) returned 1 [0092.001] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\dudpbN0lJKI1k_g7.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\dudpbn0ljki1k_g7.mp4"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\dudpbN0lJKI1k_g7.mp4.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\dudpbn0ljki1k_g7.mp4.bd")) returned 1 [0092.006] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\e7Pp4y2_-hr.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\e7pp4y2_-hr.mp4"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\e7Pp4y2_-hr.mp4.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\e7pp4y2_-hr.mp4.bd")) returned 1 [0092.012] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\eG--OcjfGpf8N9GyCwN.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\eg--ocjfgpf8n9gycwn.wav"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\eG--OcjfGpf8N9GyCwN.wav.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\eg--ocjfgpf8n9gycwn.wav.bd")) returned 1 [0092.018] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\gAiw5F5f_OZaf-oL.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\gaiw5f5f_ozaf-ol.mp4"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\gAiw5F5f_OZaf-oL.mp4.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\gaiw5f5f_ozaf-ol.mp4.bd")) returned 1 [0092.022] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\GGhwfgce8sXXWIw.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\gghwfgce8sxxwiw.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\GGhwfgce8sXXWIw.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\gghwfgce8sxxwiw.png.bd")) returned 1 [0092.030] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\HQ_G5gr7EyGO.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\hq_g5gr7eygo.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\HQ_G5gr7EyGO.mp3.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\hq_g5gr7eygo.mp3.bd")) returned 1 [0092.034] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\IFxtHucw8S.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\ifxthucw8s.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\IFxtHucw8S.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\ifxthucw8s.jpg.bd")) returned 1 [0092.038] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\jawshtml.html" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\jawshtml.html"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\jawshtml.html.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\jawshtml.html.bd")) returned 1 [0092.042] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\kXXCiNK.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\kxxcink.flv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\kXXCiNK.flv.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\kxxcink.flv.bd")) returned 1 [0092.045] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\l3prZ.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\l3prz.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\l3prZ.mp3.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\l3prz.mp3.bd")) returned 1 [0092.050] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\m1h-idct7.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\m1h-idct7.mkv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\m1h-idct7.mkv.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\m1h-idct7.mkv.bd")) returned 1 [0092.100] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\Microsoft .NET Framework 4.6.2 Setup_20220803_150943770.html" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\microsoft .net framework 4.6.2 setup_20220803_150943770.html"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\Microsoft .NET Framework 4.6.2 Setup_20220803_150943770.html.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\microsoft .net framework 4.6.2 setup_20220803_150943770.html.bd")) returned 1 [0092.109] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\mRpT.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\mrpt.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\mRpT.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\mrpt.jpg.bd")) returned 1 [0092.160] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\Qyhxye4tp7ZwfU.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\qyhxye4tp7zwfu.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\Qyhxye4tp7ZwfU.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\qyhxye4tp7zwfu.png.bd")) returned 1 [0092.167] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tZvV-PKIfLFL.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\tzvv-pkiflfl.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tZvV-PKIfLFL.mp3.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\tzvv-pkiflfl.mp3.bd")) returned 1 [0092.174] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\VVb77p7fW08pCl4cMk.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\vvb77p7fw08pcl4cmk.xls"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\VVb77p7fW08pCl4cMk.xls.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\vvb77p7fw08pcl4cmk.xls.bd")) returned 1 [0092.183] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\W8SZ.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\w8sz.wav"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\W8SZ.wav.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\w8sz.wav.bd")) returned 1 [0092.187] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\xzXinrzLOk8plqf.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\xzxinrzlok8plqf.mkv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\xzXinrzLOk8plqf.mkv.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\xzxinrzlok8plqf.mkv.bd")) returned 1 [0092.190] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\YhBKDAV.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\yhbkdav.mp4"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\YhBKDAV.mp4.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\yhbkdav.mp4.bd")) returned 1 [0092.436] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\-ddjy0.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\-ddjy0.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\-ddjy0.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\-ddjy0.png.bd")) returned 1 [0092.440] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\0HQVWj4.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\0hqvwj4.mp4"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\0HQVWj4.mp4.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\0hqvwj4.mp4.bd")) returned 1 [0092.642] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\1CCm7K5m1jsRzw.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\1ccm7k5m1jsrzw.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\1CCm7K5m1jsRzw.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\1ccm7k5m1jsrzw.png.bd")) returned 1 [0092.650] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\333J.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\333j.flv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\333J.flv.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\333j.flv.bd")) returned 1 [0092.654] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\37-FwQ8G.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\37-fwq8g.mp4"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\37-FwQ8G.mp4.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\37-fwq8g.mp4.bd")) returned 1 [0092.660] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8DxCagDQ.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\8dxcagdq.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8DxCagDQ.mp3.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\8dxcagdq.mp3.bd")) returned 1 [0092.663] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\9loa.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\9loa.mkv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\9loa.mkv.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\9loa.mkv.bd")) returned 1 [0092.667] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\9vL5.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\9vl5.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\9vL5.mp3.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\9vl5.mp3.bd")) returned 1 [0092.700] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bTiaSMuQd.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\btiasmuqd.flv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bTiaSMuQd.flv.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\btiasmuqd.flv.bd")) returned 1 [0092.704] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\CZHlJ Sv.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\czhlj sv.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\CZHlJ Sv.pptx.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\czhlj sv.pptx.bd")) returned 1 [0092.706] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\DN90PeQDw6Y.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\dn90peqdw6y.gif"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\DN90PeQDw6Y.gif.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\dn90peqdw6y.gif.bd")) returned 1 [0092.709] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\dP_e-EgH3vXaIR.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\dp_e-egh3vxair.gif"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\dP_e-EgH3vXaIR.gif.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\dp_e-egh3vxair.gif.bd")) returned 1 [0092.713] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\dX8BFRNozAP6p3Eb7Q6.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\dx8bfrnozap6p3eb7q6.mp4"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\dX8BFRNozAP6p3Eb7Q6.mp4.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\dx8bfrnozap6p3eb7q6.mp4.bd")) returned 1 [0092.716] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\e5l55G.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\e5l55g.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\e5l55G.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\e5l55g.png.bd")) returned 1 [0092.722] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\mAuf.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mauf.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\mAuf.mp3.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mauf.mp3.bd")) returned 1 [0092.756] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\microsoft outlook.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\microsoft outlook.lnk.bd")) returned 1 [0092.760] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.bd")) returned 1 [0092.782] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\file explorer.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\file explorer.lnk.bd")) returned 1 [0092.786] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.bd")) returned 1 [0092.818] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk.bd")) returned 1 [0092.906] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\managed\\word document building blocks\\1033\\tm02835233[[fn=text sidebar (annual report red and black design)]].docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\managed\\word document building blocks\\1033\\tm02835233[[fn=text sidebar (annual report red and black design)]].docx.bd")) returned 1 [0092.934] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-ddjy0.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\-ddjy0.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-ddjy0.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\-ddjy0.lnk.bd")) returned 1 [0092.937] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0Il_92U.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\0il_92u.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0Il_92U.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\0il_92u.lnk.bd")) returned 1 [0092.939] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0lWUeF5.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\0lwuef5.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0lWUeF5.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\0lwuef5.lnk.bd")) returned 1 [0092.942] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1CCm7K5m1jsRzw.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\1ccm7k5m1jsrzw.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1CCm7K5m1jsRzw.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\1ccm7k5m1jsrzw.lnk.bd")) returned 1 [0092.944] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2DKtHiOaXaZ2X7.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\2dkthioaxaz2x7.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2DKtHiOaXaZ2X7.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\2dkthioaxaz2x7.lnk.bd")) returned 1 [0092.949] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\333J.flv.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\333j.flv.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\333J.flv.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\333j.flv.lnk.bd")) returned 1 [0092.952] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4yXDcqjMJV.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\4yxdcqjmjv.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4yXDcqjMJV.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\4yxdcqjmjv.lnk.bd")) returned 1 [0092.955] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5AKr8.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\5akr8.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5AKr8.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\5akr8.lnk.bd")) returned 1 [0092.957] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5vunWIqEPg3VKzqQc.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\5vunwiqepg3vkzqqc.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5vunWIqEPg3VKzqQc.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\5vunwiqepg3vkzqqc.lnk.bd")) returned 1 [0092.959] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7lDp4MNiUOFeiDoLj0sy.flv.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\7ldp4mniuofeidolj0sy.flv.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7lDp4MNiUOFeiDoLj0sy.flv.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\7ldp4mniuofeidolj0sy.flv.lnk.bd")) returned 1 [0092.974] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7qLqQIn.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\7qlqqin.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7qLqQIn.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\7qlqqin.lnk.bd")) returned 1 [0092.978] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7sWoUdl2wk.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\7swoudl2wk.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7sWoUdl2wk.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\7swoudl2wk.lnk.bd")) returned 1 [0092.980] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8FKeQdlN0Z.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\8fkeqdln0z.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8FKeQdlN0Z.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\8fkeqdln0z.lnk.bd")) returned 1 [0092.983] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8JnODARgNn6VETb.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\8jnodargnn6vetb.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8JnODARgNn6VETb.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\8jnodargnn6vetb.lnk.bd")) returned 1 [0092.985] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8vSz.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\8vsz.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8vSz.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\8vsz.lnk.bd")) returned 1 [0092.988] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\94ZoY.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\94zoy.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\94ZoY.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\94zoy.lnk.bd")) returned 1 [0092.990] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9KDVfnKUJs.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\9kdvfnkujs.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9KDVfnKUJs.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\9kdvfnkujs.lnk.bd")) returned 1 [0092.996] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A1xn000L.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\a1xn000l.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A1xn000L.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\a1xn000l.lnk.bd")) returned 1 [0093.001] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a2gysYWDmP-DwmBet.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\a2gysywdmp-dwmbet.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a2gysYWDmP-DwmBet.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\a2gysywdmp-dwmbet.lnk.bd")) returned 1 [0093.003] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AErIKk.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\aerikk.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AErIKk.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\aerikk.lnk.bd")) returned 1 [0093.006] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AKcfBGKLc6tJJX.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\akcfbgklc6tjjx.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AKcfBGKLc6tJJX.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\akcfbgklc6tjjx.lnk.bd")) returned 1 [0093.011] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ASgsmg-.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\asgsmg-.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ASgsmg-.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\asgsmg-.lnk.bd")) returned 1 [0093.017] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aX8Dcph44d31plLiqNd.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\ax8dcph44d31plliqnd.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aX8Dcph44d31plLiqNd.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\ax8dcph44d31plliqnd.lnk.bd")) returned 1 [0093.020] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ayKsz0Om.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\ayksz0om.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ayKsz0Om.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\ayksz0om.lnk.bd")) returned 1 [0093.042] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bTiaSMuQd.flv.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\btiasmuqd.flv.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bTiaSMuQd.flv.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\btiasmuqd.flv.lnk.bd")) returned 1 [0093.050] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BWfq.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\bwfq.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BWfq.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\bwfq.lnk.bd")) returned 1 [0093.052] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BY565QJ.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\by565qj.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BY565QJ.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\by565qj.lnk.bd")) returned 1 [0093.057] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Common Files.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\common files.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Common Files.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\common files.lnk.bd")) returned 1 [0093.059] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRoelfslKaz4WMk6u (2).lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\croelfslkaz4wmk6u (2).lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRoelfslKaz4WMk6u (2).lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\croelfslkaz4wmk6u (2).lnk.bd")) returned 1 [0093.061] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRoelfslKaz4WMk6u.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\croelfslkaz4wmk6u.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRoelfslKaz4WMk6u.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\croelfslkaz4wmk6u.lnk.bd")) returned 1 [0093.072] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CZHlJ Sv.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\czhlj sv.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CZHlJ Sv.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\czhlj sv.lnk.bd")) returned 1 [0093.075] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cZkNUo8hT-eh.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\czknuo8ht-eh.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cZkNUo8hT-eh.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\czknuo8ht-eh.lnk.bd")) returned 1 [0093.077] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D-hjBWTnbHsPxYw.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\d-hjbwtnbhspxyw.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D-hjBWTnbHsPxYw.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\d-hjbwtnbhspxyw.lnk.bd")) returned 1 [0093.080] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dLqIdDwfNDo ZVV.ots.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\dlqiddwfndo zvv.ots.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dLqIdDwfNDo ZVV.ots.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\dlqiddwfndo zvv.ots.lnk.bd")) returned 1 [0093.082] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DN90PeQDw6Y.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\dn90peqdw6y.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DN90PeQDw6Y.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\dn90peqdw6y.lnk.bd")) returned 1 [0093.084] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dP_e-EgH3vXaIR.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\dp_e-egh3vxair.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dP_e-EgH3vXaIR.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\dp_e-egh3vxair.lnk.bd")) returned 1 [0093.289] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\e5l55G.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\e5l55g.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\e5l55G.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\e5l55g.lnk.bd")) returned 1 [0093.293] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EIB3O.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\eib3o.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EIB3O.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\eib3o.lnk.bd")) returned 1 [0093.295] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eJeR4HKhrS6L.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\ejer4hkhrs6l.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eJeR4HKhrS6L.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\ejer4hkhrs6l.lnk.bd")) returned 1 [0093.297] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EobG4cAVyaqL7iH.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\eobg4cavyaql7ih.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EobG4cAVyaqL7iH.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\eobg4cavyaql7ih.lnk.bd")) returned 1 [0093.298] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fianMD.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\fianmd.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fianMD.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\fianmd.lnk.bd")) returned 1 [0093.300] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fk63-85UutdH45mYQza2.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\fk63-85uutdh45myqza2.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fk63-85UutdH45mYQza2.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\fk63-85uutdh45myqza2.lnk.bd")) returned 1 [0093.302] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Flcga5.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\flcga5.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Flcga5.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\flcga5.lnk.bd")) returned 1 [0093.305] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOj347aEOghh.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\fwoj347aeoghh.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOj347aEOghh.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\fwoj347aeoghh.lnk.bd")) returned 1 [0093.306] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fyGRheq3stTs.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\fygrheq3stts.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fyGRheq3stTs.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\fygrheq3stts.lnk.bd")) returned 1 [0093.308] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Fz7bWc 6NYywz1Z.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\fz7bwc 6nyywz1z.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Fz7bWc 6NYywz1Z.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\fz7bwc 6nyywz1z.lnk.bd")) returned 1 [0093.310] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gbDdey_y2Pm.flv.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\gbddey_y2pm.flv.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gbDdey_y2Pm.flv.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\gbddey_y2pm.flv.lnk.bd")) returned 1 [0093.312] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h -7 (2).lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\h -7 (2).lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h -7 (2).lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\h -7 (2).lnk.bd")) returned 1 [0093.314] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h -7.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\h -7.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h -7.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\h -7.lnk.bd")) returned 1 [0093.316] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HcfpuOn14f.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\hcfpuon14f.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HcfpuOn14f.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\hcfpuon14f.lnk.bd")) returned 1 [0093.317] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hDoHjm.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\hdohjm.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hDoHjm.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\hdohjm.lnk.bd")) returned 1 [0093.320] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hDxpwNMTr.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\hdxpwnmtr.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hDxpwNMTr.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\hdxpwnmtr.lnk.bd")) returned 1 [0093.346] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hr6u-hD3fNhCB5puTw.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\hr6u-hd3fnhcb5putw.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hr6u-hD3fNhCB5puTw.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\hr6u-hd3fnhcb5putw.lnk.bd")) returned 1 [0093.348] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H_MuWcKi.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\h_muwcki.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H_MuWcKi.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\h_muwcki.lnk.bd")) returned 1 [0093.349] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ib4YIpMAtE-GH.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\ib4yipmate-gh.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ib4YIpMAtE-GH.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\ib4yipmate-gh.lnk.bd")) returned 1 [0093.393] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IMwDLseNr-mY05xK9 v.flv.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\imwdlsenr-my05xk9 v.flv.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IMwDLseNr-mY05xK9 v.flv.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\imwdlsenr-my05xk9 v.flv.lnk.bd")) returned 1 [0093.395] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ISSdTeg.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\issdteg.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ISSdTeg.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\issdteg.lnk.bd")) returned 1 [0093.397] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\j4tKUce.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\j4tkuce.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\j4tKUce.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\j4tkuce.lnk.bd")) returned 1 [0093.400] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jd-FGX.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\jd-fgx.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jd-FGX.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\jd-fgx.lnk.bd")) returned 1 [0093.402] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jd85.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\jd85.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jd85.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\jd85.lnk.bd")) returned 1 [0093.404] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kgciaf.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\kgciaf.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kgciaf.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\kgciaf.lnk.bd")) returned 1 [0093.406] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\krH5ZhSwpubEjuL9F.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\krh5zhswpubejul9f.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\krH5ZhSwpubEjuL9F.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\krh5zhswpubejul9f.lnk.bd")) returned 1 [0093.408] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kX9Z.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\kx9z.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kX9Z.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\kx9z.lnk.bd")) returned 1 [0093.410] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lcVa.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\lcva.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lcVa.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\lcva.lnk.bd")) returned 1 [0093.412] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjK-5z.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\ljk-5z.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjK-5z.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\ljk-5z.lnk.bd")) returned 1 [0093.416] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LM4POnb.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\lm4ponb.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LM4POnb.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\lm4ponb.lnk.bd")) returned 1 [0093.421] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lOfGxOeLjVoh3fDJ6xyy.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\lofgxoeljvoh3fdj6xyy.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lOfGxOeLjVoh3fDJ6xyy.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\lofgxoeljvoh3fdj6xyy.lnk.bd")) returned 1 [0093.427] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lpIEJJeiUZB.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\lpiejjeiuzb.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lpIEJJeiUZB.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\lpiejjeiuzb.lnk.bd")) returned 1 [0093.429] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L_Hx.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\l_hx.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L_Hx.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\l_hx.lnk.bd")) returned 1 [0093.431] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m-nCi0J9JUekKLT5qeHD.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\m-nci0j9juekklt5qehd.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m-nCi0J9JUekKLT5qeHD.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\m-nci0j9juekklt5qehd.lnk.bd")) returned 1 [0093.433] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mDEq6wjBZ-rkL9UaUP.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\mdeq6wjbz-rkl9uaup.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mDEq6wjBZ-rkL9UaUP.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\mdeq6wjbz-rkl9uaup.lnk.bd")) returned 1 [0093.435] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MtH6jXoGMcn5LFWCvj.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\mth6jxogmcn5lfwcvj.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MtH6jXoGMcn5LFWCvj.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\mth6jxogmcn5lfwcvj.lnk.bd")) returned 1 [0093.437] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\music.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\music.lnk.bd")) returned 1 [0093.439] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MUzuaP.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\muzuap.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MUzuaP.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\muzuap.lnk.bd")) returned 1 [0093.441] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mZ70S9RVzTPtrUD4x-YF.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\mz70s9rvztptrud4x-yf.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mZ70S9RVzTPtrUD4x-YF.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\mz70s9rvztptrud4x-yf.lnk.bd")) returned 1 [0093.443] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n4nU6oZ5Wn0pXNewD0.flv.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\n4nu6oz5wn0pxnewd0.flv.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n4nU6oZ5Wn0pXNewD0.flv.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\n4nu6oz5wn0pxnewd0.flv.lnk.bd")) returned 1 [0093.444] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\N6bj.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\n6bj.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\N6bj.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\n6bj.lnk.bd")) returned 1 [0093.447] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NlRtIQkZvs6BaK.flv.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\nlrtiqkzvs6bak.flv.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NlRtIQkZvs6BaK.flv.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\nlrtiqkzvs6bak.flv.lnk.bd")) returned 1 [0093.449] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nT6-.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\nt6-.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nT6-.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\nt6-.lnk.bd")) returned 1 [0093.464] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nUFQg.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\nufqg.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nUFQg.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\nufqg.lnk.bd")) returned 1 [0093.467] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NZHY15qn9QlSV.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\nzhy15qn9qlsv.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NZHY15qn9QlSV.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\nzhy15qn9qlsv.lnk.bd")) returned 1 [0093.469] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o0XLNcg9OQZLhpGJZ2l.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\o0xlncg9oqzlhpgjz2l.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o0XLNcg9OQZLhpGJZ2l.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\o0xlncg9oqzlhpgjz2l.lnk.bd")) returned 1 [0093.471] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O1YDSM61Qu.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\o1ydsm61qu.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O1YDSM61Qu.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\o1ydsm61qu.lnk.bd")) returned 1 [0093.473] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ocj1vUlxB-.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\ocj1vulxb-.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ocj1vUlxB-.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\ocj1vulxb-.lnk.bd")) returned 1 [0093.475] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OPz9WesB_Fkof.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\opz9wesb_fkof.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OPz9WesB_Fkof.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\opz9wesb_fkof.lnk.bd")) returned 1 [0093.482] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OSvsgc3guuRlcgE7.flv.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\osvsgc3guurlcge7.flv.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OSvsgc3guuRlcgE7.flv.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\osvsgc3guurlcge7.flv.lnk.bd")) returned 1 [0093.485] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\pictures.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\pictures.lnk.bd")) returned 1 [0093.487] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ppd8HF5.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\ppd8hf5.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ppd8HF5.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\ppd8hf5.lnk.bd")) returned 1 [0093.489] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pViO94j01HMr.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\pvio94j01hmr.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pViO94j01HMr.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\pvio94j01hmr.lnk.bd")) returned 1 [0093.492] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qGUR-jFx.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\qgur-jfx.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qGUR-jFx.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\qgur-jfx.lnk.bd")) returned 1 [0093.495] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QKF_LE2dkMVF0j.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\qkf_le2dkmvf0j.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QKF_LE2dkMVF0j.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\qkf_le2dkmvf0j.lnk.bd")) returned 1 [0093.497] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QKJx1jIG jyuiQ5H86.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\qkjx1jig jyuiq5h86.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QKJx1jIG jyuiQ5H86.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\qkjx1jig jyuiq5h86.lnk.bd")) returned 1 [0093.499] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qRpsPAmNwMW2C4xwYa.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\qrpspamnwmw2c4xwya.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qRpsPAmNwMW2C4xwYa.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\qrpspamnwmw2c4xwya.lnk.bd")) returned 1 [0093.501] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qSXEeT9krGpiw.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\qsxeet9krgpiw.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qSXEeT9krGpiw.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\qsxeet9krgpiw.lnk.bd")) returned 1 [0093.503] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R0iS26.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\r0is26.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R0iS26.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\r0is26.lnk.bd")) returned 1 [0093.506] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R1Da9z7lmaNTBAvJo.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\r1da9z7lmantbavjo.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R1Da9z7lmaNTBAvJo.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\r1da9z7lmantbavjo.lnk.bd")) returned 1 [0093.509] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rCgWWo.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\rcgwwo.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rCgWWo.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\rcgwwo.lnk.bd")) returned 1 [0093.512] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RcLeo 22Fr BWUlJG.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\rcleo 22fr bwuljg.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RcLeo 22Fr BWUlJG.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\rcleo 22fr bwuljg.lnk.bd")) returned 1 [0093.514] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RNWt wtFv (2).lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\rnwt wtfv (2).lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RNWt wtFv (2).lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\rnwt wtfv (2).lnk.bd")) returned 1 [0093.517] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RNWt wtFv.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\rnwt wtfv.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RNWt wtFv.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\rnwt wtfv.lnk.bd")) returned 1 [0093.519] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk.bd")) returned 1 [0093.576] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrpDp.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\rrpdp.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrpDp.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\rrpdp.lnk.bd")) returned 1 [0093.579] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RsRm-bZlrFWAaWz.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\rsrm-bzlrfwaawz.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RsRm-bZlrFWAaWz.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\rsrm-bzlrfwaawz.lnk.bd")) returned 1 [0093.582] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\S9NvfP61A6.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\s9nvfp61a6.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\S9NvfP61A6.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\s9nvfp61a6.lnk.bd")) returned 1 [0093.585] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Sa5TIUvnK.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\sa5tiuvnk.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Sa5TIUvnK.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\sa5tiuvnk.lnk.bd")) returned 1 [0093.602] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sBodEAbseHHB.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\sbodeabsehhb.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sBodEAbseHHB.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\sbodeabsehhb.lnk.bd")) returned 1 [0093.605] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sgZbEs.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\sgzbes.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sgZbEs.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\sgzbes.lnk.bd")) returned 1 [0093.608] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sQxya1bDnxSO-cuS.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\sqxya1bdnxso-cus.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sQxya1bDnxSO-cuS.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\sqxya1bdnxso-cus.lnk.bd")) returned 1 [0093.610] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SU_3yUQcPzkYV-E7WrU.flv.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\su_3yuqcpzkyv-e7wru.flv.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SU_3yUQcPzkYV-E7WrU.flv.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\su_3yuqcpzkyv-e7wru.flv.lnk.bd")) returned 1 [0093.613] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TD0exglq-MMs3AT.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\td0exglq-mms3at.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TD0exglq-MMs3AT.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\td0exglq-mms3at.lnk.bd")) returned 1 [0093.615] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tElvL6EYnWRbrRKSOBF.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\telvl6eynwrbrrksobf.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tElvL6EYnWRbrRKSOBF.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\telvl6eynwrbrrksobf.lnk.bd")) returned 1 [0093.618] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TKLy.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\tkly.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TKLy.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\tkly.lnk.bd")) returned 1 [0093.621] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TOt_Ia.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\tot_ia.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TOt_Ia.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\tot_ia.lnk.bd")) returned 1 [0093.623] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tsfa8X60WGpQ_34jVTzl.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\tsfa8x60wgpq_34jvtzl.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tsfa8X60WGpQ_34jVTzl.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\tsfa8x60wgpq_34jvtzl.lnk.bd")) returned 1 [0093.626] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u1kUBpUqxW-O8lu.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\u1kubpuqxw-o8lu.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u1kUBpUqxW-O8lu.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\u1kubpuqxw-o8lu.lnk.bd")) returned 1 [0093.628] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U2 YnmgblLtqEgqiZ.flv.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\u2 ynmgblltqegqiz.flv.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U2 YnmgblLtqEgqiZ.flv.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\u2 ynmgblltqegqiz.flv.lnk.bd")) returned 1 [0093.630] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uE23K.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\ue23k.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uE23K.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\ue23k.lnk.bd")) returned 1 [0093.677] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uQi7-Vd-9HaTMW99qlo.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\uqi7-vd-9hatmw99qlo.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uQi7-Vd-9HaTMW99qlo.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\uqi7-vd-9hatmw99qlo.lnk.bd")) returned 1 [0093.680] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v3h4MmgVH.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\v3h4mmgvh.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v3h4MmgVH.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\v3h4mmgvh.lnk.bd")) returned 1 [0093.682] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V49dSUwucPJRrP.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\v49dsuwucpjrrp.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V49dSUwucPJRrP.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\v49dsuwucpjrrp.lnk.bd")) returned 1 [0093.684] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VgHc4D.flv.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\vghc4d.flv.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VgHc4D.flv.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\vghc4d.flv.lnk.bd")) returned 1 [0093.686] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\videos.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\videos.lnk.bd")) returned 1 [0093.688] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VlmC-W0x6E6k.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\vlmc-w0x6e6k.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VlmC-W0x6E6k.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\vlmc-w0x6e6k.lnk.bd")) returned 1 [0093.690] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vpbXJdkYQ9 71Wc_hCa.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\vpbxjdkyq9 71wc_hca.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vpbXJdkYQ9 71Wc_hCa.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\vpbxjdkyq9 71wc_hca.lnk.bd")) returned 1 [0093.692] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XH6LrwSI3JfRIBE.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\xh6lrwsi3jfribe.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XH6LrwSI3JfRIBE.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\xh6lrwsi3jfribe.lnk.bd")) returned 1 [0093.694] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xwo9pCOZHS2j1pjI.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\xwo9pcozhs2j1pji.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xwo9pCOZHS2j1pjI.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\xwo9pcozhs2j1pji.lnk.bd")) returned 1 [0093.696] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YtkY0gX.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\ytky0gx.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YtkY0gX.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\ytky0gx.lnk.bd")) returned 1 [0093.698] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y_9YAVNPZwPGix95tDyG.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\y_9yavnpzwpgix95tdyg.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y_9YAVNPZwPGix95tDyG.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\y_9yavnpzwpgix95tdyg.lnk.bd")) returned 1 [0093.700] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zt4BuwnFrHShvCHV.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\zt4buwnfrhshvchv.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zt4BuwnFrHShvCHV.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\zt4buwnfrhshvchv.lnk.bd")) returned 1 [0093.702] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZynUwtLwGAEe4NdXV.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\zynuwtlwgaee4ndxv.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZynUwtLwGAEe4NdXV.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\zynuwtlwgaee4ndxv.lnk.bd")) returned 1 [0093.704] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_8CVh1IFuaOJStr.ots.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\_8cvh1ifuaojstr.ots.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_8CVh1IFuaOJStr.ots.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\_8cvh1ifuaojstr.ots.lnk.bd")) returned 1 [0093.706] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_F8jjIiQ.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\_f8jjiiq.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_F8jjIiQ.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\_f8jjiiq.lnk.bd")) returned 1 [0093.708] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_kLE.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\_kle.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_kLE.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\recent\\_kle.lnk.bd")) returned 1 [0093.722] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\sendto\\bluetooth file transfer.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\sendto\\bluetooth file transfer.lnk.bd")) returned 1 [0093.725] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.bd")) returned 1 [0093.735] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk.bd")) returned 1 [0093.739] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk.bd")) returned 1 [0093.743] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk.bd")) returned 1 [0093.748] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\internet explorer.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\internet explorer.lnk.bd")) returned 1 [0093.755] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.bd")) returned 1 [0094.139] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk.bd")) returned 1 [0094.142] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk.bd")) returned 1 [0094.145] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk.bd")) returned 1 [0094.149] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Apps.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\default apps.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Apps.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\default apps.lnk.bd")) returned 1 [0094.152] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Devices.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\devices.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Devices.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\devices.lnk.bd")) returned 1 [0094.155] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk.bd")) returned 1 [0094.158] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk.bd")) returned 1 [0094.163] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk.bd")) returned 1 [0094.229] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk.bd")) returned 1 [0094.232] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk.bd")) returned 1 [0094.236] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk.bd")) returned 1 [0094.256] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\cachedimage_1440_900_pos4.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\cachedimage_1440_900_pos4.jpg.bd")) returned 1 [0094.270] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Q04iXgqtoi1a6bWK1.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\q04ixgqtoi1a6bwk1.mp4"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Q04iXgqtoi1a6bWK1.mp4.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\q04ixgqtoi1a6bwk1.mp4.bd")) returned 1 [0094.275] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\RcLeo 22Fr BWUlJG.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\rcleo 22fr bwuljg.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\RcLeo 22Fr BWUlJG.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\rcleo 22fr bwuljg.png.bd")) returned 1 [0094.278] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\RrpDp.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\rrpdp.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\RrpDp.xlsx.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\rrpdp.xlsx.bd")) returned 1 [0094.281] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\U2 YnmgblLtqEgqiZ.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\u2 ynmgblltqegqiz.flv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\U2 YnmgblLtqEgqiZ.flv.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\u2 ynmgblltqegqiz.flv.bd")) returned 1 [0094.286] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\x7fMHiH3.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\x7fmhih3.mp4"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\x7fMHiH3.mp4.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\x7fmhih3.mp4.bd")) returned 1 [0094.290] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Y_9YAVNPZwPGix95tDyG.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\y_9yavnpzwpgix95tdyg.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Y_9YAVNPZwPGix95tDyG.docx.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\y_9yavnpzwpgix95tdyg.docx.bd")) returned 1 [0094.292] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\_THDtM33.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\_thdtm33.wav"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\_THDtM33.wav.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\_thdtm33.wav.bd")) returned 1 [0094.300] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\0Zp6-GedBeUcWNL.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\0zp6-gedbeucwnl.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\0Zp6-GedBeUcWNL.mp3.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\0zp6-gedbeucwnl.mp3.bd")) returned 1 [0094.349] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7yTu2fIau7azD1My5.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\7ytu2fiau7azd1my5.mp4"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7yTu2fIau7azD1My5.mp4.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\7ytu2fiau7azd1my5.mp4.bd")) returned 1 [0094.357] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8JnODARgNn6VETb.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8jnodargnn6vetb.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8JnODARgNn6VETb.xlsx.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8jnodargnn6vetb.xlsx.bd")) returned 1 [0094.361] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A1xn000L.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a1xn000l.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A1xn000L.bmp.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a1xn000l.bmp.bd")) returned 1 [0094.368] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\D-hjBWTnbHsPxYw.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\d-hjbwtnbhspxyw.gif"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\D-hjBWTnbHsPxYw.gif.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\d-hjbwtnbhspxyw.gif.bd")) returned 1 [0094.373] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\dEb8rp0qFDK1NqV.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\deb8rp0qfdk1nqv.mkv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\dEb8rp0qFDK1NqV.mkv.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\deb8rp0qfdk1nqv.mkv.bd")) returned 1 [0094.375] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Hr6u-hD3fNhCB5puTw.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\hr6u-hd3fnhcb5putw.gif"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Hr6u-hD3fNhCB5puTw.gif.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\hr6u-hd3fnhcb5putw.gif.bd")) returned 1 [0094.378] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\mqV3YTrv P.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\mqv3ytrv p.avi"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\mqV3YTrv P.avi.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\mqv3ytrv p.avi.bd")) returned 1 [0094.381] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\nT6-.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\nt6-.gif"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\nT6-.gif.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\nt6-.gif.bd")) returned 1 [0094.397] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\o0XLNcg9OQZLhpGJZ2l.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\o0xlncg9oqzlhpgjz2l.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\o0XLNcg9OQZLhpGJZ2l.bmp.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\o0xlncg9oqzlhpgjz2l.bmp.bd")) returned 1 [0094.404] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\pafghrB2SS1J.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\pafghrb2ss1j.mp4"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\pafghrB2SS1J.mp4.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\pafghrb2ss1j.mp4.bd")) returned 1 [0094.423] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\R1Da9z7lmaNTBAvJo.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r1da9z7lmantbavjo.gif"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\R1Da9z7lmaNTBAvJo.gif.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r1da9z7lmantbavjo.gif.bd")) returned 1 [0094.428] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\SU_3yUQcPzkYV-E7WrU.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\su_3yuqcpzkyv-e7wru.flv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\SU_3yUQcPzkYV-E7WrU.flv.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\su_3yuqcpzkyv-e7wru.flv.bd")) returned 1 [0094.433] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\TD0exglq-MMs3AT\\BWfq.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\td0exglq-mms3at\\bwfq.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\TD0exglq-MMs3AT\\BWfq.pptx.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\td0exglq-mms3at\\bwfq.pptx.bd")) returned 1 [0094.439] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\TD0exglq-MMs3AT\\eXj.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\td0exglq-mms3at\\exj.mp4"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\TD0exglq-MMs3AT\\eXj.mp4.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\td0exglq-mms3at\\exj.mp4.bd")) returned 1 [0094.445] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\TD0exglq-MMs3AT\\ISSdTeg.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\td0exglq-mms3at\\issdteg.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\TD0exglq-MMs3AT\\ISSdTeg.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\td0exglq-mms3at\\issdteg.png.bd")) returned 1 [0094.476] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\TD0exglq-MMs3AT\\R0iS26\\nG 0FcxKmuphj.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\td0exglq-mms3at\\r0is26\\ng 0fcxkmuphj.avi"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\TD0exglq-MMs3AT\\R0iS26\\nG 0FcxKmuphj.avi.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\td0exglq-mms3at\\r0is26\\ng 0fcxkmuphj.avi.bd")) returned 1 [0094.483] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\TD0exglq-MMs3AT\\R0iS26\\oX55X32TeiCEgPo1vmMW.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\td0exglq-mms3at\\r0is26\\ox55x32teicegpo1vmmw.avi"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\TD0exglq-MMs3AT\\R0iS26\\oX55X32TeiCEgPo1vmMW.avi.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\td0exglq-mms3at\\r0is26\\ox55x32teicegpo1vmmw.avi.bd")) returned 1 [0094.485] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\TD0exglq-MMs3AT\\R0iS26\\X4UdawAviHUB.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\td0exglq-mms3at\\r0is26\\x4udawavihub.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\TD0exglq-MMs3AT\\R0iS26\\X4UdawAviHUB.mp3.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\td0exglq-mms3at\\r0is26\\x4udawavihub.mp3.bd")) returned 1 [0094.488] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\TD0exglq-MMs3AT\\R0iS26\\YByndYp07yTLSsQ.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\td0exglq-mms3at\\r0is26\\ybyndyp07ytlssq.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\TD0exglq-MMs3AT\\R0iS26\\YByndYp07yTLSsQ.mp3.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\td0exglq-mms3at\\r0is26\\ybyndyp07ytlssq.mp3.bd")) returned 1 [0094.494] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\TD0exglq-MMs3AT\\u1kUBpUqxW-O8lu.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\td0exglq-mms3at\\u1kubpuqxw-o8lu.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\TD0exglq-MMs3AT\\u1kUBpUqxW-O8lu.bmp.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\td0exglq-mms3at\\u1kubpuqxw-o8lu.bmp.bd")) returned 1 [0094.498] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\wGNLds00.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\wgnlds00.mp4"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\wGNLds00.mp4.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\wgnlds00.mp4.bd")) returned 1 [0094.505] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\ZynUwtLwGAEe4NdXV.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\zynuwtlwgaee4ndxv.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\ZynUwtLwGAEe4NdXV.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\zynuwtlwgaee4ndxv.png.bd")) returned 1 [0094.535] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0lWUeF5\\7qLqQIn.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\0lwuef5\\7qlqqin.doc"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0lWUeF5\\7qLqQIn.doc.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\0lwuef5\\7qlqqin.doc.bd")) returned 1 [0094.540] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0lWUeF5\\krH5ZhSwpubEjuL9F.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\0lwuef5\\krh5zhswpubejul9f.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0lWUeF5\\krH5ZhSwpubEjuL9F.docx.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\0lwuef5\\krh5zhswpubejul9f.docx.bd")) returned 1 [0094.546] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0lWUeF5\\MUzuaP.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\0lwuef5\\muzuap.pdf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0lWUeF5\\MUzuaP.pdf.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\0lwuef5\\muzuap.pdf.bd")) returned 1 [0094.550] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0lWUeF5\\OPz9WesB_Fkof.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\0lwuef5\\opz9wesb_fkof.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0lWUeF5\\OPz9WesB_Fkof.docx.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\0lwuef5\\opz9wesb_fkof.docx.bd")) returned 1 [0094.554] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0lWUeF5\\XH6LrwSI3JfRIBE.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\0lwuef5\\xh6lrwsi3jfribe.pdf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0lWUeF5\\XH6LrwSI3JfRIBE.pdf.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\0lwuef5\\xh6lrwsi3jfribe.pdf.bd")) returned 1 [0094.563] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\2DKtHiOaXaZ2X7.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\2dkthioaxaz2x7.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\2DKtHiOaXaZ2X7.xlsx.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\2dkthioaxaz2x7.xlsx.bd")) returned 1 [0094.567] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\4yXDcqjMJV.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\4yxdcqjmjv.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\4yXDcqjMJV.docx.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\4yxdcqjmjv.docx.bd")) returned 1 [0094.569] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\94ZoY.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\94zoy.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\94ZoY.xlsx.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\94zoy.xlsx.bd")) returned 1 [0094.582] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\9KDVfnKUJs.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\9kdvfnkujs.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\9KDVfnKUJs.pptx.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\9kdvfnkujs.pptx.bd")) returned 1 [0094.642] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\AErIKk.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\aerikk.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\AErIKk.xlsx.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\aerikk.xlsx.bd")) returned 1 [0094.649] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\CRoelfslKaz4WMk6u\\fyGRheq3stTs.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\croelfslkaz4wmk6u\\fygrheq3stts.pdf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\CRoelfslKaz4WMk6u\\fyGRheq3stTs.pdf.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\croelfslkaz4wmk6u\\fygrheq3stts.pdf.bd")) returned 1 [0094.653] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\CRoelfslKaz4WMk6u\\LM4POnb.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\croelfslkaz4wmk6u\\lm4ponb.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\CRoelfslKaz4WMk6u\\LM4POnb.pptx.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\croelfslkaz4wmk6u\\lm4ponb.pptx.bd")) returned 1 [0094.659] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\CRoelfslKaz4WMk6u\\uE23K.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\croelfslkaz4wmk6u\\ue23k.pdf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\CRoelfslKaz4WMk6u\\uE23K.pdf.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\croelfslkaz4wmk6u\\ue23k.pdf.bd")) returned 1 [0094.663] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\CRoelfslKaz4WMk6u\\uQi7-Vd-9HaTMW99qlo.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\croelfslkaz4wmk6u\\uqi7-vd-9hatmw99qlo.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\CRoelfslKaz4WMk6u\\uQi7-Vd-9HaTMW99qlo.docx.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\croelfslkaz4wmk6u\\uqi7-vd-9hatmw99qlo.docx.bd")) returned 1 [0094.667] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\CRoelfslKaz4WMk6u\\zt4BuwnFrHShvCHV.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\croelfslkaz4wmk6u\\zt4buwnfrhshvchv.doc"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\CRoelfslKaz4WMk6u\\zt4BuwnFrHShvCHV.doc.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\croelfslkaz4wmk6u\\zt4buwnfrhshvchv.doc.bd")) returned 1 [0094.671] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\EobG4cAVyaqL7iH.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\eobg4cavyaql7ih.pdf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\EobG4cAVyaqL7iH.pdf.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\eobg4cavyaql7ih.pdf.bd")) returned 1 [0094.675] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fianMD.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fianmd.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fianMD.xlsx.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fianmd.xlsx.bd")) returned 1 [0094.685] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\hDoHjm.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\hdohjm.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\hDoHjm.docx.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\hdohjm.docx.bd")) returned 1 [0094.690] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\j4tKUce.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\j4tkuce.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\j4tKUce.pptx.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\j4tkuce.pptx.bd")) returned 1 [0094.698] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\jd-FGX.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\jd-fgx.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\jd-FGX.pptx.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\jd-fgx.pptx.bd")) returned 1 [0094.700] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lcVa.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lcva.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lcVa.pptx.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lcva.pptx.bd")) returned 1 [0094.705] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LjK-5z.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ljk-5z.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LjK-5z.docx.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ljk-5z.docx.bd")) returned 1 [0094.707] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lOfGxOeLjVoh3fDJ6xyy.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lofgxoeljvoh3fdj6xyy.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lOfGxOeLjVoh3fDJ6xyy.pptx.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lofgxoeljvoh3fdj6xyy.pptx.bd")) returned 1 [0094.713] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\L_Hx.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l_hx.doc"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\L_Hx.doc.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l_hx.doc.bd")) returned 1 [0094.720] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ppd8HF5.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ppd8hf5.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ppd8HF5.pptx.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ppd8hf5.pptx.bd")) returned 1 [0094.725] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\QKF_LE2dkMVF0j.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qkf_le2dkmvf0j.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\QKF_LE2dkMVF0j.docx.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qkf_le2dkmvf0j.docx.bd")) returned 1 [0094.754] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\qSXEeT9krGpiw.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qsxeet9krgpiw.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\qSXEeT9krGpiw.xlsx.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qsxeet9krgpiw.xlsx.bd")) returned 1 [0094.758] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\rCgWWo.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\rcgwwo.ppt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\rCgWWo.ppt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\rcgwwo.ppt.bd")) returned 1 [0094.762] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\S9NvfP61A6.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\s9nvfp61a6.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\S9NvfP61A6.docx.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\s9nvfp61a6.docx.bd")) returned 1 [0094.765] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\V49dSUwucPJRrP.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\v49dsuwucpjrrp.odt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\V49dSUwucPJRrP.odt.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\v49dsuwucpjrrp.odt.bd")) returned 1 [0094.768] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\_F8jjIiQ.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\_f8jjiiq.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\_F8jjIiQ.xlsx.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\_f8jjiiq.xlsx.bd")) returned 1 [0094.780] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Desktop.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\links\\desktop.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Desktop.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\links\\desktop.lnk.bd")) returned 1 [0094.786] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Downloads.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\links\\downloads.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Downloads.lnk.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\links\\downloads.lnk.bd")) returned 1 [0094.806] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\aAKvUAMaYYmfNz.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\aakvuamayymfnz.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\aAKvUAMaYYmfNz.mp3.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\aakvuamayymfnz.mp3.bd")) returned 1 [0094.814] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\fk63-85UutdH45mYQza2\\RsRm-bZlrFWAaWz\\0ZObSBqMDL_R.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\fk63-85uutdh45myqza2\\rsrm-bzlrfwaawz\\0zobsbqmdl_r.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\fk63-85UutdH45mYQza2\\RsRm-bZlrFWAaWz\\0ZObSBqMDL_R.mp3.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\fk63-85uutdh45myqza2\\rsrm-bzlrfwaawz\\0zobsbqmdl_r.mp3.bd")) returned 1 [0094.819] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\DkrdQscXEZBwM625X.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\dkrdqscxezbwm625x.wav"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\DkrdQscXEZBwM625X.wav.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\dkrdqscxezbwm625x.wav.bd")) returned 1 [0094.831] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\Jd85\\78QVaGmA9 FPCHSf1.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\jd85\\78qvagma9 fpchsf1.wav"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\Jd85\\78QVaGmA9 FPCHSf1.wav.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\jd85\\78qvagma9 fpchsf1.wav.bd")) returned 1 [0094.837] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\Jd85\\A8DSqPZNu8WKwUBo6r.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\jd85\\a8dsqpznu8wkwubo6r.wav"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\Jd85\\A8DSqPZNu8WKwUBo6r.wav.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\jd85\\a8dsqpznu8wkwubo6r.wav.bd")) returned 1 [0094.843] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\Jd85\\F4EClyWbCPVu4pRHD.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\jd85\\f4eclywbcpvu4prhd.wav"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\Jd85\\F4EClyWbCPVu4pRHD.wav.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\jd85\\f4eclywbcpvu4prhd.wav.bd")) returned 1 [0094.863] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\Jd85\\VfdVnP_J.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\jd85\\vfdvnp_j.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\Jd85\\VfdVnP_J.mp3.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\jd85\\vfdvnp_j.mp3.bd")) returned 1 [0094.867] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\oRBsB0HEiKwrnZl.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\orbsb0heikwrnzl.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\oRBsB0HEiKwrnZl.mp3.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\orbsb0heikwrnzl.mp3.bd")) returned 1 [0094.871] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\PCsC-4LJb0-.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\pcsc-4ljb0-.wav"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\PCsC-4LJb0-.wav.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\pcsc-4ljb0-.wav.bd")) returned 1 [0094.877] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\Sa5TIUvnK\\QywE29.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\sa5tiuvnk\\qywe29.wav"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\Sa5TIUvnK\\QywE29.wav.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\sa5tiuvnk\\qywe29.wav.bd")) returned 1 [0094.883] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\Sa5TIUvnK\\sehFwrK.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\sa5tiuvnk\\sehfwrk.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\Sa5TIUvnK\\sehFwrK.mp3.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\sa5tiuvnk\\sehfwrk.mp3.bd")) returned 1 [0094.889] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\VlmC-W0x6E6k\\5TnZ56N0Qr8fULMuyYn.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\vlmc-w0x6e6k\\5tnz56n0qr8fulmuyyn.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\VlmC-W0x6E6k\\5TnZ56N0Qr8fULMuyYn.mp3.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\vlmc-w0x6e6k\\5tnz56n0qr8fulmuyyn.mp3.bd")) returned 1 [0094.897] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\VlmC-W0x6E6k\\6tERG9.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\vlmc-w0x6e6k\\6terg9.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\VlmC-W0x6E6k\\6tERG9.mp3.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\vlmc-w0x6e6k\\6terg9.mp3.bd")) returned 1 [0094.906] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\VlmC-W0x6E6k\\mnOzm6.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\vlmc-w0x6e6k\\mnozm6.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\VlmC-W0x6E6k\\mnOzm6.mp3.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\vlmc-w0x6e6k\\mnozm6.mp3.bd")) returned 1 [0094.913] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\VlmC-W0x6E6k\\N6bj\\fhIbg_Q dtyxOERLj.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\vlmc-w0x6e6k\\n6bj\\fhibg_q dtyxoerlj.wav"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\VlmC-W0x6E6k\\N6bj\\fhIbg_Q dtyxOERLj.wav.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\vlmc-w0x6e6k\\n6bj\\fhibg_q dtyxoerlj.wav.bd")) returned 1 [0094.919] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\VlmC-W0x6E6k\\N6bj\\ikTI25BiJfH.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\vlmc-w0x6e6k\\n6bj\\ikti25bijfh.wav"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\VlmC-W0x6E6k\\N6bj\\ikTI25BiJfH.wav.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\vlmc-w0x6e6k\\n6bj\\ikti25bijfh.wav.bd")) returned 1 [0094.922] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\VlmC-W0x6E6k\\pADn7bcN9PS7HAG7.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\vlmc-w0x6e6k\\padn7bcn9ps7hag7.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\VlmC-W0x6E6k\\pADn7bcN9PS7HAG7.mp3.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\vlmc-w0x6e6k\\padn7bcn9ps7hag7.mp3.bd")) returned 1 [0094.926] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\VlmC-W0x6E6k\\qkE_1N8.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\vlmc-w0x6e6k\\qke_1n8.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\VlmC-W0x6E6k\\qkE_1N8.mp3.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\vlmc-w0x6e6k\\qke_1n8.mp3.bd")) returned 1 [0094.933] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\VlmC-W0x6E6k\\Vr3z-o4OC9V.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\vlmc-w0x6e6k\\vr3z-o4oc9v.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\eJeR4HKhrS6L\\MtH6jXoGMcn5LFWCvj\\VlmC-W0x6E6k\\Vr3z-o4OC9V.mp3.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ejer4hkhrs6l\\mth6jxogmcn5lfwcvj\\vlmc-w0x6e6k\\vr3z-o4oc9v.mp3.bd")) returned 1 [0094.939] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\fWOj347aEOghh\\Bgnrb_.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\fwoj347aeoghh\\bgnrb_.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\fWOj347aEOghh\\Bgnrb_.mp3.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\fwoj347aeoghh\\bgnrb_.mp3.bd")) returned 1 [0094.942] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\fWOj347aEOghh\\fM-RfB6dA ko.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\fwoj347aeoghh\\fm-rfb6da ko.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\fWOj347aEOghh\\fM-RfB6dA ko.mp3.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\fwoj347aeoghh\\fm-rfb6da ko.mp3.bd")) returned 1 [0094.982] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\fWOj347aEOghh\\Ti3RKENqmPDiJJEqZ.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\fwoj347aeoghh\\ti3rkenqmpdijjeqz.wav"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\fWOj347aEOghh\\Ti3RKENqmPDiJJEqZ.wav.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\fwoj347aeoghh\\ti3rkenqmpdijjeqz.wav.bd")) returned 1 [0094.988] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ICzzMjT.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\iczzmjt.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ICzzMjT.mp3.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\iczzmjt.mp3.bd")) returned 1 [0094.993] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\jodbz8y3WaQnmcxox.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\jodbz8y3waqnmcxox.wav"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\jodbz8y3WaQnmcxox.wav.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\jodbz8y3waqnmcxox.wav.bd")) returned 1 [0095.001] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\qRpsPAmNwMW2C4xwYa\\FuVXvPfbaGxSf07xe5GJ.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\qrpspamnwmw2c4xwya\\fuvxvpfbagxsf07xe5gj.wav"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\qRpsPAmNwMW2C4xwYa\\FuVXvPfbaGxSf07xe5GJ.wav.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\qrpspamnwmw2c4xwya\\fuvxvpfbagxsf07xe5gj.wav.bd")) returned 1 [0095.005] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\qRpsPAmNwMW2C4xwYa\\Go6HC3bFPCF.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\qrpspamnwmw2c4xwya\\go6hc3bfpcf.wav"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\qRpsPAmNwMW2C4xwYa\\Go6HC3bFPCF.wav.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\qrpspamnwmw2c4xwya\\go6hc3bfpcf.wav.bd")) returned 1 [0095.010] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\qRpsPAmNwMW2C4xwYa\\TocBNDgJOdmrTW4g8w.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\qrpspamnwmw2c4xwya\\tocbndgjodmrtw4g8w.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\qRpsPAmNwMW2C4xwYa\\TocBNDgJOdmrTW4g8w.mp3.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\qrpspamnwmw2c4xwya\\tocbndgjodmrtw4g8w.mp3.bd")) returned 1 [0095.013] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\qRpsPAmNwMW2C4xwYa\\WIoFkp.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\qrpspamnwmw2c4xwya\\wiofkp.wav"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\qRpsPAmNwMW2C4xwYa\\WIoFkp.wav.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\qrpspamnwmw2c4xwya\\wiofkp.wav.bd")) returned 1 [0095.017] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\qRpsPAmNwMW2C4xwYa\\x1ttNZCO3n.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\qrpspamnwmw2c4xwya\\x1ttnzco3n.wav"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\qRpsPAmNwMW2C4xwYa\\x1ttNZCO3n.wav.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\qrpspamnwmw2c4xwya\\x1ttnzco3n.wav.bd")) returned 1 [0095.076] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\TtSszKbLr4B.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ttsszkblr4b.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\TtSszKbLr4B.mp3.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ttsszkblr4b.mp3.bd")) returned 1 [0095.099] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ASgsmg-.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\asgsmg-.gif"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ASgsmg-.gif.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\asgsmg-.gif.bd")) returned 1 [0095.106] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\aX8Dcph44d31plLiqNd.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ax8dcph44d31plliqnd.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\aX8Dcph44d31plLiqNd.bmp.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ax8dcph44d31plliqnd.bmp.bd")) returned 1 [0095.109] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BY565QJ.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\by565qj.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BY565QJ.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\by565qj.jpg.bd")) returned 1 [0095.115] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\cZkNUo8hT-eh.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\czknuo8ht-eh.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\cZkNUo8hT-eh.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\czknuo8ht-eh.jpg.bd")) returned 1 [0095.123] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\h -7\\AKcfBGKLc6tJJX.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\h -7\\akcfbgklc6tjjx.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\h -7\\AKcfBGKLc6tJJX.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\h -7\\akcfbgklc6tjjx.png.bd")) returned 1 [0095.129] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\h -7\\kX9Z.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\h -7\\kx9z.gif"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\h -7\\kX9Z.gif.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\h -7\\kx9z.gif.bd")) returned 1 [0095.164] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\h -7\\m-nCi0J9JUekKLT5qeHD.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\h -7\\m-nci0j9juekklt5qehd.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\h -7\\m-nCi0J9JUekKLT5qeHD.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\h -7\\m-nci0j9juekklt5qehd.jpg.bd")) returned 1 [0095.170] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\h -7\\TOt_Ia.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\h -7\\tot_ia.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\h -7\\TOt_Ia.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\h -7\\tot_ia.jpg.bd")) returned 1 [0095.173] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\h -7\\vpbXJdkYQ9 71Wc_hCa.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\h -7\\vpbxjdkyq9 71wc_hca.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\h -7\\vpbXJdkYQ9 71Wc_hCa.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\h -7\\vpbxjdkyq9 71wc_hca.png.bd")) returned 1 [0095.178] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\H_MuWcKi.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\h_muwcki.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\H_MuWcKi.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\h_muwcki.png.bd")) returned 1 [0095.182] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\nUFQg.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\nufqg.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\nUFQg.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\nufqg.jpg.bd")) returned 1 [0095.189] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\NZHY15qn9QlSV.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\nzhy15qn9qlsv.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\NZHY15qn9QlSV.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\nzhy15qn9qlsv.png.bd")) returned 1 [0095.200] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\QKJx1jIG jyuiQ5H86.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\qkjx1jig jyuiq5h86.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\QKJx1jIG jyuiQ5H86.bmp.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\qkjx1jig jyuiq5h86.bmp.bd")) returned 1 [0095.206] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\RNWt wtFv\\0Il_92U.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\rnwt wtfv\\0il_92u.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\RNWt wtFv\\0Il_92U.bmp.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\rnwt wtfv\\0il_92u.bmp.bd")) returned 1 [0095.210] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\RNWt wtFv\\5vunWIqEPg3VKzqQc.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\rnwt wtfv\\5vunwiqepg3vkzqqc.gif"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\RNWt wtFv\\5vunWIqEPg3VKzqQc.gif.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\rnwt wtfv\\5vunwiqepg3vkzqqc.gif.bd")) returned 1 [0095.226] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\RNWt wtFv\\8vSz.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\rnwt wtfv\\8vsz.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\RNWt wtFv\\8vSz.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\rnwt wtfv\\8vsz.png.bd")) returned 1 [0095.237] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\RNWt wtFv\\Fz7bWc 6NYywz1Z.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\rnwt wtfv\\fz7bwc 6nyywz1z.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\RNWt wtFv\\Fz7bWc 6NYywz1Z.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\rnwt wtfv\\fz7bwc 6nyywz1z.jpg.bd")) returned 1 [0095.240] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\RNWt wtFv\\hDxpwNMTr.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\rnwt wtfv\\hdxpwnmtr.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\RNWt wtFv\\hDxpwNMTr.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\rnwt wtfv\\hdxpwnmtr.jpg.bd")) returned 1 [0095.244] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\RNWt wtFv\\lpIEJJeiUZB.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\rnwt wtfv\\lpiejjeiuzb.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\RNWt wtFv\\lpIEJJeiUZB.bmp.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\rnwt wtfv\\lpiejjeiuzb.bmp.bd")) returned 1 [0095.249] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\RNWt wtFv\\mDEq6wjBZ-rkL9UaUP.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\rnwt wtfv\\mdeq6wjbz-rkl9uaup.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\RNWt wtFv\\mDEq6wjBZ-rkL9UaUP.bmp.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\rnwt wtfv\\mdeq6wjbz-rkl9uaup.bmp.bd")) returned 1 [0095.255] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\RNWt wtFv\\qGUR-jFx.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\rnwt wtfv\\qgur-jfx.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\RNWt wtFv\\qGUR-jFx.bmp.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\rnwt wtfv\\qgur-jfx.bmp.bd")) returned 1 [0095.259] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\RNWt wtFv\\tElvL6EYnWRbrRKSOBF.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\rnwt wtfv\\telvl6eynwrbrrksobf.gif"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\RNWt wtFv\\tElvL6EYnWRbrRKSOBF.gif.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\rnwt wtfv\\telvl6eynwrbrrksobf.gif.bd")) returned 1 [0095.263] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\RNWt wtFv\\v3h4MmgVH.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\rnwt wtfv\\v3h4mmgvh.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\RNWt wtFv\\v3h4MmgVH.png.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\rnwt wtfv\\v3h4mmgvh.png.bd")) returned 1 [0095.266] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\RNWt wtFv\\Xwo9pCOZHS2j1pjI.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\rnwt wtfv\\xwo9pcozhs2j1pji.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\RNWt wtFv\\Xwo9pCOZHS2j1pjI.jpg.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\rnwt wtfv\\xwo9pcozhs2j1pji.jpg.bd")) returned 1 [0095.277] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\_kLE.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\_kle.gif"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\_kLE.gif.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\_kle.gif.bd")) returned 1 [0095.290] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\d6hd4z.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\d6hd4z.avi"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\d6hd4z.avi.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\d6hd4z.avi.bd")) returned 1 [0095.300] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\aDgGVw.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\adggvw.mp4"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\aDgGVw.mp4.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\adggvw.mp4.bd")) returned 1 [0095.305] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\CXjLuVB-McjiWbqgg.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\cxjluvb-mcjiwbqgg.mkv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\CXjLuVB-McjiWbqgg.mkv.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\cxjluvb-mcjiwbqgg.mkv.bd")) returned 1 [0095.309] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\lhJnTNqx6T00mhUcO3.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\lhjntnqx6t00mhuco3.mkv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\lhJnTNqx6T00mhUcO3.mkv.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\lhjntnqx6t00mhuco3.mkv.bd")) returned 1 [0095.315] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\Nh6BD.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\nh6bd.avi"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\Nh6BD.avi.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\nh6bd.avi.bd")) returned 1 [0095.319] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\NlRtIQkZvs6BaK.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\nlrtiqkzvs6bak.flv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\NlRtIQkZvs6BaK.flv.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\nlrtiqkzvs6bak.flv.bd")) returned 1 [0095.366] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\p1gzeQrH_McP_JvKVkPg.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\p1gzeqrh_mcp_jvkvkpg.mp4"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\p1gzeQrH_McP_JvKVkPg.mp4.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\p1gzeqrh_mcp_jvkvkpg.mp4.bd")) returned 1 [0095.374] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\CoZwavX-r.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\cozwavx-r.mp4"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\CoZwavX-r.mp4.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\cozwavx-r.mp4.bd")) returned 1 [0095.378] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\hNLPPx0_8rQoON.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\hnlppx0_8rqoon.mkv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\hNLPPx0_8rQoON.mkv.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\hnlppx0_8rqoon.mkv.bd")) returned 1 [0095.383] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\n4nU6oZ5Wn0pXNewD0.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\n4nu6oz5wn0pxnewd0.flv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\n4nU6oZ5Wn0pXNewD0.flv.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\n4nu6oz5wn0pxnewd0.flv.bd")) returned 1 [0095.388] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\OSvsgc3guuRlcgE7.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\osvsgc3guurlcge7.flv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\OSvsgc3guuRlcgE7.flv.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\osvsgc3guurlcge7.flv.bd")) returned 1 [0095.395] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\pViO94j01HMr\\4YHM uF cJcQI8mH.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\pvio94j01hmr\\4yhm uf cjcqi8mh.mkv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\pViO94j01HMr\\4YHM uF cJcQI8mH.mkv.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\pvio94j01hmr\\4yhm uf cjcqi8mh.mkv.bd")) returned 1 [0095.402] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\pViO94j01HMr\\9sHjVWa AFM6Oz.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\pvio94j01hmr\\9shjvwa afm6oz.mkv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\pViO94j01HMr\\9sHjVWa AFM6Oz.mkv.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\pvio94j01hmr\\9shjvwa afm6oz.mkv.bd")) returned 1 [0095.405] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\pViO94j01HMr\\D6HMw_XP832F.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\pvio94j01hmr\\d6hmw_xp832f.mkv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\pViO94j01HMr\\D6HMw_XP832F.mkv.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\pvio94j01hmr\\d6hmw_xp832f.mkv.bd")) returned 1 [0095.410] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\pViO94j01HMr\\gbDdey_y2Pm.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\pvio94j01hmr\\gbddey_y2pm.flv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\pViO94j01HMr\\gbDdey_y2Pm.flv.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\pvio94j01hmr\\gbddey_y2pm.flv.bd")) returned 1 [0095.416] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\pViO94j01HMr\\IObwzUdt2J.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\pvio94j01hmr\\iobwzudt2j.mkv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\pViO94j01HMr\\IObwzUdt2J.mkv.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\pvio94j01hmr\\iobwzudt2j.mkv.bd")) returned 1 [0095.418] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\pViO94j01HMr\\NGkOxe.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\pvio94j01hmr\\ngkoxe.avi"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\pViO94j01HMr\\NGkOxe.avi.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\pvio94j01hmr\\ngkoxe.avi.bd")) returned 1 [0095.901] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\pViO94j01HMr\\xvbu4I 87biq_nW1Szo5.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\pvio94j01hmr\\xvbu4i 87biq_nw1szo5.mp4"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\pViO94j01HMr\\xvbu4I 87biq_nW1Szo5.mp4.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\pvio94j01hmr\\xvbu4i 87biq_nw1szo5.mp4.bd")) returned 1 [0095.909] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\sgZbEs\\7lDp4MNiUOFeiDoLj0sy.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\sgzbes\\7ldp4mniuofeidolj0sy.flv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\sgZbEs\\7lDp4MNiUOFeiDoLj0sy.flv.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\sgzbes\\7ldp4mniuofeidolj0sy.flv.bd")) returned 1 [0095.915] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\sgZbEs\\IMwDLseNr-mY05xK9 v.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\sgzbes\\imwdlsenr-my05xk9 v.flv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\sgZbEs\\IMwDLseNr-mY05xK9 v.flv.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\sgzbes\\imwdlsenr-my05xk9 v.flv.bd")) returned 1 [0095.921] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\sgZbEs\\QibSLgbiKOOP.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\sgzbes\\qibslgbikoop.avi"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\sgZbEs\\QibSLgbiKOOP.avi.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\sgzbes\\qibslgbikoop.avi.bd")) returned 1 [0095.925] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\x6tmOwd.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\x6tmowd.mp4"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\tsfa8X60WGpQ_34jVTzl\\x6tmOwd.mp4.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\tsfa8x60wgpq_34jvtzl\\x6tmowd.mp4.bd")) returned 1 [0095.978] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\ZMls-Z2YBJAxxn.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\zmls-z2ybjaxxn.avi"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\O1YDSM61Qu\\ZMls-Z2YBJAxxn.avi.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\o1ydsm61qu\\zmls-z2ybjaxxn.avi.bd")) returned 1 [0095.983] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\PcPJ-DFl.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\pcpj-dfl.mp4"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\PcPJ-DFl.mp4.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\pcpj-dfl.mp4.bd")) returned 1 [0095.987] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\qumKJG7UFw 2fq.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\qumkjg7ufw 2fq.avi"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\qumKJG7UFw 2fq.avi.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\qumkjg7ufw 2fq.avi.bd")) returned 1 [0095.991] MoveFileA (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\VgHc4D.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\vghc4d.flv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\VgHc4D.flv.BD" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\vghc4d.flv.bd")) returned 1 [0099.162] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0099.165] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0099.165] CloseHandle (hObject=0x1d0) returned 1 [0112.371] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_lrg.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_lrg.gif.bd")) returned 1 [0112.387] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg.bd")) returned 1 [0112.393] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\aspx_file.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\aspx_file.gif.bd")) returned 1 [0112.400] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\branding_full2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\branding_full2.gif.bd")) returned 1 [0112.408] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\darkblue_grad.jpg.bd")) returned 1 [0112.411] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif.bd")) returned 1 [0112.414] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\folder.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\folder.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\folder.gif.bd")) returned 1 [0112.416] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onblue.gif.bd")) returned 1 [0112.423] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onwhite.gif.bd")) returned 1 [0112.427] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\headergradient_tall.gif.bd")) returned 1 [0112.463] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\help.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\help.jpg.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\help.jpg.bd")) returned 1 [0112.469] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\helpicon_solid.gif.bd")) returned 1 [0112.476] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\image1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image1.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\image1.gif.bd")) returned 1 [0112.480] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\image2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image2.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\image2.gif.bd")) returned 1 [0112.487] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\requiredbang.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\requiredbang.gif.bd")) returned 1 [0112.489] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\security_watermark.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\security_watermark.jpg.bd")) returned 1 [0112.491] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif.bd")) returned 1 [0112.493] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif.bd")) returned 1 [0112.494] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif.bd")) returned 1 [0112.502] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\topgradrepeat.jpg.bd")) returned 1 [0112.504] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif.bd")) returned 1 [0112.506] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif.bd")) returned 1 [0112.515] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\yellowcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\yellowcorner.gif.bd")) returned 1 [0112.868] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif.bd")) returned 1 [0112.874] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg.bd")) returned 1 [0112.881] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif.bd")) returned 1 [0112.887] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif.bd")) returned 1 [0112.896] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg.bd")) returned 1 [0112.904] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif.bd")) returned 1 [0112.910] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif.bd")) returned 1 [0112.913] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif.bd")) returned 1 [0112.919] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif.bd")) returned 1 [0112.924] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif.bd")) returned 1 [0112.930] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg.bd")) returned 1 [0112.936] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif.bd")) returned 1 [0112.943] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif.bd")) returned 1 [0112.949] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif.bd")) returned 1 [0112.957] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif.bd")) returned 1 [0112.960] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg.bd")) returned 1 [0112.966] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif.bd")) returned 1 [0112.970] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif.bd")) returned 1 [0112.973] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif.bd")) returned 1 [0112.981] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg.bd")) returned 1 [0112.998] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif.bd")) returned 1 [0113.002] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif.bd")) returned 1 [0113.009] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif.bd")) returned 1 [0113.297] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_lrg.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_lrg.gif.bd")) returned 1 [0113.301] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_sml.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_sml.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_sml.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_sml.gif.bd")) returned 1 [0113.306] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg.bd")) returned 1 [0113.319] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\aspx_file.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\aspx_file.gif.bd")) returned 1 [0113.323] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\branding_full2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\branding_full2.gif.bd")) returned 1 [0113.330] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\darkblue_grad.jpg.bd")) returned 1 [0113.332] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif.bd")) returned 1 [0113.337] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\folder.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\folder.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\folder.gif.bd")) returned 1 [0113.339] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onblue.gif.bd")) returned 1 [0113.342] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onwhite.gif.bd")) returned 1 [0113.346] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\headergradient_tall.gif.bd")) returned 1 [0113.351] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\help.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\help.jpg.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\help.jpg.bd")) returned 1 [0113.356] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\helpicon_solid.gif.bd")) returned 1 [0113.361] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\image1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image1.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\image1.gif.bd")) returned 1 [0113.365] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\image2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image2.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\image2.gif.bd")) returned 1 [0113.370] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\requiredbang.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\requiredbang.gif.bd")) returned 1 [0113.372] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\security_watermark.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\security_watermark.jpg.bd")) returned 1 [0113.374] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif.bd")) returned 1 [0113.376] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif.bd")) returned 1 [0113.378] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif.bd")) returned 1 [0113.382] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\topgradrepeat.jpg.bd")) returned 1 [0113.389] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif.bd")) returned 1 [0113.392] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif.bd")) returned 1 [0113.396] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\yellowcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\yellowcorner.gif.bd")) returned 1 [0114.539] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif.bd")) returned 1 [0114.541] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_sml.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_sml.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_sml.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_sml.gif.bd")) returned 1 [0114.547] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg.bd")) returned 1 [0114.550] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif.bd")) returned 1 [0114.555] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif.bd")) returned 1 [0114.559] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg.bd")) returned 1 [0114.564] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif.bd")) returned 1 [0114.571] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif.bd")) returned 1 [0114.574] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif.bd")) returned 1 [0114.620] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif.bd")) returned 1 [0114.643] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif.bd")) returned 1 [0114.647] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg.bd")) returned 1 [0114.652] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif.bd")) returned 1 [0114.655] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif.bd")) returned 1 [0114.657] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif.bd")) returned 1 [0114.660] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif.bd")) returned 1 [0114.661] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg.bd")) returned 1 [0114.663] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif.bd")) returned 1 [0114.668] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif.bd")) returned 1 [0114.674] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif.bd")) returned 1 [0114.678] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg.bd")) returned 1 [0114.680] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif.bd")) returned 1 [0114.682] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif.bd")) returned 1 [0114.685] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif.BD" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif.bd")) returned 1 [0116.213] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk.bd")) returned 1 [0116.236] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk.bd")) returned 1 [0116.242] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk.bd")) returned 1 [0116.249] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk.bd")) returned 1 [0116.253] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk.bd")) returned 1 [0116.258] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk.bd")) returned 1 [0116.271] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk.bd")) returned 1 [0116.278] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk.bd")) returned 1 [0116.284] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk.bd")) returned 1 [0116.289] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk.bd")) returned 1 [0116.296] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk.bd")) returned 1 [0116.301] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk.bd")) returned 1 [0116.304] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - Network Connections.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - network connections.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - Network Connections.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - network connections.lnk.bd")) returned 1 [0116.308] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk.bd")) returned 1 [0116.313] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - System.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - system.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - System.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - system.lnk.bd")) returned 1 [0116.320] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk.bd")) returned 1 [0116.324] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - Power Options.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - power options.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - Power Options.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - power options.lnk.bd")) returned 1 [0116.328] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk.bd")) returned 1 [0116.332] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - Programs and Features.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - programs and features.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - Programs and Features.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - programs and features.lnk.bd")) returned 1 [0116.356] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.bd")) returned 1 [0116.360] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.bd")) returned 1 [0116.370] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.bd")) returned 1 [0116.385] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk.bd")) returned 1 [0116.390] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk.bd")) returned 1 [0116.394] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk.bd")) returned 1 [0116.402] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.bd")) returned 1 [0116.414] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk.bd")) returned 1 [0116.420] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk.bd")) returned 1 [0116.423] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk.bd")) returned 1 [0116.427] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Apps.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\default apps.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Apps.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\default apps.lnk.bd")) returned 1 [0116.432] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Devices.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\devices.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Devices.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\devices.lnk.bd")) returned 1 [0116.435] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk.bd")) returned 1 [0116.438] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk.bd")) returned 1 [0116.445] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk.bd")) returned 1 [0116.449] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk.bd")) returned 1 [0116.454] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk.bd")) returned 1 [0116.462] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk.bd")) returned 1 [0116.486] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk.bd")) returned 1 [0116.495] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk.bd")) returned 1 [0116.501] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk.bd")) returned 1 [0116.505] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk.bd")) returned 1 [0116.509] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk.bd")) returned 1 [0116.512] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk.bd")) returned 1 [0116.546] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk.bd")) returned 1 [0116.551] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk.bd")) returned 1 [0116.557] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk.bd")) returned 1 [0116.562] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk.bd")) returned 1 [0116.570] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk.bd")) returned 1 [0116.574] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk.bd")) returned 1 [0116.580] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - Network Connections.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - network connections.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - Network Connections.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - network connections.lnk.bd")) returned 1 [0116.584] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk.bd")) returned 1 [0116.587] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - System.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - system.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - System.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - system.lnk.bd")) returned 1 [0116.591] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk.bd")) returned 1 [0116.595] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - Power Options.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - power options.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - Power Options.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - power options.lnk.bd")) returned 1 [0116.598] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk.bd")) returned 1 [0116.602] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - Programs and Features.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - programs and features.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - Programs and Features.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - programs and features.lnk.bd")) returned 1 [0116.630] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.bd")) returned 1 [0116.634] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.bd")) returned 1 [0116.644] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.bd")) returned 1 [0116.656] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk.bd")) returned 1 [0116.659] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk.bd")) returned 1 [0116.663] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk.bd")) returned 1 [0116.668] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.bd")) returned 1 [0116.679] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk.bd")) returned 1 [0116.682] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk.bd")) returned 1 [0116.685] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk.bd")) returned 1 [0116.688] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Apps.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\default apps.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Apps.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\default apps.lnk.bd")) returned 1 [0116.692] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Devices.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\devices.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Devices.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\devices.lnk.bd")) returned 1 [0116.695] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk.bd")) returned 1 [0116.699] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk.bd")) returned 1 [0116.707] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk.bd")) returned 1 [0116.712] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk.bd")) returned 1 [0116.718] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk.bd")) returned 1 [0116.722] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk.BD" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk.bd")) returned 1 [0118.464] MoveFileA (lpExistingFileName="C:\\Windows\\ShellNew\\EXCEL12.XLSX" (normalized: "c:\\windows\\shellnew\\excel12.xlsx"), lpNewFileName="C:\\Windows\\ShellNew\\EXCEL12.XLSX.BD" (normalized: "c:\\windows\\shellnew\\excel12.xlsx.bd")) returned 1 [0122.262] WriteFile (in: hFile=0x1d0, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0122.265] SetFileTime (hFile=0x1d0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0122.265] CloseHandle (hObject=0x1d0) returned 1 [0123.416] SetFileTime (hFile=0x1d4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0123.416] CloseHandle (hObject=0x1d4) returned 1 [0128.816] WriteFile (in: hFile=0x1c8, lpBuffer=0x638fe0*, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x638fe0*, lpNumberOfBytesWritten=0x406561*=0x26f, lpOverlapped=0x0) returned 1 [0128.819] SetFileTime (hFile=0x1c8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0128.820] CloseHandle (hObject=0x1c8) returned 1 [0132.919] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_eventviewersettings_31bf3856ad364e35_10.0.10586.0_none_817d705fae0a5733\\Event Viewer.lnk" (normalized: "c:\\windows\\winsxs\\amd64_eventviewersettings_31bf3856ad364e35_10.0.10586.0_none_817d705fae0a5733\\event viewer.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_eventviewersettings_31bf3856ad364e35_10.0.10586.0_none_817d705fae0a5733\\Event Viewer.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_eventviewersettings_31bf3856ad364e35_10.0.10586.0_none_817d705fae0a5733\\event viewer.lnk.bd")) returned 0 [0135.721] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.10586.0_none_67772984f550f61f\\Steps Recorder.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.10586.0_none_67772984f550f61f\\steps recorder.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.10586.0_none_67772984f550f61f\\Steps Recorder.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.10586.0_none_67772984f550f61f\\steps recorder.lnk.bd")) returned 0 [0135.769] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.10586.0_none_3b6c733895d68477\\Task Manager.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.10586.0_none_3b6c733895d68477\\task manager.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.10586.0_none_3b6c733895d68477\\Task Manager.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.10586.0_none_3b6c733895d68477\\task manager.lnk.bd")) returned 0 [0136.644] WriteFile (in: hFile=0xffffffff, lpBuffer=0x638fe0, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0136.644] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0136.644] CloseHandle (hObject=0xffffffff) returned 1 [0136.850] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-c..s-admin-compsvclink_31bf3856ad364e35_10.0.10586.0_none_5f17ea2284d04ef8\\Component Services.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-c..s-admin-compsvclink_31bf3856ad364e35_10.0.10586.0_none_5f17ea2284d04ef8\\component services.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-c..s-admin-compsvclink_31bf3856ad364e35_10.0.10586.0_none_5f17ea2284d04ef8\\Component Services.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-c..s-admin-compsvclink_31bf3856ad364e35_10.0.10586.0_none_5f17ea2284d04ef8\\component services.lnk.bd")) returned 0 [0137.079] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_10.0.10586.0_none_d79bb88420ae2d66\\Computer Management.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_10.0.10586.0_none_d79bb88420ae2d66\\computer management.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_10.0.10586.0_none_d79bb88420ae2d66\\Computer Management.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_10.0.10586.0_none_d79bb88420ae2d66\\computer management.lnk.bd")) returned 0 [0137.456] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.10586.0_none_7edf55b74eb25a19\\Character Map.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.10586.0_none_7edf55b74eb25a19\\character map.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.10586.0_none_7edf55b74eb25a19\\Character Map.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.10586.0_none_7edf55b74eb25a19\\character map.lnk.bd")) returned 0 [0137.476] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.10586.0_none_f9c9ceba07e30464\\Disk Cleanup.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.10586.0_none_f9c9ceba07e30464\\disk cleanup.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.10586.0_none_f9c9ceba07e30464\\Disk Cleanup.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.10586.0_none_f9c9ceba07e30464\\disk cleanup.lnk.bd")) returned 0 [0137.596] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-commandprompt-shortcut_31bf3856ad364e35_10.0.10586.0_none_c643edf99966f12f\\Command Prompt.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-commandprompt-shortcut_31bf3856ad364e35_10.0.10586.0_none_c643edf99966f12f\\command prompt.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-commandprompt-shortcut_31bf3856ad364e35_10.0.10586.0_none_c643edf99966f12f\\Command Prompt.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-commandprompt-shortcut_31bf3856ad364e35_10.0.10586.0_none_c643edf99966f12f\\command prompt.lnk.bd")) returned 0 [0138.323] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.10586.0_none_259ba7173a9c269a\\dfrgui.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.10586.0_none_259ba7173a9c269a\\dfrgui.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.10586.0_none_259ba7173a9c269a\\dfrgui.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.10586.0_none_259ba7173a9c269a\\dfrgui.lnk.bd")) returned 0 [0139.192] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\01 - Command Prompt.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\01 - command prompt.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\01 - Command Prompt.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\01 - command prompt.lnk.bd")) returned 0 [0139.195] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\01 - File Explorer.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\01 - file explorer.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\01 - File Explorer.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\01 - file explorer.lnk.bd")) returned 0 [0139.196] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\01a - Windows PowerShell.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\01a - windows powershell.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\01a - Windows PowerShell.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\01a - windows powershell.lnk.bd")) returned 0 [0139.200] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\02 - Command Prompt.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\02 - command prompt.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\02 - Command Prompt.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\02 - command prompt.lnk.bd")) returned 0 [0139.201] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\02a - Windows PowerShell.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\02a - windows powershell.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\02a - Windows PowerShell.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\02a - windows powershell.lnk.bd")) returned 0 [0139.203] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\03 - Computer Management.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\03 - computer management.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\03 - Computer Management.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\03 - computer management.lnk.bd")) returned 0 [0139.204] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\03 - Documents.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\03 - documents.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\03 - Documents.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\03 - documents.lnk.bd")) returned 0 [0139.206] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\04 - Disk Management.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\04 - disk management.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\04 - Disk Management.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\04 - disk management.lnk.bd")) returned 0 [0139.207] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\04 - Downloads.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\04 - downloads.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\04 - Downloads.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\04 - downloads.lnk.bd")) returned 0 [0139.208] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\04-1 - Network Connections.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\04-1 - network connections.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\04-1 - Network Connections.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\04-1 - network connections.lnk.bd")) returned 0 [0139.210] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\05 - Device Manager.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\05 - device manager.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\05 - Device Manager.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\05 - device manager.lnk.bd")) returned 0 [0139.211] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\05 - Music.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\05 - music.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\05 - Music.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\05 - music.lnk.bd")) returned 0 [0139.212] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\06 - Pictures.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\06 - pictures.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\06 - Pictures.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\06 - pictures.lnk.bd")) returned 0 [0139.214] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\06 - System.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\06 - system.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\06 - System.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\06 - system.lnk.bd")) returned 0 [0139.233] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\07 - Event Viewer.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\07 - event viewer.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\07 - Event Viewer.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\07 - event viewer.lnk.bd")) returned 0 [0139.235] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\07 - Videos.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\07 - videos.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\07 - Videos.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\07 - videos.lnk.bd")) returned 0 [0139.237] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\08 - Homegroup.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\08 - homegroup.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\08 - Homegroup.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\08 - homegroup.lnk.bd")) returned 0 [0139.238] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\08 - Power Options.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\08 - power options.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\08 - Power Options.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\08 - power options.lnk.bd")) returned 0 [0139.240] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\09 - Mobility Center.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\09 - mobility center.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\09 - Mobility Center.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\09 - mobility center.lnk.bd")) returned 0 [0139.241] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\09 - Network.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\09 - network.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\09 - Network.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\09 - network.lnk.bd")) returned 0 [0139.242] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\1 - Desktop.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\1 - desktop.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\1 - Desktop.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\1 - desktop.lnk.bd")) returned 0 [0139.244] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\1 - Run.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\1 - run.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\1 - Run.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\1 - run.lnk.bd")) returned 0 [0139.252] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\10 - Programs and Features.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\10 - programs and features.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\10 - Programs and Features.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\10 - programs and features.lnk.bd")) returned 0 [0139.254] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\10 - UserProfile.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\10 - userprofile.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\10 - UserProfile.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\10 - userprofile.lnk.bd")) returned 0 [0139.256] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\2 - Search.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\2 - search.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\2 - Search.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\2 - search.lnk.bd")) returned 0 [0139.257] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\3 - Windows Explorer.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\3 - windows explorer.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\3 - Windows Explorer.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\3 - windows explorer.lnk.bd")) returned 0 [0139.259] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\4 - Control Panel.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\4 - control panel.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\4 - Control Panel.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\4 - control panel.lnk.bd")) returned 0 [0139.260] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\5 - Task Manager.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\5 - task manager.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\5 - Task Manager.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\5 - task manager.lnk.bd")) returned 0 [0139.262] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\computer.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\computer.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\computer.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\computer.lnk.bd")) returned 0 [0139.264] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\Control Panel.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\control panel.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\Control Panel.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\control panel.lnk.bd")) returned 0 [0139.265] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\Default Apps.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\default apps.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\Default Apps.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\default apps.lnk.bd")) returned 0 [0139.266] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\Devices.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\devices.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\Devices.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\devices.lnk.bd")) returned 0 [0139.268] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\File Explorer.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\file explorer.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\File Explorer.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\file explorer.lnk.bd")) returned 0 [0139.269] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\Run.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\run.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\Run.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\run.lnk.bd")) returned 0 [0139.270] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\Shows Desktop.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\shows desktop.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\Shows Desktop.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\shows desktop.lnk.bd")) returned 0 [0139.271] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\Window Switcher.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\window switcher.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\Window Switcher.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.10586.0_none_443d824ebb4341e2\\window switcher.lnk.bd")) returned 0 [0139.291] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.10586.0_none_057f44bfd2bd9812\\Fax Recipient.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.10586.0_none_057f44bfd2bd9812\\fax recipient.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.10586.0_none_057f44bfd2bd9812\\Fax Recipient.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.10586.0_none_057f44bfd2bd9812\\fax recipient.lnk.bd")) returned 0 [0139.295] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.10586.0_none_057f44bfd2bd9812\\Windows Fax and Scan.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.10586.0_none_057f44bfd2bd9812\\windows fax and scan.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.10586.0_none_057f44bfd2bd9812\\Windows Fax and Scan.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.10586.0_none_057f44bfd2bd9812\\windows fax and scan.lnk.bd")) returned 0 [0141.137] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.10586.0_none_6470c30a06691255\\iSCSI Initiator.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.10586.0_none_6470c30a06691255\\iscsi initiator.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.10586.0_none_6470c30a06691255\\iSCSI Initiator.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.10586.0_none_6470c30a06691255\\iscsi initiator.lnk.bd")) returned 0 [0141.344] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.10586.0_none_d0d57fb6e80e3f5e\\ODBC Data Sources (64-bit).lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.10586.0_none_d0d57fb6e80e3f5e\\odbc data sources (64-bit).lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.10586.0_none_d0d57fb6e80e3f5e\\ODBC Data Sources (64-bit).lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.10586.0_none_d0d57fb6e80e3f5e\\odbc data sources (64-bit).lnk.bd")) returned 0 [0141.435] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.10586.0_none_205c3495240eb77a\\Memory Diagnostics Tool.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.10586.0_none_205c3495240eb77a\\memory diagnostics tool.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.10586.0_none_205c3495240eb77a\\Memory Diagnostics Tool.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.10586.0_none_205c3495240eb77a\\memory diagnostics tool.lnk.bd")) returned 0 [0142.927] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.10586.0_none_fab36fc5430712f4\\Magnify.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.10586.0_none_fab36fc5430712f4\\magnify.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.10586.0_none_fab36fc5430712f4\\Magnify.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.10586.0_none_fab36fc5430712f4\\magnify.lnk.bd")) returned 0 [0143.046] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-mediaplayer-shortcut_31bf3856ad364e35_10.0.10586.0_none_3b570a9cf80c90b7\\Windows Media Player.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-mediaplayer-shortcut_31bf3856ad364e35_10.0.10586.0_none_3b570a9cf80c90b7\\windows media player.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-mediaplayer-shortcut_31bf3856ad364e35_10.0.10586.0_none_3b570a9cf80c90b7\\Windows Media Player.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-mediaplayer-shortcut_31bf3856ad364e35_10.0.10586.0_none_3b570a9cf80c90b7\\windows media player.lnk.bd")) returned 0 [0143.663] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.10586.0_none_66ffd6dc481743c2\\System Configuration.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.10586.0_none_66ffd6dc481743c2\\system configuration.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.10586.0_none_66ffd6dc481743c2\\System Configuration.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.10586.0_none_66ffd6dc481743c2\\system configuration.lnk.bd")) returned 0 [0143.713] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.10586.0_none_3861ff2fa4057c69\\System Information.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.10586.0_none_3861ff2fa4057c69\\system information.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.10586.0_none_3861ff2fa4057c69\\System Information.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.10586.0_none_3861ff2fa4057c69\\system information.lnk.bd")) returned 0 [0143.803] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.10586.0_none_1aa31efd98e8ec4b\\Paint.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.10586.0_none_1aa31efd98e8ec4b\\paint.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.10586.0_none_1aa31efd98e8ec4b\\Paint.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.10586.0_none_1aa31efd98e8ec4b\\paint.lnk.bd")) returned 0 [0144.102] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.10586.0_none_4aa371494e102b6a\\Narrator.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.10586.0_none_4aa371494e102b6a\\narrator.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.10586.0_none_4aa371494e102b6a\\Narrator.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.10586.0_none_4aa371494e102b6a\\narrator.lnk.bd")) returned 0 [0144.352] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.10586.0_none_fba025d41a56eea4\\Notepad.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.10586.0_none_fba025d41a56eea4\\notepad.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.10586.0_none_fba025d41a56eea4\\Notepad.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.10586.0_none_fba025d41a56eea4\\notepad.lnk.bd")) returned 0 [0144.442] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-osk_31bf3856ad364e35_10.0.10586.0_none_37426bc50445e4b2\\On-Screen Keyboard.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-osk_31bf3856ad364e35_10.0.10586.0_none_37426bc50445e4b2\\on-screen keyboard.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-osk_31bf3856ad364e35_10.0.10586.0_none_37426bc50445e4b2\\On-Screen Keyboard.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-osk_31bf3856ad364e35_10.0.10586.0_none_37426bc50445e4b2\\on-screen keyboard.lnk.bd")) returned 0 [0144.497] FindFirstFileA (in: lpFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-p..cemanager.resources_31bf3856ad364e35_10.0.10586.0_en-us_2e099bbad121e2a9\\*.*" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-p..cemanager.resources_31bf3856ad364e35_10.0.10586.0_en-us_2e099bbad121e2a9\\*.*"), lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c9388af, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9c9388af, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9c9388af, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x636ab0 [0144.573] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-p..erandprintui-pmcppc_31bf3856ad364e35_10.0.10586.0_none_97edda452b08d8b9\\Print Management.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-p..erandprintui-pmcppc_31bf3856ad364e35_10.0.10586.0_none_97edda452b08d8b9\\print management.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-p..erandprintui-pmcppc_31bf3856ad364e35_10.0.10586.0_none_97edda452b08d8b9\\Print Management.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-p..erandprintui-pmcppc_31bf3856ad364e35_10.0.10586.0_none_97edda452b08d8b9\\print management.lnk.bd")) returned 0 [0144.936] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.10586.0_none_288f56844b4b2341\\Performance Monitor.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.10586.0_none_288f56844b4b2341\\performance monitor.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.10586.0_none_288f56844b4b2341\\Performance Monitor.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.10586.0_none_288f56844b4b2341\\performance monitor.lnk.bd")) returned 0 [0144.939] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.10586.0_none_288f56844b4b2341\\Resource Monitor.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.10586.0_none_288f56844b4b2341\\resource monitor.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.10586.0_none_288f56844b4b2341\\Resource Monitor.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.10586.0_none_288f56844b4b2341\\resource monitor.lnk.bd")) returned 0 [0144.991] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-powershell-ise_31bf3856ad364e35_10.0.10586.0_none_f56b55eaacaec7c6\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-powershell-ise_31bf3856ad364e35_10.0.10586.0_none_f56b55eaacaec7c6\\windows powershell ise (x86).lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-powershell-ise_31bf3856ad364e35_10.0.10586.0_none_f56b55eaacaec7c6\\Windows PowerShell ISE (x86).lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-powershell-ise_31bf3856ad364e35_10.0.10586.0_none_f56b55eaacaec7c6\\windows powershell ise (x86).lnk.bd")) returned 0 [0144.994] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-powershell-ise_31bf3856ad364e35_10.0.10586.0_none_f56b55eaacaec7c6\\Windows PowerShell ISE.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-powershell-ise_31bf3856ad364e35_10.0.10586.0_none_f56b55eaacaec7c6\\windows powershell ise.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-powershell-ise_31bf3856ad364e35_10.0.10586.0_none_f56b55eaacaec7c6\\Windows PowerShell ISE.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-powershell-ise_31bf3856ad364e35_10.0.10586.0_none_f56b55eaacaec7c6\\windows powershell ise.lnk.bd")) returned 0 [0146.055] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-s..ment-policytools-ex_31bf3856ad364e35_10.0.10586.0_none_e5e4edf6eb6cd204\\Security Configuration Management.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-s..ment-policytools-ex_31bf3856ad364e35_10.0.10586.0_none_e5e4edf6eb6cd204\\security configuration management.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-s..ment-policytools-ex_31bf3856ad364e35_10.0.10586.0_none_e5e4edf6eb6cd204\\Security Configuration Management.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-s..ment-policytools-ex_31bf3856ad364e35_10.0.10586.0_none_e5e4edf6eb6cd204\\security configuration management.lnk.bd")) returned 0 [0147.176] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_10.0.10586.0_none_5be97afcf0121814\\services.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_10.0.10586.0_none_5be97afcf0121814\\services.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_10.0.10586.0_none_5be97afcf0121814\\services.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_10.0.10586.0_none_5be97afcf0121814\\services.lnk.bd")) returned 0 [0147.565] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.10586.0_none_26499a8833fa2713\\Snipping Tool.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.10586.0_none_26499a8833fa2713\\snipping tool.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.10586.0_none_26499a8833fa2713\\Snipping Tool.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.10586.0_none_26499a8833fa2713\\snipping tool.lnk.bd")) returned 0 [0147.596] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.10586.0_none_a88f8863f623d2ed\\Speech Recognition.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.10586.0_none_a88f8863f623d2ed\\speech recognition.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.10586.0_none_a88f8863f623d2ed\\Speech Recognition.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.10586.0_none_a88f8863f623d2ed\\speech recognition.lnk.bd")) returned 0 [0147.659] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-stickynotes-app_31bf3856ad364e35_10.0.10586.0_none_79cc4f5663a2c321\\Sticky Notes.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-stickynotes-app_31bf3856ad364e35_10.0.10586.0_none_79cc4f5663a2c321\\sticky notes.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-stickynotes-app_31bf3856ad364e35_10.0.10586.0_none_79cc4f5663a2c321\\Sticky Notes.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-stickynotes-app_31bf3856ad364e35_10.0.10586.0_none_79cc4f5663a2c321\\sticky notes.lnk.bd")) returned 0 [0147.700] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-sud-link_31bf3856ad364e35_10.0.10586.0_none_5bb3b3b77727a42e\\Default Programs.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-sud-link_31bf3856ad364e35_10.0.10586.0_none_5bb3b3b77727a42e\\default programs.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-sud-link_31bf3856ad364e35_10.0.10586.0_none_5bb3b3b77727a42e\\Default Programs.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-sud-link_31bf3856ad364e35_10.0.10586.0_none_5bb3b3b77727a42e\\default programs.lnk.bd")) returned 0 [0147.883] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-t..etpc-mathinputpanel_31bf3856ad364e35_10.0.10586.0_none_57271b70fb42a4a1\\Math Input Panel.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-t..etpc-mathinputpanel_31bf3856ad364e35_10.0.10586.0_none_57271b70fb42a4a1\\math input panel.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-t..etpc-mathinputpanel_31bf3856ad364e35_10.0.10586.0_none_57271b70fb42a4a1\\Math Input Panel.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-t..etpc-mathinputpanel_31bf3856ad364e35_10.0.10586.0_none_57271b70fb42a4a1\\math input panel.lnk.bd")) returned 0 [0147.985] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.10586.0_none_da61e5edcb6ec32f\\Remote Desktop Connection.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.10586.0_none_da61e5edcb6ec32f\\remote desktop connection.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.10586.0_none_da61e5edcb6ec32f\\Remote Desktop Connection.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.10586.0_none_da61e5edcb6ec32f\\remote desktop connection.lnk.bd")) returned 0 [0148.276] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_10.0.10586.0_none_a43720aa4eef6916\\Windows Journal.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_10.0.10586.0_none_a43720aa4eef6916\\windows journal.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_10.0.10586.0_none_a43720aa4eef6916\\Windows Journal.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_10.0.10586.0_none_a43720aa4eef6916\\windows journal.lnk.bd")) returned 0 [0149.539] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.10586.0_none_ba40118c173cb7f2\\Wordpad.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.10586.0_none_ba40118c173cb7f2\\wordpad.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.10586.0_none_ba40118c173cb7f2\\Wordpad.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.10586.0_none_ba40118c173cb7f2\\wordpad.lnk.bd")) returned 0 [0149.683] GetFileSize (in: hFile=0x1c8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x462 [0149.684] GetFileTime (in: hFile=0x1c8, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5835376d, dwHighDateTime=0x1d112e3), lpLastAccessTime=0x407536*(dwLowDateTime=0x5835376d, dwHighDateTime=0x1d112e3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5835376d, dwHighDateTime=0x1d112e3)) returned 1 [0149.684] SetFilePointer (in: hFile=0x1c8, lDistanceToMove=92, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c [0149.684] ReadFile (in: hFile=0x1c8, lpBuffer=0x1f6c020, nNumberOfBytesToRead=0x14e988, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1f6c020*, lpNumberOfBytesRead=0x40655d*=0x406, lpOverlapped=0x0) returned 1 [0149.687] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-xpsreachviewer_31bf3856ad364e35_10.0.10586.0_none_a1a0ebd8f88eb4bf\\XPS Viewer.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-xpsreachviewer_31bf3856ad364e35_10.0.10586.0_none_a1a0ebd8f88eb4bf\\xps viewer.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-xpsreachviewer_31bf3856ad364e35_10.0.10586.0_none_a1a0ebd8f88eb4bf\\XPS Viewer.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-xpsreachviewer_31bf3856ad364e35_10.0.10586.0_none_a1a0ebd8f88eb4bf\\xps viewer.lnk.bd")) returned 0 [0153.212] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_networking-mpssvc-shortcut_31bf3856ad364e35_10.0.10586.0_none_11dc8d62b71c6074\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\windows\\winsxs\\amd64_networking-mpssvc-shortcut_31bf3856ad364e35_10.0.10586.0_none_11dc8d62b71c6074\\windows firewall with advanced security.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_networking-mpssvc-shortcut_31bf3856ad364e35_10.0.10586.0_none_11dc8d62b71c6074\\Windows Firewall with Advanced Security.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_networking-mpssvc-shortcut_31bf3856ad364e35_10.0.10586.0_none_11dc8d62b71c6074\\windows firewall with advanced security.lnk.bd")) returned 0 [0154.094] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_taskschedulersettings_31bf3856ad364e35_10.0.10586.0_none_d7709c22aeb417b7\\Task Scheduler.lnk" (normalized: "c:\\windows\\winsxs\\amd64_taskschedulersettings_31bf3856ad364e35_10.0.10586.0_none_d7709c22aeb417b7\\task scheduler.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_taskschedulersettings_31bf3856ad364e35_10.0.10586.0_none_d7709c22aeb417b7\\Task Scheduler.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_taskschedulersettings_31bf3856ad364e35_10.0.10586.0_none_d7709c22aeb417b7\\task scheduler.lnk.bd")) returned 0 [0154.467] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_windows-defender-ui_31bf3856ad364e35_10.0.10586.0_none_a28eb67a8a54ab2a\\Windows Defender.lnk" (normalized: "c:\\windows\\winsxs\\amd64_windows-defender-ui_31bf3856ad364e35_10.0.10586.0_none_a28eb67a8a54ab2a\\windows defender.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_windows-defender-ui_31bf3856ad364e35_10.0.10586.0_none_a28eb67a8a54ab2a\\Windows Defender.lnk.BD" (normalized: "c:\\windows\\winsxs\\amd64_windows-defender-ui_31bf3856ad364e35_10.0.10586.0_none_a28eb67a8a54ab2a\\windows defender.lnk.bd")) returned 0 [0158.720] GetFileAttributesA (lpFileName="C:\\Windows\\WinSxS\\FileMaps\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\filemaps\\how to decrypt files.txt")) returned 0xffffffff [0158.721] CreateFileA (lpFileName="C:\\Windows\\WinSxS\\FileMaps\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\filemaps\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.722] WriteFile (in: hFile=0xffffffff, lpBuffer=0x638fe0, nNumberOfBytesToWrite=0x26f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0158.722] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0158.722] CloseHandle (hObject=0xffffffff) returned 1 [0177.972] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.10586.0_none_db2a2a091c6f0159\\ODBC Data Sources (32-bit).lnk" (normalized: "c:\\windows\\winsxs\\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.10586.0_none_db2a2a091c6f0159\\odbc data sources (32-bit).lnk"), lpNewFileName="C:\\Windows\\WinSxS\\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.10586.0_none_db2a2a091c6f0159\\ODBC Data Sources (32-bit).lnk.BD" (normalized: "c:\\windows\\winsxs\\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.10586.0_none_db2a2a091c6f0159\\odbc data sources (32-bit).lnk.bd")) returned 0 [0184.051] CreateFileA (lpFileName="C:\\Windows\\WinSxS\\x86_microsoft-windows-wlan-dialog_31bf3856ad364e35_10.0.10586.0_none_401571eadf9eae10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\x86_microsoft-windows-wlan-dialog_31bf3856ad364e35_10.0.10586.0_none_401571eadf9eae10\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.060] CreateFileA (lpFileName="C:\\Windows\\WinSxS\\x86_microsoft-windows-wlanpref_31bf3856ad364e35_10.0.10586.0_none_69f49efe00fb94fa\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\x86_microsoft-windows-wlanpref_31bf3856ad364e35_10.0.10586.0_none_69f49efe00fb94fa\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.219] CreateFileA (lpFileName="C:\\Windows\\WinSxS\\x86_microsoft-windows-write_31bf3856ad364e35_10.0.10586.0_none_8fe9cf04cf119f4a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\x86_microsoft-windows-write_31bf3856ad364e35_10.0.10586.0_none_8fe9cf04cf119f4a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff Thread: id = 2 os_tid = 0x12c0 Thread: id = 3 os_tid = 0x10e4